Tracing ext3 file system operations in the QEMU emulator
https://doi.org/10.15514/ISPRAS-2018-30(5)-6
Abstract
The paper proposes an approach to monitoring file operations through capturing virtual disk accesses in the emulator. This method allows obtaining information about file operations in the OS-agnostic manner but requires a separate implementation for each file system. An important problem for implementing this approach is the correct handling of changes in the file system. Operating systems that cache write requests can perform operations in any order. The authors have created a method for detecting read, write, create, delete and rename operations, and a module for QEMU, which monitors operations in the ext3 file system. The advantage of this method over others is that it does not interfere with the operation of the OS and does not depend on it. It is assumed that the QEMU module for file systems other than ext2/3 can be implemented using the methods described in this article.
About the Authors
V. M. Stepanov
Yaroslav-the-Wise Novgorod State University
Russian Federation
Russian Federation
P. M. Dovgalyuk
Yaroslav-the-Wise Novgorod State University
Russian Federation
Russian Federation
D. N. Poletaev
Yaroslav-the-Wise Novgorod State University
Russian Federation
Russian Federation
References
1. Bellard, F. QEMU, a fast and portable dynamic translator. In Proceedings of the USENIX Annual Technical Conference, 2005, pp. 41-46.
2. Brian Carrier, File System Forensic Analysis. Addison-Wesley Professional, 2005.
3. Koen Vervloesem. Inotify: Watch your filesystem. Linux format, № LXF140, 2011.
4. FileSystemWatcher. https://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher(v=vs.110).aspx
5. Jonathan Lemon. Kqueue - A Generic and Scalable Event Notification Facility, Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, 2001, p.141-153
6. P. Dovgalyuk, N. Fursova, I. Vasiliev, V. Makarov. 2017. QEMU-based framework for non-intrusive virtual machine instrumentation and introspection. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering (ESEC/FSE 2017), pp. 944-948. https://dx.doi.org/10.1145/3106237.3122817
7. Artem Jerdev. Kolibri-A: a lightweight 32-bit OS for AMD platforms, Postgraduate Conference for Computing: Applications and Theory (PCCAT 2011), pp. 20-22.
Review
For citations:
Stepanov V.M., Dovgalyuk P.M., Poletaev D.N. Tracing ext3 file system operations in the QEMU emulator. Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS). 2018;30(5):101-108. (In Russ.) https://doi.org/10.15514/ISPRAS-2018-30(5)-6
Email this article 