METHOD OF ACCESSING PROCEDURES OF LOADING DRIVER Russian patent published in 2016 - IPC G06F21/57 G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to software safety, namely to methods of performing boot driver addressing procedures. Method of accessing boot driver procedures, in which: a) in process of operating system loading by driver-interceptor list of not initialised loading drivers is read, which are loaded into memory, but not initialised; b) by means of driver-interceptor call initialisation procedure for trapping of at least one loading driver from a list of been loading drivers is set; c) at installation of handler interception initialisation procedure loading drivers, with help of said handler is replaced by previously read address of entry point of loading address of driver entry point of said handler; d) with help of call initialisation procedure intercepted handler is mounted at least one loading driver from list of not initialised loading drivers; e) with help of handler stored information at least one loading driver, filled with at least one said loading driver during initiation, wherein said information on said loading gate driver contains at least an entry point at least one procedure loading driver; f) by means of at least one of driver-interceptor, anti-driver is accessing procedures of at least one loading driver at previously stored addresses entry points.

EFFECT: providing access to initial procedures of loading drivers in case of procedures interception by root kits by performing addressing procedures of at least one loading driver at previously stored locations.

4 cl, 3 dwg