Method and system of file manipulation during early boot time by accessing user-level data associated with a kernel-level function
A system and method that enables access to user-level data during a boot-time of a computer is described. One embodiment includes memory containing program instructions configured to cause a processor of computer system to access user-level data associated with a kernel-level function using a portable executable (PE) file. The memory includes program instructions configured to cause a processor to access the user-level data during a boot-time of a computer. In this embodiment, the memory also includes program instructions configured to cause the processor to access the PE file.
1. A non-transitory computer-readable storage medium containing program instructions executable by at least one processor, the programming instructions comprising:
a first instruction set configured to cause the at least one processor to access, during a boot-time of a computer, user-level data associated with a kernel-level function using a portable executable (PE) file; and
a second instruction set configured to cause the at least one processor to access the PE file using the computer.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the user-level data is associated with at least a portion of an index.
3. The non-transitory computer-readable storage medium of claim 2 , wherein the first instruction set is further configured to cause the at least one processor access an address and wherein the kernel-level function is an application program interface (API).
4. The non-transitory computer-readable storage medium of claim 1 , wherein the boot-time is an early boot-time.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is loaded into a memory during the boot-time as a boot-file.
6. The non-transitory computer-readable storage medium of claim 1 , wherein:
the PE file is a first PE file; and
the first instruction set is further configured to cause the at least one processor to access from a second PE file using the first PE file.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is a first PE file, and a second PE file that is loaded during the boot-time is linked to the first PE file.
8. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is a first PE file configured to patch a second PE file.
9. The non-transitory computer-readable storage medium of claim 1 , wherein the program instructions further comprise:
a third instruction set configured to cause the at least one processor to modify a boot-loader registry during an installation period to include a reference to the PE file, wherein the reference is used by an operating system (OS) during the boot-time to image the PE file into a memory.
10. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is a first PE file loaded into a memory during the boot-time, the first PE file is loaded before a second PE file containing the user-level data is loaded into the memory during the boot-time.
11. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is loaded into a memory during the boot-time at a first time and the PE file includes an instruction that prevents an operating system fault at a second time, wherein the second time is after the first time.
12. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is configured to write data associated with at least a portion of the user-level data to a location that can be accessed by a pestware monitor.
13. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is at least one of an index-containing PE file or a dummy driver.
14. The non-transitory computer-readable storage medium of claim 1 , wherein the PE file is at least one of an NTDLL.DLL file or a dummy kernel-mode DLL file.
15. A computing system, comprising:
at least one processor;
a memory containing a plurality of program instructions configured to cause the at least one processor to:
access, during a boot-time of the computing system, user-level data associated with a kernel-level function using a portable executable (PE) file; and
access the PE file.
16. The computing system of claim 15 , wherein the user-level data is associated with at least a portion of an index.
17. The computing system of claim 16 , wherein the memory containing the plurality of program instructions is further configured to cause the at least one processor to access an address and wherein the kernel-level function is an application program interface (API).
18. The system of claim 15 , wherein the boot-time is an early boot-time.
19. The system of claim 15 , wherein the PE file is loaded into a memory during the boot-time as a boot-file.
20. The system of claim 15 , wherein the memory containing the plurality of program instructions is further configured to cause the at least one processor to:
modify a boot-loader registry during an installation period to include a reference to the PE file, wherein the reference is used by an operating system (OS) during the boot-time to image the PE file into a memory.
21. The system of claim 15 , wherein the PE file is configured to write data associated with at least a portion of the user-level data to a location that can be accessed by a pestware monitor.
22. The system of claim 15 , wherein the PE file is at least one of an index-containing PE file or a dummy driver.
23. The system of claim 15 , wherein the PE file is at least one of an NTDLL.DLL file or a dummy kernel-mode DLL file.