33 results about "Model-specific register" patented technology

A security system and method efficiently monitors and secures a computer to defend against malicious intrusions, and includes an in-band software monitor disposed within a kernel in communication with an operating system (OS) of the computer. The monitor intercepts system calls made from an MSR (Model Specific Register), to execute monitoring operations, and subsequently returns execution to the OS. An out-of-band hypervisor communicably coupled to the OS, has read shadow means for trapping read requests to the MSR, and write mask means for trapping write requests to the MSR. The hypervisor includes means for responding to the trapped read and write requests so that presence of the monitor is obscured.

The invention discloses a method for detecting the existence of a virtual machine monitor (VMM) under a Windows platform, aiming at solving the problem that malicious codes use the VMM as a platform for hiding self behaviors and providing malicious services, and providing a method for detecting the existence of the VMM through resource differences. In a technical scheme, the method comprises the steps of: firstly, allocating internal memory spaces for Allocated PTEs (Page Table Entries) and a Special PTE; writing an address A before mapping modification for the Allocated PTEs; writing an address B after mapping modification for the Special PTE; accessing the Allocated PTEs in sequence to ensure that all PTEs pointing to the address A are stored into a page table buffer register; sequentially modifying the pointer contents of the Allocated PTEs into the address B pointed by the Special PTE; executing a privileged instruction RDMSR (Read from Model Specific Register) in a Windows system; and setting a counter, traversing all page table entries in the page table buffer register, and judging whether the VMM exists in the current system by judging whether the numerical value of the counter is consistent with N. The method disclosed by the invention can be used for effectively detecting the VMM so as to improve system security.

A microprocessor having model specific registers (MSRs) includes, for each of the MSRs, an associated default value that indicates whether the MSR is protected or non-protected and an associated fuse that, if blown, toggles the associated default value from protected to non-protected or non-protected to protected. In one embodiment, microcode that does the following in response to the microprocessor encountering an instruction that accesses a specified MSR: determines whether the fuse associated with the specified MSR is blown or unblown, uses the default value associated with the MSR as an indicator of whether the MSR is protected if the associated fuse is unblown; toggles the associated default value to generate the indicator if the associated fuse is blown; protects access to the MSR if the indicator indicates the MSR is protected; and refrains from protecting access to the MSR if the indicator indicates the MSR is non-protected.