![](bga.png)
in hardware, we strongly believe we will see them in
the future assisting memory introspection solutions.
Other challenges relate to instruction decoding
and emulation, and while they can be handled in soft-
ware using caches and emulators, they involve deep
knowledge of the instruction set and behaviour of the
CPU. Problems such as protecting paged memory or
accessing swapped out pages may not appear in a
kernel-mode memory introspection scenario, but are
very common when dealing with user-mode memory
introspection. While the solutions are not necessary
complex, they are neither obvious nor straightforward
to implement and may not be very effective.
We have discussed various possible improvements
that could be made inside the CPU itself in order
to aid memory introspection tasks, and while they
are purely theoretical, they may bring significant im-
provement to such applications, both from the imple-
mentation complexity and performance perspective.
The complexity of implementing these in the CPU,
however, may vary significantly, although emulators
such as Bochs or QEMU and simulation tools such as
PIN may provide an overview on how such extensions
may improve memory introspection. Many hardware
extensions were implemented recently for various al-
gorithms, like AES, SHA or CRC, showing an obvi-
ous trend of moving as much logic as possible on the
chip.
The software improvements that we have dis-
cussed were implemented and tested in U-HIPE and
some of them were presented in papers such as (Lutas
et al., 2015a) and (Lutas et al., 2015b), and, while the
performance increases, so do the attack surface and
the implementation complexity.
It is worth mentioning that currently, introspection
solutions are somewhat ahead of their time: they are
complex software that leverage the latest CPU inno-
vations in order to provide security, although the vast
majority of these extensions were not created for this
specific purpose. We keep seeing significant improve-
ments in hardware, especially in security & virtualiza-
tion fields, and we think that future CPU generations
will include extensions that may help fix at least some
of these issues, making hypervisor-based memory in-
trospection solutions easier the develop, deploy and
much more efficient.
REFERENCES
AMD Corporation (2005). AMD64 Virtualization Code-
named Pacifica Technology. Secure Virtual Machine
Architecture Reference Manual.
Baliga, A., Ganapathy, V., and Iftode, L. (2008). Automatic
Inference and Enforcement of Kernel Data Structure
Invariants. In In Proc. Annual Computer Security Ap-
plications Conference, pages 77–86.
Carbone, M., Cui, W., Lu, L., Lee, W., Peinado, M., and
Jiang, X. (2009). Mapping kernelobjects to enable
systematic integrity checking. In In Proc. The 16th
ACM conference on Computer and communications
security Pages, pages 555–565.
Cozzie, A., Stratton, F., Xue, H., and King, S. T. (2008).
Digging for data structures. In In Proc. 8th USENIX
conference on Operating systems design and imple-
mentation, pages 255–266.
D. Durham (2014). Mitigating Exploits, Rootkits and Ad-
vanced Persistent Threats.
Dolan-Gavitt, B., Srivastava, A., Traynor, P., and Giffin, J.
(2009). Robust signatures for kernel data structures.
In In Proc. 16th ACM conference on Computer and
communications security, pages 566–577.
G. Hoglund and J. Butler (2005). Rootkits: Subverting the
Windows Kernel.
Garfinkel, T. and Rosenblum, M. (2003). A Virtual Ma-
chine Introspection Based Architecture for Intrusion
Detection. In In Proc. Network and Distributed Sys-
tems Security Symposium, pages 191–206.
Intel Corporation (2016a). Control-flow Enforcement Tech-
nology Preview.
Intel Corporation (2016b). Intel
R
64 and IA-32 Architec-
tures Software Developer’s Manual. Number 325462-
060US.
Lin, Z., Rhee, J., Zhang, X., Xu, D., and Jiang, X. (2011).
Graph-based signatures for kernel data structures. In
In Proc. 12th Annual Information Security Sympo-
sium, page Article no. 21.
Lutas, A., Colesa, A., Lukacs, S., and Lutas, D. (2015a). U-
HIPE: hypervisor-based protection of user-mode pro-
cesses in Windows.
Lutas, A., Lukacs, S., Colesa, A., and Lutas, D. (2015b).
Proposed Processor Extensions for Signicant Speedup
of Hypervisor Memory Introspection. In Trust and
Trustworthy Computing, pages 249–267.
M. Rusinovich and D. Solomon and A. Ionescu (2012).
Windows Internals 6th edition.
Sahita, R., Shanbhogue, V., Neiger, G., Edwards, J., Ouziel,
I., Huntley, B., Shwartsman, S., Durham, D. M.,
Anderson, A., and LeMay, M. (2014). Method
and apparatus for fine grain memory protection.
US20150378633.
Serebrin, B. and Haertel, M. (2008). Alternate address
space to permit virtual machine monitor access to
guest virtual address space. US20090187726.
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
294