Graph-based signatures for kernel data structures

摘要: Brute force scanning of kernel memory images for finding data structure instances is an important function in many computer security and forensics applications. requires effective, robust signatures structures. Existing approaches often use the value invariants certain fields as signatures. However, they do not fully exploit rich points-to relations between In this work, we show that such can be leveraged to generate graph-based structural invariant More specifically, develop SigGraph, a framework systematically generates non-isomorphic structures OS kernel. Each signature graph rooted at subject with its edges reflecting other Our experiments range Linux kernels SigGraph-based achieve high accuracy recognizing via brute scanning. We further SigGraph achieves better robustness against pointer anomalies corruptions, without requiring global mapping object reachability. demonstrate applied forensics, rootkit detection, version inference.