Finding the attack surface of the systems and applications is an important phase in secure software development lifecycle. Attack surface usually analyzed with the help of the experts or static and dynamic analysis tools. Most of the analysis tools and methods can be applied only to the single programs and do not cover the systems that consist of several heterogenous components. In this paper we present new hybrid introspection method for analyzing the software which includes interpreted code and just-in-time (JIT) compilers besides the machine code. We show how to inspect such applications when they are executed in the virtual machine. Targeting the virtual machine analysis allows one to recover the attack surface for the complex systems that include web servers, databases, and other backend components. We also present a case study with the analysis of Java application and show how to find bugs in the core dependencies, that reside on the attack surface.

This paper presents SWAT - System-Wide Analysis Toolkit. It is based on open source emulation and debugging projects and implements the approaches for non-intrusive system-wide analysis and debugging: lightweight OS-agnostic virtual machine introspection, full system execution replay, non-intrusive debugging with WinDbg, and full system reverse debugging. These features are based on novel non-intrusive introspection and reverse debugging methods. They are useful for stealth debugging and analysis of the platforms with custom kernels. SWAT includes multi-platform emulator QEMU with additional instrumentation and debugging features, GUI for convenient QEMU setup and execution, QEMU plugin for non-intrusive introspection, and modified version of GDB. Our toolkit may be useful for the developers of the virtual platforms, emulators, and firmwares/drivers/operating systems. Virtual machine intospection approach does not require loading any guest agents and source code of the OS. Therefore it may be applied to ROM-based guest systems and enables using of record/replay of the system execution. This paper includes the description of SWAT components, analysis methods, and some SWAT use cases.

This paper presents a novel approach for virtual machine introspection of the embedded systems based on the unknown revisions of the known kernels. Existing introspection methods require embedding the code into the guest to capture the data for analysis algorithms. When OS image is extracted from the ROM, usually no analysis code can be loaded into the virtual machine. We propose new non-intrusive method for extracting the kernel- and process-level information from such virtual machines. This method is based on the application binary interface, which is small enough and usually non-volatile. Therefore one analysis configuration may be used for different systems with the kernels from the same family without re-tuning them. We also present the analysis framework based on the simulator QEMU. It includes instrumentation and some tools for extracting the process- and kernel-level information from the guest. Our framework may be applied to ROM-based guest systems and enables using of record/replay of the system execution during the analysis. We applied our framework to some public firmwares to evaluate how our method works on the embedded systems with custom Linux kernel.

This paper presents the framework based on the emulator QEMU. Our framework provides set of multi-platform analysis tools for the virtual machines and mechanism for creating instrumentation and analysis tools. Our framework is based on a lightweight approach to dynamic analysis of binary code executed in virtual machines. This approach is non-intrusive and provides system-wide analysis capabilities. It does not require loading any guest agents and source code of the OS. Therefore it may be applied to ROM-based guest systems and enables using of record/replay of the system execution. We use application binary interface (ABI) of the platform to be analyzed for creating introspection tools. These tools recover the part of kernel-level information related to the system calls executed on the guest machine.

Debugging of device drivers' failures is a very tough task because of kernel panics, blue screens of death, hardware volatility, long periods of time required to expose the bug, perturbation of the drivers by the debugger, and non-determinism of multi-threaded environment. This paper shows how reverse debugging reduces the influence of these factors to the process of drivers debugging. We present reverse debugger as a practical tool, which was tested for i386, x86-64, and ARM platforms, for Windows and Linux guest operating systems. We show that our tool incurs very low overhead (about 10%), which allows using it for debugging of the time sensitive applications. The paper also presents the case study which demonstrates reverse debugging of the USB kernel drivers for Linux.