Mapping Kernel Objects to Enable Systematic Integrity Checking

Dynamic kernel data have become an attractive target for kernelmode malware. However, previous solutions for checking kernel integrity either limit themselves to code and static data or can only inspect a fraction of dynamic data, resulting in limited protection.  Our study shows that previous solutions may reach only 28% of the dynamic kernel data and thus may fail to identify function pointers manipulated by many kernel-mode malware.

KOP (v1) was the first system that can map kernel objects with nearly complete coverage and nearly perfect accuracy.  Unlike previous approaches, which ignore generic pointers, unions and dynamic arrays when locating dynamic kernel objects, KOP (1) applies interprocedural points-to analysis to compute all possible types for generic pointers (e.g., void*), (2) uses a pattern matching algorithm to resolve type ambiguities (e.g., unions), and (3) recognizes dynamic arrays by leveraging knowledge of kernel memory pool boundaries.

In KOP (v1), we made the following contributions:

  • We designed a points-to analysis algorithm to perform an inter-procedural, field-sensitive, and context-sensitive analysis of a large C/C++ program such as an OS kernel.
  • We designed an algorithm to infer candidate types for genericpointers based on a points-to graph.
  • We designed a set of techniques to resolve type ambiguities in memory traversal.
  • We designed an approach to recognize dynamic arrays and their sizes in a memory snapshot.
  • We developed the first tool that can identify implicit function pointers manipulated by kernel-mode malware.
  • We developed a prototype system of KOP that can map dynamic kernel data in a Windows system loaded with a large number of drivers with nearly complete coverage and nearly perfect accuracy.