title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÐºÐ¾Ð´Ðµ SMM Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Dynamic analysis based technique of SMM malware detection
Creators: name: Ð¤ÐµÐ´Ð¾ÑÐ¾Ð², ÐÐ²Ð³ÐµÐ½Ð¸Ð¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ
Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ðµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ðµ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ðµ
Ð³Ð¸Ð¿ÐµÑÐ²Ð¸Ð·Ð¾Ñ
Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
ÑÐ°Ð±Ð¾ÑÐ¾ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð¾ÑÑÑ
detection of malicious software
hypervisor
system management mode
dynamic analysis
smi transfer monitor

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ, ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÑÑÑÐµÐ³Ð¾ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÐµÑÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ·ÑÑÐ¸ÑÑ ÑÐµÐ¶Ð¸Ð¼ ÑÐ°Ð±Ð¾ÑÑ SMM. 2. ÐÐ·ÑÑÐ¸ÑÑ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM. 3. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÐºÐ¾Ð´Ð° SMM Ð¸ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¿Ð¾Ð´ÑÐ¾Ð´ Ðº Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. 5. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ°Ð±Ð¾ÑÐ¾ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð°. 6. Ð Ð°Ð±Ð¾ÑÐ° Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð½Ð° Ð±Ð°Ð·Ðµ ÑÐ¸ÑÐ¾ÐºÐ¾Ð³Ð¾ ÑÐ¿Ð¸ÑÐºÐ° Ð¿ÑÐ¾ÑÐ¸Ð»ÑÐ½ÑÑ Ð½Ð°ÑÑÐ½ÑÑ ÑÑÐ°ÑÐµÐ¹. Ð ÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð° Ð¾ÑÑÑÐµÑÑÐ²Ð»ÑÐ»Ð¾ÑÑ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐ·ÑÐºÐ° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ C, Ð½Ð° Ð±Ð°Ð·Ðµ ÑÑÐµÐ´Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ EDKII. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM, Ð¼ÐµÑÐ¾Ð´Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÐºÐ¾Ð´Ð° ÑÐµÐ¶Ð¸Ð¼Ð° SMM Ð¸ Ð¼ÐµÑÐ¾Ð´Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÐÐÐ, ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÑÑÑÐµÐ³Ð¾ Ð² Ð´Ð°Ð½Ð½Ð¾Ð¼ ÑÐµÐ¶Ð¸Ð¼Ðµ. ÐÐ° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð±ÑÐ»Ð¸ Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ñ ÐºÑÐ¸ÑÐµÑÐ¸Ð¸ Ðº ÑÐ°Ð·ÑÐ°Ð±Ð°ÑÑÐ²Ð°ÐµÐ¼Ð¾Ð¼Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ. Ð¡ ÑÑÐµÑÐ¾Ð¼ Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ ÐºÑÐ¸ÑÐµÑÐ¸ÐµÐ² ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¿Ð¾Ð´ÑÐ¾Ð´ Ðº Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¹ Ð¿Ð¾Ð´ÑÐ¾Ð´ Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½ Ð½Ð° Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¸Ñ Ð¿Ð»Ð°ÑÑÐ¾ÑÐ¼Ð°Ñ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ Ð² ÑÐµÐ¶Ð¸Ð¼Ðµ SMM.
description: This work is devoted to the development of an approach for detecting malicious software operating in the SMM mode. The subject of the study is the detection of malicious software in the SMM mode. Tasks that were solved in the course of the study: 1. Study of SMM processor mode. 2. Analysis of approaches to malicious software in SMM mode. 3. Explore methods for analyzing SMM code and detecting malware in SMM mode. 4. Develop an approach to detecting malicious software in SMM mode based on dynamic analysis. 5. Conduct working testing of the developed approach. The work was carried out on the basis of a wide list of specialized scientific articles. The approach was implemented using the C programming language, based on the EDKII development environment. As a result, approaches to building malicious software in the SMM mode, methods for analyzing the code of the SMM mode, and methods for detecting malicious software operating in this mode were analyzed. Based on the analysis, criteria were set for the developed approach. Taking into account the criteria set, an approach has been developed to detect malicious software in the SMM mode based on dynamic analysis. The developed approach can be used on user platforms to detect malware in the SMM mode.