A method for preventing hard disk formatting based on kernel under window operating system

Abstract

This invention discloses a kernel-based method for preventing hard drive formatting under a Windows operating system, comprising the following steps: creating and setting an Image callback function of the Windows operating system to monitor all processes and modules loaded by the application layer of the Windows operating system and obtain information about each process and module; obtaining the structure RTL_USER_PROCESS_PARAMETERS from the information of the processes and modules; obtaining the string value of the member CommandLine from the structure RTL_USER_PROCESS_PARAMETERS; comparing the string values ​​to determine whether a specific string corresponding to the command to format the hard drive exists; if so, replacing the specific string with a space and returning the structure to the process to ensure that the process does not format the hard drive. This invention belongs to ring 0, where no processes or DLLs exist, making it difficult to uninstall and therefore more secure and reliable.

Description

Technical Field

[0001] This invention belongs to the field of software, and in particular relates to a kernel-based method for preventing hard disk formatting under a Windows operating system. Background Technology

[0002] Formatting a hard drive is a crucial method for erasing data from a computer, but it also poses the greatest risk to data integrity. Once formatted, data recovery is often difficult or requires significant time and expense for even partial recovery. However, the process of formatting is incredibly simple; ordinary users can perform the operation with just a few easy steps. This makes it all the more important to prevent accidental hard drive formatting, malicious manipulation by departing employees, or formatting by hackers in today's data-driven world. Summary of the Invention

[0003] To overcome the above problems, this invention provides a safe and reliable method for preventing hard disk formatting based on the kernel under a Windows operating system.

[0004] The technical solution of this invention is to provide a kernel-based method for preventing hard disk formatting under a Windows operating system. This method is executed at ring 0 level of the Windows operating system and includes the following steps: Create and set the Image callback function of the Windows operating system to monitor all processes and modules loaded by the application layer of the Windows operating system and obtain information about each process and module; obtain the structure RTL_USER_PROCESS_PARAMETERS from the information about the processes and modules; Obtain the string value of the CommandLine member of the RTL_USER_PROCESS_PARAMETERS structure; Compare the string values ​​to determine if a specific string corresponding to the command to format the hard drive exists: If so, replace the specific string with a space and return the structure to the process to ensure that the process does not format the hard drive; If none is found, return immediately to allow the process to continue execution.

[0005] Preferably, the specific string is "c:windowssystem32dllhost.exe / processid:{".

[0006] Preferably, the method for obtaining the corresponding structure RTL_USER_PROCESS_PARAMETERS from the return parameters of the Image callback is as follows: Calling the system function PsGetProcessWow64Process: If the return value is normal, then retrieve the structure RTL_USER_PROCESS_PARAMETERS. If the return value is abnormal, the system function PsGetProcessPeb is called. If the return value is normal, the structure RTL_USER_PROCESS_PARAMETERS is retrieved.

[0007] Preferably, the method for obtaining the corresponding structure RTL_USER_PROCESS_PARAMETERS from the return parameters of the Image callback is as follows: Calling the system function PsGetProcessPeb: If the return value is normal, then retrieve the structure RTL_USER_PROCESS_PARAMETERS. If the return value is abnormal, the system function PsGetProcessWow64Process is called; if the return value is normal, the structure RTL_USER_PROCESS_PARAMETERS is retrieved.

[0008] Preferably, the method begins execution upon startup of the Windows operating system.

[0009] Preferably, the operating system is a 64-bit Windows 10 operating system.

[0010] The method for preventing hard disk formatting based on the kernel under the Windows operating system of the present invention is implemented based on the kernel and belongs to the ring 0 layer. Compared with the application layer (ring 3) technology implementation, there are no processes or DLLs, making it more difficult to uninstall and thus more secure and reliable. Attached Figure Description

[0011] Figure 1 This is a schematic diagram illustrating the principle of the present invention. Detailed Implementation

[0012] The specific embodiments of the present invention will be described in further detail below.

[0013] 1. Technical Foundation We are implementing this based on the current 64-bit Windows 10. In terms of permissions, current operating systems are divided into ring 3 and ring 0. The former is the application layer with low privileges, while the latter is the kernel layer with high privileges, allowing free use of all system resources. Implementing at the kernel layer allows for a higher level of protection. There are many ways to allow a program to execute in ring 0. The most common method is to write a driver program to enter ring 0; another method is to read and write physical memory to access the physical memory where the Global Controller Platform (GDT) resides, generating its own call gates on the GDT to freely enter and exit ring 0. This invention uses the first method, writing a driver program. Detailed implementation information is widely available and is not the focus of this invention. In the kernel, the operating system provides an interface called Image callback (i.e., the PsSetLoadImageNotifyRoutine function). This function allows programs loaded into the kernel to intercept all processes and modules loaded at the application layer. For information on calling the Image callback function, please refer to the relevant documentation on the Microsoft website.

[0014] By analyzing the formatting process, it can be found that it is carried out by a specific command with specific parameters. If the parameters of this command are modified, the formatting of the disk can be prevented.

[0015] 2. See process description. Figure 1 The command analysis process involves the application layer executing a formatted command. The corresponding process retrieves a structure called `RTL_USER_PROCESS_PARAMETERS` in the `Image` callback. This structure is public in 32-bit systems and also public to 64-bit processes in 64-bit systems. However, how the process obtains this structure is not publicly disclosed. We obtained this structure through reverse engineering. The `RTL_USER_PROCESS_PARAMETERS` structure differs between 32-bit and 64-bit processes. The structure of this structure for a 32-bit process in a 64-bit system is as follows: "typedefstruct_RTL_USER_PROCESS_PARAMETERS{ UCHARReserved1

[16] ; PVOIDReserved2

[10] ; UNICODE_STRINGImagePathName; UNICODE_STRINGCommandLine; … }".

[0016] Both 32-bit and 64-bit processes include a member called CommandLine in their structure. When formatting a hard drive, the string "c:\windows\system32\dllhost.exe / processid:{" will appear in this member. Repeated testing has confirmed that if this string is found, simply replacing it with a space will prevent drive formatting and result in no error message. However, replacing it with other characters will cause an error to pop up.

[0017] Its pseudocode is as follows: "Wchar_ts[]=L"c:windowssystem32dllhost.exe / processid:{";

[0039] intlen = wcslen(s) * 2;

[0040] if (CommandLine.Length>len&&memcmp(CommandLine.Buffer,s,len)==0) memset(CommandLine.Buffer,",CommandLine.Length);".

[0018] 3. The method to retrieve the RTL_USER_PROCESS_PARAMETERS structure in the Image callback: First, create and set the Image callback function for the Windows operating system (see Microsoft documentation for creation and setting methods) to monitor module loading at the kernel level, including loading DLL modules, kernel modules, etc., and obtain information about each process and its modules. For the returned process and module information, call the system-provided function PsGetProcessWow64Process to obtain the RTL_USER_PROCESS_PARAMETERS structure; for 64-bit processes, call the system-provided kernel function PsGetProcessPeb. Considering the inability to determine whether it's a 32-bit or 64-bit process, you can first call PsGetProcessWow64Process. If PsGetProcessWow64Process succeeds, there's no need to call PsGetProcessPeb; otherwise, call PsGetProcessPeb; or vice versa. This way, regardless of whether it's a 32-bit or 64-bit process, the RTL_USER_PROCESS_PARAMETERS structure can be successfully obtained.

[0019] The above embodiments are merely one implementation of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this patent should be determined by the appended claims.

Claims

1. A kernel-based method for preventing hard disk formatting under a Windows operating system, characterized in that it is a method executed at ring 0 level of the Windows operating system. Includes the following steps: Create and set the Image callback function of the Windows operating system to monitor all processes and modules loaded by the application layer of the Windows operating system and obtain information about each process and module; obtain the structure RTL_USER_PROCESS_PARAMETERS from the information about the processes and modules; Obtain the string value of the CommandLine member of the RTL_USER_PROCESS_PARAMETERS structure; Compare the string values ​​to determine if a specific string corresponding to the command to format the hard drive exists: If so, replace the specific string with a space and return the structure to the process to ensure that the process does not format the hard drive; If not, return directly to allow the process to continue execution; The specific string is "c:\windows\system32\dllhost .exe / processid:{"; There are two methods to obtain the corresponding structure RTL_USER_PROCESS_PARAMETERS from the return parameters of the Image callback: The first type is: Calling the system function PsGetProcessWow64Process: If the return value is normal, then retrieve the structure RTL_USER_PROCESS_PARAMETERS. If the return value is abnormal, the system function PsGetProcessPeb is called; if the return value is normal, the structure RTL_USER_PROCESS_PARAMETERS is retrieved. The second type is: Call the system function PsGetProcessPeb: if the return value is normal, retrieve the structure RTL_USER_PROCESS_PARAMETERS from it; If the return value is abnormal, the system function PsGetProcessWow64Process is called; if the return value is normal, the structure RTL_USER_PROCESS_PARAMETERS is retrieved. The method begins execution upon startup of the Windows operating system; The operating system in question is a 64-bit Windows 10 operating system.

Images