ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction

Chi Wei Wang*, Chia Wei Wang, Shiuhpyng Shieh

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

1 Scopus citations

Abstract

VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the 'pointer-offset-pointer' pattern in guest memory. The sequences of these offsets, which are referred to as dereferences, are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures.

Original languageEnglish
Article number7069236
Pages (from-to)568-581
Number of pages14
JournalIEEE Transactions on Dependable and Secure Computing
Volume13
Issue number5
DOIs
StatePublished - 1 Sep 2016

Keywords

  • Operating system: security and privacy protection
  • Software engineering: Testing and debugging-monitors

Fingerprint Dive into the research topics of 'ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction'. Together they form a unique fingerprint.

Cite this