Rustifying the VM Introspection Ecosystem FOSDEM 2020 Dorian - - PowerPoint PPT Presentation

▶
rustifying the vm introspection ecosystem
SMART_READER_LITE
LIVE PREVIEW

Rustifying the VM Introspection Ecosystem FOSDEM 2020 Dorian - - PowerPoint PPT Presentation

Oct 30, 2023 385 likes •718 views

Rustifying the VM Introspection Ecosystem FOSDEM 2020 Dorian Eikenberg Mathieu Tarral Agenda What is VM Introspection ? VMI ecosystem today Rustifying the VM Introspection ecosystem Future work Virtualization

slide-1
SLIDE 1

Rustifying the VM Introspection Ecosystem

FOSDEM 2020

Mathieu Tarral Dorian Eikenberg

slide-2
SLIDE 2

Agenda

  • What is VM Introspection ?
  • VMI ecosystem today
  • Rustifying the VM Introspection ecosystem
  • Future work
slide-3
SLIDE 3

Virtualization Rust

  • 2015:

○ Rust 1.0

  • 2016:

○ rustyvisor

  • 2017:

○ crosvm ○ Firecracker

  • 2019:

○ rust-vmm ○

  • range_slice

○ cloud-hypervisor

Wenzel/awesome-virtualization

slide-4
SLIDE 4

VM Introspection

slide-5
SLIDE 5

VM Introspection

“Deriving the execution context of a virtual machine, from the hypervisor interface, by querying its hardware state, for security purposes”

slide-6
SLIDE 6

VM Introspection : Concepts

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API

  • Intercept hardware events

○ memory access (r/w/x) ○ interrupts ■ set breakpoints ! (int 3) ○ MSR registers ○ control registers ○ etc...

  • Modify hardware state

○ VCPUs registers ○ physical memory

slide-7
SLIDE 7

VM Introspection : Core Strenghts

What VMI provides:

  • VM hardware access

○ full system view at hypervisor-level privilege

  • Interposition

○ control what hardware events to catch ○ manipulate what the OS should see of itself

slide-8
SLIDE 8

VM Introspection : Scenarios

  • When detectability is an issue

○ stealth malware analysis

  • Need a full-system approach

○ complex debugging scenarios (nested hypervisor) ○ advanced in-kernel fuzzing

  • Can’t rely on guest OS

○ to give you a view of itself ○ assuming compromised kernel ○ Unikernel (!)

slide-9
SLIDE 9

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

slide-10
SLIDE 10

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

  • Setup a breakpoint callback on “kernel32:WriteFile”
  • Filter on process name for “cargo.exe”
  • Callback: log function parameters
slide-11
SLIDE 11

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

  • Identify VM context: kernel and libraries
  • Load debug symbols
  • Identify current running process on VCPU
slide-12
SLIDE 12

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

  • write int3 in memory
  • register interrupt callback
  • write original opcode back
  • singlestep
slide-13
SLIDE 13

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

  • Deliver hardware event to each registered callbacks
slide-14
SLIDE 14

VM Introspection : Complexity

Virtual Machine Hypervisor

Virtualization layer

Introspection Agent VMI API Semantic Engine Virtual Address Translation Event Dispatcher Breakpoint Manager

  • Identify paging
  • Walk paging structures
slide-15
SLIDE 15

VMI ecosystem in 2020

slide-16
SLIDE 16

VMI API: Hypervisor Support

2007 2019

Community Effort Upstream integration Alternate EPT/RVI available

Xen XenAccess LibVMI

2011

VirtualBox

Winbagility

2017

Hyper-V

LiveCloudKd

KVM

Nitro

KVM-VMI FireEye rVMI Bitdefender KVMi

QEMU

PyREBox

slide-17
SLIDE 17

VMI Projects : Silos

PyREBox

LibVMI

icebox LiveCloudKd rVMI pyvmidbg DRAKVUF

slide-18
SLIDE 18

The Idea : Unifying the ecosystem

slide-19
SLIDE 19

Unifying the ecosystem

PyREBox

LibVMI

icebox LiveCloudKd rVMI pyvmidbg DRAKVUF

slide-20
SLIDE 20

Unification : Constraints - Speed

PyREBox

LibVMI

icebox LiveCloudKd rVMI pyvmidbg DRAKVUF abstraction layer == cost

slide-21
SLIDE 21

Unification : Constraints - Compatibility

PyREBox

LibVMI

icebox LiveCloudKd rVMI pyvmidbg DRAKVUF Provide a C API

slide-22
SLIDE 22

Unification : Constraints - Cross-Platform

PyREBox

LibVMI

icebox LiveCloudKd rVMI pyvmidbg DRAKVUF Be easy to maintain on Windows/Linux

slide-23
SLIDE 23

Desired Quality - Memory Safety

Hypervisor

Virtualization layer

Introspection Agent VMI API

slide-24
SLIDE 24

Desired Quality - Memory Safety

Hypervisor

Virtualization layer

Introspection Agent VMI API Attack Surface

slide-25
SLIDE 25

Unifying the ecosystem

  • Speed
  • C compatibility
  • Cross-platform
  • Memory safety
slide-26
SLIDE 26

libmicrovmi : Playing lego with VMI

Unified low-level VMI API

Address Translation

Semantic Engine Breakpoint Manager

https://github.com/Wenzel/libmicrovmi

Hypervisors Custom Hypervisor Emulators

Dynamic Analysis

  • pyvmidbg
  • icebox
  • rVMI
  • LiveCloudKd
  • DECAF
  • PANDA
  • PyREBox
  • Drakvuf

Live-Memory Analysis

  • Volatility
  • Rekall

OS Hardening Monitoring Fuzzing

  • ApplePie

VMI Apps Event Dispatcher

slide-27
SLIDE 27

libmicrovmi

slide-28
SLIDE 28

libmicrovmi : Status

  • read physical memory
  • r/w VCPU registers
  • Subscribe on hardware events

○ registers ■ mov CR0/CR3/CR4 ■ mov DRx ■ r/w MSR ○ interrupts ○ singlestep ○ descriptors ○ hypercalls ○ memory ■ r/w/x on frame ■ switch on alternate EPT views

  • Utilities

○ foreign memory mapping ○ pagefault injection

  • C API
  • LibVMI integration
  • Xen

○ xenctrl / -sys ○ xenstore / -sys ○ xenforeignmemory / -sys

  • KVM

○ kvmi / -sys

  • VirtualBox

○ fdp / -sys

  • Hyper-V

○ vid-sys

  • QEMU
slide-29
SLIDE 29

Demo: mem-dump on Xen / KVM / VirtualBox

slide-30
SLIDE 30

Demo : Intercepting context switch on KVM (CR3 events)

  • Demo is running in nested virtualization
slide-31
SLIDE 31

Future - VM Introspection

  • An OS-independent hooking framework

○ Hypervisor-based intrusion detection ○ Full-system view for debuggers ○ A new layer of hardening and defense in depth ○ Snapshot-based fuzzing capabilities

  • Make VM Introspection a new commodity
slide-32
SLIDE 32

One Last Thing : GSoC

  • We will propose libmicrovmi for the GSoC
  • Part of the Honeynet organization
  • Ideas
  • Improve an existing driver

○ Xen / KVM / VirtualBox

  • Add support for emulators

○ QEMU / Bochs / Unicorn

  • Propose stealth breakpoints implementation based on EPT
  • Add libloading support to rust-lang/bindgen #1541
slide-33
SLIDE 33

Rustifying the VM Introspection ecosystem

FOSDEM 2020

Mathieu Tarral Dorian Eikenberg https://github.com/Wenzel/libmicrovmi @mtarral @rageagainsthepc