Declarative Approach to Virtual Machine Introspection
https://doi.org/10.15514/ISPRAS-2024-36(3)-9
Abstract
The prominent problem in memory dump analysis and virtual machine introspection approaches is a semantic gap. Availability of debug symbols or knowledge about kernel data structures offsets is very important for retrieving high-level information from binary code. A set of information about kernel data structures field offsets is called an OS profile. Methods of generating such profiles are based on guest agents, debug symbols, source code compilation or binary analysis. Using only binary analysis makes it possible to do research with a minimal knowledge about analyzed guest OS. In this paper we present a novel approach for OS profile generating. It is based on system call tracing and comparison between data obtained from application binary interface and data extracted from expected locations of kernel structures. The advantage of this solution is scalability for supporting different guest systems. While other existing approaches use heuristics based on handling Linux kernel functions that access the fields, the current approach suggests using heuristics that are similar across different OS families. We also suggest a method of describing heuristic algorithms for profile generation that simplifies understanding of them and makes them more resistant to changes between OS versions.
Supporting agencies: The work was partially supported by the Russian Science Foundation (grant No. 24-11-20022, https://rscf.ru/project/24-11-20022/).
About the Authors
Vladislav Mikhailovich STEPANOV
Institute for System Programming of the Russian Academy of Sciences
Russian Federation
Russian Federation
Software developer. Research interests: debugging, introspection and instrumentation of virtual machines, dynamic analysis of binary code, emulators.
Pavel Mikhailovich DOVGALYUK
Institute for System Programming of the Russian Academy of Sciences
Yaroslav-the-Wise Novgorod State University
Russian Federation
Russian Federation
Cand. Sci. (Tech.), engineer. Research interests: virtual machines introspection and instrumentation, dynamic analysis of code, debuggers, emulators.
Natalia Igorevna FURSOVA
Institute for System Programming of the Russian Academy of Sciences
Russian Federation
Russian Federation
Cand. Sci. (Tech.), engineer. Research interests: virtual machines introspection and instrumentation, dynamic analysis of code, emulators.
References
1. Volatility 3: The volatile memory extraction framework. Url: https://github.com/volatilityfoundation/volatility3, дата обращения 12.04.2024.
2. Rekall Memory Forensic Framework. Url: https://github.com/google/rekall, дата обращения 12.04.2024.
3. Pavel Dovgalyuk, Natalia Fursova, Ivan Vasiliev, and Vladimir Makarov. 2017. QEMU-based framework for non-intrusive virtual machine instrumentation and introspection. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering (ESEC/FSE 2017). Association for Computing Machinery, New York, NY, USA, 944–948. DOI: https://doi.org/10.1145/3106237.3122817.
4. DRAKVUF. Black-box Binary Analysis System. Url: https://drakvuf.com, дата обращения 12.04.2024.
5. Andrew Henderson, Aravind Prakash, Lok Kwong Yan, Xunchao Hu, Xujiewen Wang, Rundong Zhou, and Heng Yin. 2014. Make it work, make it right, make it fast: building a platform-neutral whole-system dynamic binary analysis platform. In Proceedings of the 2014 International Symposium on Software Testing and Analysis (ISSTA 2014). Association for Computing Machinery, New York, NY, USA, 248–258. DOI: https://doi.org/10.1145/2610384.2610407.
6. Brendan Dolan-Gavitt, Josh Hodosh, Patrick Hulin, Tim Leek, and Ryan Whelan. 2015. Repeatable Reverse Engineering with PANDA. In Proceedings of the 5th Program Protection and Reverse Engineering Workshop (PPREW-5). Association for Computing Machinery, New York, NY, USA, Article 4, 1–11. DOI: https://doi.org/10.1145/2843859.2843867.
7. Richard Golden, Andrew Case, and Lodovico Marziale. 2010. Dynamic Recreation of Kernel Data Structures for Live Forensics. Digital Investigation 7 (2010), 32–40.
8. Shuhui Zhang, Xiangxu Meng, and Lianhai Wang. 2016. An adaptive approach for Linux memory analysis based on kernel code reconstruction. EURASIP Journal on Information Security 2016, 1 (2016), 14.
9. Zhenxiao Qi, Yu Qu, and Heng Yin. 2022. LogicMem: Automatic Profile Generation for Binary-Only Memory Forensics via Logic Inference. In Network and Distributed System Security Symposium (NDSS).
10. Brendan Dolan-Gavitt, Abhinav Srivastava, Patrick Traynor, and Jonathon Giffin. 2009. Robust signatures for kernel data structures. In Proceedings of the 16th ACM Conference on Computer and Communications Security. 566–577.
11. Alireza Saberi, Yangchun Fu, and Zhiqiang Lin. 2014. Hybrid-bridge: Efficiently bridging the semantic gap in virtual machine introspection via decoupled execution and training memorization. In Proceedings of the 21st Annual Network and Distributed System Security Symposium (NDSS’14).
12. Qian Feng, Aravind Prakash, Minghua Wang, Curtis Carmony, and Heng Yin. 2016. Origen: Automatic extraction of offset-revealing instructions for crossversion memory analysis. In Proceedings of the 11th ACM on Asia Conference.
13. Bindiff. Url: https://www.zynamics.com/bindiff.html, дата обращения 12.04.2024.
14. Fabian Franzen, Tobias Holl, Manuel Andreas, Julian Kirsch, and Jens Grossklags. 2022. Katana: Robust, Automated, Binary-Only Forensic Analysis of Linux Memory Snapshots. In 25th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2022), October 26–28, 2022, Limassol, Cyprus. ACM, New York, NY, USA, 18 pages.
15. Bellard, F.: QEMU, a fast and portable dynamic translator. In Proceedings of the USENIX. Annual Technical Conference, 2005, pp. 41–46.
Review
For citations:
STEPANOV V.M., DOVGALYUK P.M., FURSOVA N.I. Declarative Approach to Virtual Machine Introspection. Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS). 2024;36(3):123-138. (In Russ.) https://doi.org/10.15514/ISPRAS-2024-36(3)-9
Email this article 