Finding the attack surface of the systems and applications is an important phase in secure software development lifecycle. Attack surface usually analyzed with the help of the experts or static and dynamic analysis tools. Most of the analysis tools and methods can be applied only to the single programs and do not cover the systems that consist of several heterogenous components. In this paper we present new hybrid introspection method for analyzing the software which includes interpreted code and just-in-time (JIT) compilers besides the machine code. We show how to inspect such applications when they are executed in the virtual machine. Targeting the virtual machine analysis allows one to recover the attack surface for the complex systems that include web servers, databases, and other backend components. We also present a case study with the analysis of Java application and show how to find bugs in the core dependencies, that reside on the attack surface.

Existing file operation tracing methods are always OS-specific. It is a problem for file monitoring in some exotic operating systems and other programs running in privileged mode. We present a file system specific solution that could be work with any guest OS on a virtual machine. This solution works on the basis of intercepting requests to a block device. Our implementation is based on the QEMU emulator and supports ext2 and ext3 file systems.