Iterative Kernel Code Zone Detection in Virtual Machine Memory

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting the location of kernel code in virtual machine memory are inadequate, particularly for optimized kernel code lacking function markers and those with non-contiguous data within the code, as they fail to accurately identify and isolate the code area.

Innovation Solution

An iterative method that detects target addresses in memory, disassembles parts of the identified areas, and uses a stopping condition to determine the approximate area occupied by kernel code, incorporating a complementary search to precisely delimit the code zone, which includes grouping target addresses and excluding data ranges to enhance precision.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If function markers are used to identify kernel code location, then detection accuracy is improved, but this technique fails on optimized kernel code where function markers are virtually nonexistent

Engineering Contradiction:
Improvedetection accuracyVSAvoidcompatibility with optimized kernels
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent changes the detection parameter from relying on function markers (which are removed in optimized code) to using disassembly mechanisms that analyze code structure and control flow. This allows the system to adapt to different kernel optimization levels while maintaining detection accuracy.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The patent segments the kernel memory space into discrete addressable units and uses iterative disassembly to identify code regions. By breaking down the detection process into iterative steps of disassembly and analysis, it can accurately identify kernel code without depending on function markers.

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If disassembly mechanism is used to identify kernel code by detecting arbitrary first instruction, then code area can be identified, but this technique is not effective when data is present in the middle of the kernel code

Engineering Contradiction:
Improvecode area identification accuracyVSAvoidhandling non-contiguous data
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent implements a dynamic iterative process that adapts to the actual memory layout. Instead of assuming contiguous code, the system iteratively disassembles and analyzes target addresses, allowing it to dynamically adjust to non-contiguous data regions within the kernel code.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent uses feedback from each disassembly iteration to refine the identified code area. By continuously analyzing target addresses and comparing against known code patterns, the system can accurately delimit code regions even when data is interspersed, using feedback from each analysis cycle to improve precision.

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP3991028B1Iterative method and device for detecting an approximate zone occupied by the computer code of an operating system core in a memory
Publication Date: 2024.05.29 ORANGE SA
  • EP3991028B1 patent drawingFigure 1A~1B
  • EP3991028B1 patent drawingFigure 1C~2
  • EP3991028B1 patent drawingFigure 3A

AI summary

The method aims to detect an approximate zone (ZIC) occupied by the computer code of an operating system core (12) in a memory, the zone (ZIC) comprising one or more areas (ZC). It comprises an iterative method comprising: - detecting (E10) at least one target address (@RIk, @FSj) in the memory; - determining (E30) a first zone (Z1) defined by two of said target addresses (@Cmin, @Cmax); - dismantling (E40) said zones (Z1, Z2) at least in part determined (E30, E70) during the preceding iteration; - detecting target addresses (@Ci) pointing to the dismantled zones (Z1, Z2); and - a step (E90) of searching for an additional area of memory (MC) starting after the second target address obtained in the last iteration and only comprising computer code.