SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures.

摘要: Brute force scanning of kernel memory images for finding data structure instances is an important function in many computer security and forensics applications. requires effective, robust signatures structures. Existing approaches often use the value invariants certain fields as signatures. However, they do not fully exploit rich pointsto relations between In this paper, we show that such points-to can be leveraged to generate graph-based structural invariant More specifically, develop SigGraph, a framework systematically generates non-isomorphic structures OS kernel. Each signature graph rooted at subject with its edges reflecting other Our experiments range Linux kernels SigGraph-based achieve high accuracy recognizing via brute scanning. We further SigGraph achieves better robustness against pointer anomalies corruptions, without requiring global mapping object reachability. demonstrate applied forensics, rootkit detection, version inference.