Guest VM Snapshot Optimization for ASLR Memory Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Address Space Layout Randomization (ASLR) in Windows Vista and later versions prevents sharing of modules between host and guest operating systems due to randomization of load addresses, leading to increased memory usage.
Innovation Solution
Optimizing a guest virtual machine snapshot by creating a live snapshot that includes context information for executable modules, allowing for quick relocation and sharing of pages between host and guest operating systems, thereby bypassing the need for relocation using the PE header.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ASLR is implemented to improve security, then security is improved, but memory usage increases and module sharing between host and guest is prevented
Solution Approach 1:
The system performs preliminary actions by creating a live snapshot of the guest VM before shutdown, capturing memory pages and executable module information. This snapshot is then used during the guest VM's next startup to quickly restore the previous state without requiring full module reloading, thereby reducing memory usage while maintaining ASLR security benefits
Solution Approach 2:
The system creates a copy of the guest VM's memory state through the live snapshot mechanism. Instead of sharing actual memory pages between host and guest (which ASLR prevents), the system copies the memory state at a specific point in time and uses this copy for rapid restoration, achieving efficient resource utilization without compromising ASLR's security model
2Reliability
If ASLR randomizes load addresses, then security is improved, but module sharing between host and guest operating systems is prevented
Solution Approach 1:
The system performs preliminary identification and capture of executable module information during the guest VM shutdown process. This pre-captured information is then used during startup to rapidly restore modules without requiring them to be shared between host and guest, thus maintaining ASLR's address randomization while improving startup productivity
Solution Approach 2:
The live snapshot acts as an intermediary mechanism that bridges the gap between ASLR's security requirements and module sharing capabilities. It captures the complete memory state including module information at shutdown, then uses this intermediary snapshot during startup to restore the guest VM state without requiring actual module sharing, thus preserving both security and functionality
3Ease of manufacture
If a traditional snapshot is taken without optimization, then the snapshot process is simple, but loading speed and memory efficiency are reduced
Solution Approach 1:
The system performs preliminary identification of executable modules and their memory pages during the guest VM shutdown process. This pre-processing information about which modules need to be restored and their locations is captured in the live snapshot, enabling rapid restoration during startup without requiring complex operations at load time, thus improving loading speed while maintaining snapshot creation simplicity
Solution Approach 2:
The system uses feedback from the guest VM's running state during shutdown to optimize the snapshot creation process. By identifying and capturing information about executable modules and their memory pages while the system is still running, the snapshot includes optimized metadata that feedback into the startup process, enabling faster restoration without complicating the snapshot creation mechanism
Data Source
AI summary
Loading a guest virtual machine from a snapshot includes determining a plurality of executable modules loaded in a guest operating system. Hash values for pages of guest physical memory in the snapshot file are determined. Hash values for pages of the executable modules executing in the guest operating system are determined. Matches to the pages in the guest physical memory and the pages of the executable modules are searched for using the hash values. Context information associated with the matching pages in the guest physical memory and the pages of the executable modules is written to the snapshot. The snapshot is modified to link the guest physical memory to the pages of the executable modules.