ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction

Chi Wei Wang*, Chia Wei Wang, Shiuhpyng Shieh

*Corresponding author for this work

研究成果: Article同行評審

1 引文 斯高帕斯(Scopus)


VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the 'pointer-offset-pointer' pattern in guest memory. The sequences of these offsets, which are referred to as dereferences, are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures.

頁(從 - 到)568-581
期刊IEEE Transactions on Dependable and Secure Computing
出版狀態Published - 1 九月 2016

指紋 深入研究「ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction」主題。共同形成了獨特的指紋。