.png){kind=icon}
返回
ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2015.2416728.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the pointer-offset-pointer pattern in guest memory. The sequences of these offsets, which are referred to as dereferences, are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures.
Keyword:
Software engineering: Testing and debugging-monitors
Operating system: security and privacy protection
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
7.5
论文数:
2.4K
被引数:
9.6K
机构
引用论文
Biliary Lipid Composition in Normolipidemic and Prebeta Hyperlipoproteinemic Gallstone Patients
PREAI
分享收藏The Emerging Role of Suppressors of Cytokine Signaling (SOCS) in the Development and Progression of Leukemia.png)
Cancers
OAAI
CancersIF0
OAAI分享收藏Critical Role of Autophagy in the Processing of Adenovirus Capsid-Incorporated Cancer-Specific AntigensPLOS ONE
OAAI
PLOS ONEIF0
OAAI分享收藏A set of robust fluorescent peptide probes for quantification of Cu(ii) binding affinities in the micromolar to femtomolar rangeMetallomicsOAAI
MetallomicsIF0
OAAI分享收藏
查看更多内容