ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction
| Autor: | Chi-Wei Wang, Chia-Wei Wang, Shiuh-Pyng Shieh |
|---|---|
| Rok vydání: | 2016 |
| Předmět: |
021110 strategic
defence & security studies procfs sysfs Computer science Real-time computing 0211 other engineering and technologies Hypervisor 02 engineering and technology Kernel virtual address space Configfs Kernel preemption Computer engineering Kernel (statistics) 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing Hybrid kernel Electrical and Electronic Engineering |
| Zdroj: | IEEE Transactions on Dependable and Secure Computing. 13:568-581 |
| ISSN: | 1545-5971 |
| DOI: | 10.1109/tdsc.2015.2416728 |
| Popis: | VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the “pointer-offset-pointer” pattern in guest memory. The sequences of these offsets, which are referred to as dereferences , are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|