LiveDM : Temporal Mapping of Dynamic Kernel Memory for Dynamic Kernel Malware Analysis and Debugging

Dynamic kernel memory is difficult to analyze due to its volatile status; numer ous kernel objects are frequently allocated or freed in a kernel’s heap, and their data types are missing in the m emory systems of current commodity operating systems. Since the majority of kernel data is stored dynamically, this memory has been a favorite target of many malicious software and kernel bugs. In order to analyze dynam ic kernel memory, a global technique that systematically translates a given memory address into a data type is essential. Previous approaches had a limited focus in the analysis of either a malware’ s ex cution or a snapshot of kernel memory. We present here a new memory interpretation system called Live DM that can automatically translate dynamic kernel memory addresses into data types. 1 This system enables the accurate memory analysis of the entire kernel execution, ranging from malware activity to legitimate kernel co de execution, over a period of time beyond the instant of a snapshot by using these two novel techniques. ( 1) The system identifies an individual dynamic kernel object with its systematically-determined runtime identifier tha t points to the code where the object is allocated. (2) The data type then can be automatically extracted from the cod e using static code analysis offline. We have implemented a prototype of LiveDM that supports three Linux kern els where LiveDM dynamically tracks tens of thousands of dynamic kernel memory objects that can be ccurately translated into data types in the offline process. We have evaluated and validated its general applicab ility nd effectiveness in extensive case studies of kernel malware analysis and kernel debugging.