Host-Based VM Introspection via Dynamic Code Gadget Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Host-based virtual machine introspection (VMI) faces challenges in obtaining guest context and performing actions that are purely guest constructs due to limitations in monitoring and controlling virtual machines, including security risks from malware and operational constraints like kernel patch protection.
Innovation Solution
A hypervisor with VMI capability inserts breakpoints in guest kernel functions, reads memory and registers to parse parameters, and dynamically constructs and injects code gadgets to execute on an as-needed basis, enabling guest context determination and control without relying on guest agents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If an agent is introduced in the guest to bridge the guest context gap, then guest context can be obtained and guest-specific actions can be performed, but security risks increase because malware may disable the agent or compromise the communication channel between agent and host
Solution Approach 1:
The patent extracts the introspection functionality from the guest agent and relocates it to the host side. The host directly reads guest memory and registers to obtain context information, eliminating the need for a guest agent and its associated security vulnerabilities. This is achieved through host-based memory reading and breakpoint insertion capabilities that allow the host to directly access guest process information without intermediary software.
Solution Approach 2:
The patent introduces a host-based VMI application as an intermediary between the hypervisor and the introspection functionality. This application runs on the host and directly accesses guest memory and registers through hypervisor interfaces, serving as a secure mediator that eliminates the need for guest agents while maintaining the ability to obtain detailed guest context and perform security operations.
2Stability of the object's composition
If a guest agent is used to lock guest physical pages, then the mapping between guest virtual page and guest physical page can be kept constant, but the agent's interception capability is limited by guest operating system protections like kernel patch protection
Solution Approach 1:
Instead of having the guest agent attempt to lock pages from within the guest environment (where it is blocked by OS protections), the patent inverts the approach by having the host directly manipulate guest page tables through hypervisor interfaces. The host reads and modifies guest page table entries directly, bypassing guest OS protections entirely and achieving both page locking and broad interception capability.
Solution Approach 2:
The patent moves the page locking operation from the guest dimension (where OS protections apply) to the host dimension (where hypervisor control provides unrestricted access). By operating at the host level through virtual memory management interfaces, the system can lock guest physical pages and modify page mappings without being constrained by guest operating system security mechanisms.
3Loss of information
If breakpoints are inserted in guest kernel functions to obtain guest context, then detailed process information can be captured, but the system complexity increases due to dynamic code gadget construction and injection
Solution Approach 1:
The patent creates simplified copies of kernel functions at safe locations in guest memory. Instead of directly inserting breakpoints into protected kernel code, the system creates copy versions of the target functions that include the desired instrumentation. These copied functions are then invoked in place of the original kernel functions, providing the needed process information while avoiding the complexity of direct kernel patching and dynamic code injection.
Data Source
AI summary
A hypervisor monitors for an initialization of a guest kernel running on a virtual machine implemented by the hypervisor. When the initialization of the guest kernel is detected, the hypervisor pauses a virtual processor of the virtual machine, locates a guest kernel image of the guest kernel in guest memory, locates a kernel function in the guest kernel image, inserts a breakpoint on the guest kernel function, resumes the virtual processor and monitors for a breakpoint instruction. After detecting the breakpoint instruction, the hypervisor gathers guest context by examining the guest memory and guest registers, pauses the virtual processor, constructs and injects a code gadget configured to run in the virtual machine, diverts the virtual processor to execute the code gadget, which causes the virtual processor to call the hypervisor at the end of executing the code gadget, and returns the virtual processor to execute the guest kernel function.