KR100800090B1 - System for real-time watching irp dispatching to windows device driver and method thereof - Google Patents

Abstract

A system and a method for monitoring an IRP(I/O(Input/Output) Request Packet) dispatched to a Windows device driver in real-time are provided to solve problems owing to integration between the device driver and an IRP processing module by separating the device driver and the IRP processing module, and secure stability of the device driver and correct a product quickly by changing/applying a user mode application to the device driver easily even though an IRP processing mode is changed. An IRP control driver(203) delays the IRP received from an OS(Operating System) and transceives IRP information with an IRP control policy module(201). The IRP control policy module determines to block the IRP depending on harmfulness of the IRP received from the IRP control driver. The IRP control driver includes an IRP delayer(203a) delaying transfer of the IRP until the harmfulness is checked, an IRP information transmitter(203b) transmitting the IPR information checked in the IRP delayer to the IRP control policy module, and an IRP processing mode receiver(203c) receiving an IRP processing mode from the IRP control policy module and transferring the IPR processing mode to the IRP delayer.

Description

System for Real-time Watching IRP Dispatching to Windows Device Driver and Method about dispatching IRP (Dispatched by Windows Device Driver)

Figure 1 shows the architecture of Microsoft's Windows NT-based OS.

2 is a block diagram of an IRP real-time monitoring system according to an embodiment of the present invention

3 is a flowchart illustrating a real-time monitoring method using an IRP delay according to an embodiment of the present invention.

4 is a detailed flowchart of real time monitoring using IRP delay according to an embodiment of the present invention.

{Description of Signs of Major Parts of Drawings}

201: IRP control policy module unit 202: I / O management unit

203: IRP control driver section 203a: IRP delay section

203b: IRP information transmitter 203c: IRP processing receiver

The present invention relates to an apparatus and a method for real-time monitoring of an I / O request packet (IRP) dispatched to a Windows device driver.

In order to control or block the IRP, it is determined whether to control or block based on a specific criterion (hereinafter, referred to as a control policy). The conventional device driver technology has been configured by integrating the control policy module and the device driver.

Since the standard is complicated, diversified, and rapidly changed in modern times, the change of control policy to control IRP occurs frequently, and the change is made through code change of the control policy module included in the device driver itself. . Therefore, the test period for securing stability is excessively required for the actual application due to the code change of the device driver itself.

As such, the conventional device driver takes a considerable time until its actual application when the control policy is changed, which makes it difficult to respond quickly to virus or hacker attacks.

Therefore, in order to solve the above problems, separation between the control policy module of the IRP and the device driver is required. That is, the IRP control policy module needs to be composed of other device drivers or provided as an executable program in user mode.

With this structure, real-time processing requires delaying the IRP to be dispatched to the device driver until receiving the processing method to be determined by the IRP control policy module, and the delayed real-time processing time is achieved by integrating the device driver and the control policy module into one. Compared to the method should be at all intact.

The present invention has been made to solve the above problems, and an object thereof is to provide an apparatus and method capable of monitoring the IRP in real time.

In order to achieve the above object, the present invention provides a method for delaying the IRP without resistance of the window system, and transmitting the information of the corresponding IRP to the IRP control policy module in the delay state, and the method for processing the IRP from the control policy module after transmission. Provides a way to receive it.

In the Windows kernel level environment operating in a multi-process environment, the delay of the target IRP does not cause any problem in the process, and it does not cause the problem of speed reduction compared to the conventional real-time processing method. In order to delay IRP, synchronization objects provided by windows such as event, semaphore, mutex, critical section, etc. are used, and IRP delay function is implemented by creating synchronization objects for each target IRP. In order to transmit the IRP information to the control policy module, the present invention uses a shared event, apc call, or device io control code between the device driver and the separated control policy module. After receiving the IRP processing method from the control policy module, by activating the synchronization object that delayed the IRP, the IRP is returned from the delayed state to the active state and the IRP is processed according to the received processing method. As described above, in the present invention, the Windows kernel synchronization object used for synchronization of shared resources in a multi-process environment is used as a method of delaying the progress of the IRP, and the synchronization object is allocated to each IRP to be used independently of each process. It provides a way to make it work.

Microsoft's Windows NT series is divided into the user mode in which general applications are executed, the kernel mode in which device drivers are executed, and the kernel of the operating system, as shown in FIG. 1, between user mode applications and kernel mode device drivers, or between kernel mode drivers. Communication occurs through a structure called IRP (I / O Request Packet).

The OS kernel module that manages the above IRP is a kernel module named the I / O management unit, and the kernel mode resource access by the user mode application is not allowed through the IRP. The control of IRP, which is the foundation of Windows OS operation, forms the core of Windows OS configuration. IRP can be controlled only at the kernel level.

A general method for controlling the IRP is shown in FIG. Through the hooking device driver attaching to the Windows device driver in the form of a filter device driver or hooking the dispatch routine of the Windows device driver, the present invention can be applied to any type of device driver other than the above method used for controlling the IRP. Do.

2 schematically illustrates an IRP real-time monitoring system of the present invention, in which an IRP control driver unit 203 for controlling an IRP dispatched to a device driver of a window and an IRP control of a user mode for communicating with a corresponding driver are shown. The IRP control driver unit 203 includes a delay unit 203a for delaying the IRP, a transmitter unit 203b for transmitting IRP information, and a receiver unit for receiving an IRP processing method from the IRP control policy module ( 203c). After delaying the IRP in the delay unit 203a, the information on the IRP is passed to the IRP control policy module unit 201 in the user mode through the transmitter 203b. The IRP control policy module 201 determines whether the given IRP is harmful and transmits whether to block or normal processing to the IRP processing receiver 203c. The receiver 203c activates the synchronization object used by the delay unit to wait for the IRP, and passes control to the IRP delay unit 203a. At this time, the IRP delay unit 203a, which has transferred control, checks whether the synchronization object is activated, and then blocks or normalizes the IRP.

Referring to the operation and effect of the present invention configured as described in detail as follows.

As shown in FIG. 3 and FIG. 4, the IRP delay unit constituting the IRP control driver delays the corresponding IRP until receiving the target IRP from the IRP control module in the user mode.

Use Windows synchronization objects to delay IRP processing. For each IRP you want to delay, create one synchronization object and send one of the KeWaitForMutexObject (), KeWaitForSingleObject (), KeWaitForMultipleObjects () APIs before sending the target IRP to the Windows device driver. Select to wait until the created synchronization object is activated (S304a). Before using the above API, the pointer of the structure storing the IRP information is transferred to the IRP transmitting unit (S302). In addition, when the above API is used, infinite wait can be prevented by setting a time out value for the maximum wait time (S304b). The activation of the created synchronization object is activated by the IRP processing receiver.

Table 1 describes the APIs for creating delay effects. In Table 1, select one of the given kernel objects to perform the wait operation.

API name Kernel Objects Used by the API Explanation KeWaitForSingleObject () Event, mutex, semaphore, and timer Wait until the window synchronization object becomes active KeWaitForMultipleObjects () event, mutex, semaphore, and timer Wait until the window synchronization object becomes active KeWaitForMutexObject () Mutex Wait until the mutex, a window synchronization object, becomes active

When the API given in [Table 1] is returned and the wait is released, the API functions as shown in [Table 2] are used to check whether the status of the given synchronization object is normally activated, not Time out.

Kernel synchronization object Check the status of sync objects Explanation Event KeReadStateEvent () Check the activation status of the event object Mutex KeReadStateMutex () Check the activation status of mutex objects Semaphore KeReadStateSemaphore () Check activation status of semaphore object Timer KeReadStateTimer () Check the activation status of timer object

If the identified object is normally activated using the function in [Table 2], the IRP processing receiver processes the IRP as received.

The IRP information transmitting unit constituting the IRP control driver informs the IRP control module to take the information received from the IRP delay unit using the event shared with the IRP control module (S303b). The IRP control module that receives the event gets IRP information from the IRP control driver through the device Io control () API. To share an event between a user-mode application and a kernel-mode device driver, the IoCreateSynchronizationEvent () API is used to first create an event to be shared by the device driver. The created event is shared by OpenEvent () in user level application.

The IRP control module checks the harmfulness of the IRP and transmits a processing method (blocking or normal processing) to the IRP processing receiving unit of the IRP control driver through the device Io control () API (S303b).

In order to apply the IRP processing method received from the IRP control module in the user mode, the IRP processing receiving unit constituting the IRP control driver writes the processing method in the structure made by the IRP delay unit and passed to the IRP information transmitting unit. Thereafter, the synchronization object used for the IRP delay is activated by using the API of [Table 3], and the control is transferred to the IRP delay unit (S304d). The IRP delay unit that takes over control terminates the one cycle for one IRP by processing the IRP and deleting the synchronization object. The above cycle is repeated and applied to each IRP.

 Synchronization object APIs to activate synchronization objects Explanation Event KeSetEvent ()  Change event to signaled state Mutex KeReleaseMutex ()  Change mutex to signaled state Semaphore KeReleaseSemaphore ()  Change Semaphore to signaled state Timer KeSetTimer ()  Change Timer to signaled state

As described above, according to the present invention, the device driver and the IRP processing module can be separated separately to solve various problems which may occur due to the integrated development of the IRP processing module in one device driver as in the conventional device driver development method. To be.

In addition, even if the IRP processing method is changed, the user mode application can be changed and easily applied to the device driver, so that product configuration management, device driver stability, and rapid product modification can be easily performed.

Claims (11)

In the device for monitoring the I / O Request Packet (IRP) in real time, An IRP control driver unit for transmitting and receiving information on the IRP after delaying the IRP transmitted from an operating system; And After receiving the information on the IRP IRP real-time monitoring device including an IRP control policy module for determining whether to block by determining whether or not harmful to the IRP. The method of claim 1, wherein the IRP control driver unit An IRP delay unit that delays the delivery of the IRP until it is confirmed whether harmful; An IRP information transmitter for transmitting information on the IRP identified by the IRP delay unit to an IRP control policy module unit; And IRP real-time monitoring device comprising an IRP processing receiving unit for receiving the IRP processing method from the IRP control policy module unit and delivers it to the IRP delay unit. In the method for monitoring the I / O Request Packet (IRP) in real time, A) receiving an IRP with dispatch; B) transmitting information on the IRP to the IRP control module unit; C) waiting for receiving IRP processing related information; And D) IRP real-time monitoring method comprising the step of determining whether to block the IRP according to the IRP processing result. The method of claim 3, wherein step B) B1) generating an information structure for the IRP and passing it to the IRP information transmitter; B2) generating a sharing event for the user mode application to take the IRP information structure; And B3) the IRP real-time monitoring method comprising the step of transmitting the processing method to the IRP processing receiver by the IRP control module unit of the user mode based on the IRP information. The method of claim 4, wherein B4) determining whether to activate the synchronization object, and if not, further comprising the step of activating the synchronization object. The method of claim 3, wherein step C) C1) waiting for activation after creating a window synchronization object; And C2) IRP real-time monitoring method comprising the step of determining whether the timeout. The method of claim 3, wherein step D) IRP real-time monitoring method characterized in that if the IRP processing result is blocked, block the IRP, otherwise IRP normal processing. The method of claim 3, wherein step C) Create and select one of the window synchronization objects event, semaphore, mutex, and timer before passing the control to the Windows device driver by passing the IRP to the KeWaitForSingleObject (), KeWaitForMultipleObjects (), KeWaitForMutexObject () API. IRP real-time monitoring method characterized by waiting for the progress of the IRP until the synchronized object is activated. The method of claim 8, When using the KeWaitForSingleObject (), KeWaitForMultipleObjects (), KeWaitForMutexObject () API, set the Time Out value as the maximum delay time and use the KeSetEvent () API if the synchronization object to be activated when the Time Out occurs is an event. In the case of KeReleaseMutex () API, Semaphore in case of KeReleaseSemaphore () API, and in case of Timer, it is activated by KeSetTimer () API. IRP real-time monitoring method, characterized in that the check. The method of claim 4, wherein the method of generating a sharing event of step B2) When creating an event using the IoCreateSynchronizationEvent () API in kernel mode and opening the event using the OpenEvent () function in user mode, the event is shared and used when the event is passed a pointer to an IRP information structure from the IRP delay unit. IRP real-time monitoring method characterized by sharing the structure pointer by using device Io control () API to inform user mode application to take structure and enable sharing of IRP information structure contents. The method according to claim 5, wherein the method of activating the synchronization object in the step B5) corresponds to the information structure of the IRP delayed with respect to the IRP processing method passed from the IRP control module in the user mode through the device Io control API API. After recording the method, the state of the synchronization object created to delay the IRP is KeReadStateEvent () API for Event, KeReadStateMutex () API for Mutex, KeReadStateSemaphore () API for Semaphore, and Timer IRP real-time monitoring method characterized in that by using the KeReadStateTimer () API to check if it is not activated by activating the delay state of the IRP.

Images