Offline Scanning Kernel Transfer for Windows NT Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preparing Windows NT-based computing devices for offline scanning and removal of advanced threats require significant user involvement and knowledge, including creating bootable media and modifying BIOS settings, which is complex and not user-friendly for non-technical users.
Innovation Solution
A method that automates the preparation of computing devices for offline scanning by collecting and verifying parameters, mapping a Linux kernel to memory, and initiating a shutdown of the protected-mode operating system without altering boot sequence settings, using a Windows kernel mode driver to prepare the memory layout and transfer control to the Linux kernel for scanning and cleaning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional offline scanning methods are used (creating bootable media and modifying BIOS settings), then the scanning can be performed on infected systems, but the process becomes complex and requires substantial user knowledge
Solution Approach 1:
The system performs preliminary actions by pre-configuring the offline scanning environment and automating the boot sequence modification process. The kernel mode driver prepares the system in advance by mapping the Linux kernel to memory and setting up the scanning environment before the actual scan is needed, eliminating the need for users to manually create bootable media or modify BIOS settings at the time of scanning.
Solution Approach 2:
A kernel mode driver acts as an intermediary between the Windows NT-based operating system and the Linux-based offline scanning environment. This driver facilitates the transition by managing memory mapping, handling the shutdown sequence, and transferring control to the offline scanner without requiring user intervention in BIOS settings or media creation.
2Reliability
If manual BIOS modification is required for offline scanning, then the scanning can be performed, but different computer manufacturers have different BIOS interfaces making the process challenging
Solution Approach 1:
The kernel mode driver implements a universal interface that works across different computer manufacturers and BIOS implementations. Instead of requiring users to manually navigate manufacturer-specific BIOS interfaces, the driver automatically manages the boot sequence modification and offline scanning setup in a standardized way that is compatible with various hardware platforms.
Solution Approach 2:
The system performs self-service by automatically configuring the offline scanning environment without user intervention. The kernel mode driver handles the entire process of preparing the Linux kernel, mapping it to memory, and transferring control to the offline scanner, eliminating the need for users to manually modify BIOS settings on different computer platforms.
3Reliability
If the operating system is shut down for offline scanning, then advanced threats can be detected and removed, but the process requires creating bootable media from downloaded ISO images
Solution Approach 1:
The solution extracts the essential scanning functionality from the complex media creation process. Instead of requiring users to download ISO images and create bootable CD or USB media, the system extracts only the necessary Linux kernel and offline scanning components, mapping them directly to system memory through the kernel mode driver, thereby eliminating the media creation step entirely.
Solution Approach 2:
The system creates a virtual copy of the offline scanning environment by mapping the Linux kernel and necessary files directly into system memory. This in-memory copy eliminates the need for physical bootable media, as the scanning environment is reconstructed virtually within the existing system memory space, simplifying the process while maintaining scanning effectiveness.
Data Source
AI summary
To prepare computing devices (e.g., running Windows NT-based operating systems) for offline scanning, without the need for removable media, such as CDs and USB devices, and for users to modify the BIOS settings, parameters regarding a protected-mode operating system and the computing device are collected and verified while the protected-mode operating system is running on the computing device. A kernel of an alternate operating system (e.g., a Linux operating system) can be mapped to the memory of the device, shutdown of the protected-mode operating system can be initiated, a system environment for the alternate operating system kernel can be prepared, and control of the computing device can be transferred or passed to the alternate operating system kernel.