Iterative Kernel Code Zone Detection in Virtual Machine Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting the location of kernel code in virtual machine memory are inadequate, particularly for optimized kernel code lacking function markers and those with non-contiguous data within the code, as they fail to accurately identify and isolate the code area.
Innovation Solution
An iterative method that detects target addresses in memory, disassembles parts of the identified areas, and uses a stopping condition to determine the approximate area occupied by kernel code, incorporating a complementary search to precisely delimit the code zone, which includes grouping target addresses and excluding data ranges to enhance precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If function markers are used to identify kernel code location, then detection accuracy is improved, but this technique fails on optimized kernel code where function markers are virtually nonexistent
Solution Approach 1:
The patent changes the detection parameter from relying on function markers (which are removed in optimized code) to using disassembly mechanisms that analyze code structure and control flow. This allows the system to adapt to different kernel optimization levels while maintaining detection accuracy.
Solution Approach 2:
The patent segments the kernel memory space into discrete addressable units and uses iterative disassembly to identify code regions. By breaking down the detection process into iterative steps of disassembly and analysis, it can accurately identify kernel code without depending on function markers.
2Measurement precision
If disassembly mechanism is used to identify kernel code by detecting arbitrary first instruction, then code area can be identified, but this technique is not effective when data is present in the middle of the kernel code
Solution Approach 1:
The patent implements a dynamic iterative process that adapts to the actual memory layout. Instead of assuming contiguous code, the system iteratively disassembles and analyzes target addresses, allowing it to dynamically adjust to non-contiguous data regions within the kernel code.
Solution Approach 2:
The patent uses feedback from each disassembly iteration to refine the identified code area. By continuously analyzing target addresses and comparing against known code patterns, the system can accurately delimit code regions even when data is interspersed, using feedback from each analysis cycle to improve precision.
Data Source
Figure 1A~1B
Figure 1C~2
Figure 3A
AI summary
The method aims to detect an approximate zone (ZIC) occupied by the computer code of an operating system core (12) in a memory, the zone (ZIC) comprising one or more areas (ZC). It comprises an iterative method comprising: - detecting (E10) at least one target address (@RIk, @FSj) in the memory; - determining (E30) a first zone (Z1) defined by two of said target addresses (@Cmin, @Cmax); - dismantling (E40) said zones (Z1, Z2) at least in part determined (E30, E70) during the preceding iteration; - detecting target addresses (@Ci) pointing to the dismantled zones (Z1, Z2); and - a step (E90) of searching for an additional area of memory (MC) starting after the second target address obtained in the last iteration and only comprising computer code.