標題: ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction
作者: Wang, Chi-Wei
Wang, Chia-Wei
Shieh, Shiuhpyng
資訊工程學系
Department of Computer Science
關鍵字: Software engineering: Testing and debugging-monitors;Operating system: security and privacy protection
公開日期: 10-Sep-2016
摘要: VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the "pointer-offset-pointer" pattern in guest memory. The sequences of these offsets, which are referred to as dereferences, are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures.
URI: http://dx.doi.org/10.1109/TDSC.2015.2416728
http://hdl.handle.net/11536/134256
ISSN: 1545-5971
DOI: 10.1109/TDSC.2015.2416728
期刊: IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING
Volume: 13
Issue: 5
起始頁: 568
結束頁: 581
Appears in Collections:Articles