Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Towards Automatic Inference of Kernel Object Semantics from Binary Code Junyuan Zeng, and Zhiqiang Lin Department of Computer Science University of Texas at Dallas RAID 2015 1 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Kernel Data Structure (or Object) Semantics Concerning the meaning and the behavior of kernel data structures task_struct : process descriptor mm_struct : memory address space descriptor 2 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Kernel Data Structure (or Object) Semantics Concerning the meaning and the behavior of kernel data structures task_struct : process descriptor mm_struct : memory address space descriptor Useful for a number of security applications. Virtual machine introspection [GR03] Kernel function reverse engineering 2 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Why This is Challenging Challenges Semantics concern the meaning, which is even vague for 1 human beings. Kernel tends to have a large number of kernel objects. 2 Up to tens of thousands of dynamically created kernel objects. Hundreds of different semantics types. 3 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Why This is Challenging Challenges Semantics concern the meaning, which is even vague for 1 human beings. Kernel tends to have a large number of kernel objects. 2 Up to tens of thousands of dynamically created kernel objects. Hundreds of different semantics types. Current Practice Merely relying on human beings to manually inspect kernel source code, kernel symbols, or kernel APIs to derive and annotate the semantics of the kernel objects. 3 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Introducing A RGOS A RGOS : A utomatic R everse en G ineering of kernel O bject S emantics 4 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Introducing A RGOS A RGOS : A utomatic R everse en G ineering of kernel O bject S emantics Key Features Recognizing and uncovering important kernel data 1 structures with semantics, directly from binary code General, working with a variety of (Linux) operating system 2 kernels. 4 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Introducing A RGOS A RGOS : A utomatic R everse en G ineering of kernel O bject S emantics Key Features Recognizing and uncovering important kernel data 1 structures with semantics, directly from binary code General, working with a variety of (Linux) operating system 2 kernels. Key Principle Data use tells data semantics 4 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Key Insights Starting from well-known knowledge 1 User level system call (syscall for short) specification Kernel level exported API specification Using execution context differencing 2 e.g., task_struct vs. mm_struct Encoding the semantics using a bit-vector 3 Which syscall (e.g., fork , open , mmap ) accessed How the object was accessed: 5 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Key Insights Starting from well-known knowledge 1 User level system call (syscall for short) specification Kernel level exported API specification Using execution context differencing 2 e.g., task_struct vs. mm_struct Encoding the semantics using a bit-vector 3 Which syscall (e.g., fork , open , mmap ) accessed How the object was accessed: read write create destroy 5 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works User space Kernel space Guest OS VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification Syscall Execution Syscall Context Identification VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification Syscall Object Creation, Execution Deletion Syscall Context Object Identification Tracking VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification Syscall Object Creation, Execution Deletion Syscall Context Object Identification Tracking Bit Vector Bit ‐ Vector Generation VMM 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References How A RGOS Works Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification Syscall Object Creation, Execution Deletion Syscall Context Object Identification Tracking Bit ‐ Vector Bit Vector Generation VMM Bit V Bit ‐ Vector t Result Bit ‐ vectors Interpreter 6 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking Test cases User space Kernel space Guest OS Syscall y Kernel API Specification Specification Syscall Object Creation, Execution Deletion Syscall Context Object Identification Tracking Bit ‐ Vector Bit Vector Generation VMM Bit V Bit ‐ Vector t Result Bit ‐ vectors Interpreter 7 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking Test cases User space Kernel space Guest OS Tracking the object life 1 Syscall y Kernel API Specification Specification Syscall Object Creation, time. Execution Deletion Assigning a static type to 2 Syscall Context Object Identification Tracking the dynamic object. Tracking the object size. Bit ‐ Vector Bit Vector 3 Generation VMM Tracking object relations. 4 Bit ‐ Vector Bit V t Result Bit ‐ vectors Interpreter 7 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: Object Life Time An easy problem by hooking the corresponding kernel APIs Creation 1 kmem_cache_alloc kmalloc vmalloc Deletion 2 kmem_cache_free kfree vfree 8 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: Object Life Time An easy problem by hooking the corresponding kernel APIs Creation 1 kmem_cache_alloc kmalloc vmalloc Deletion 2 kmem_cache_free kfree vfree We will use kmalloc/kfree to denote these functions. 8 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: Assigning a Static Type The problem What we observe: each dynamic data structure (object) instance and their virtual addresses What we want: a static type associated to each instance 9 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: Assigning a Static Type The problem What we observe: each dynamic data structure (object) instance and their virtual addresses What we want: a static type associated to each instance Typical approaches Using the call-site-chain from the top callers to kmalloc 1 (e.g., f → g → h → kmalloc ) May over-classify an object type Using the program counter (PC) that invokes kmalloc 2 (i.e., PC kmalloc ) May under-classify an object type (because of wrapper) 9 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: Assigning a Static Type PC kmalloc approach A single kernel object (e.g., task_struct ) can often be 1 allocated in different calling contexts (e.g., vfork , clone ) → over-classify Experimental data 2 80.3% of the kernel objects have a direct mapping with PC kmalloc approach 97.5% of the objects over-classified with call-chain approach 10 / 29
Introduction A RGOS Design Experimental Results Discussions & Related Work Summary & References Object Tracking: the Object Size The problem No size argument to many other kernel object allocation functions (e.g., kmem_cache_alloc ) 11 / 29
Recommend
More recommend
