Improving Transparency of Hardware Breakpoints with Virtual Machine Introspection

Masaya Sato, Ryosuke Nakamura, Toshihiro Yamauchi, Hideo Taniguchi

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Hardware breakpoints are used to monitor the behavior of a program on a virtual machine (VM). Although a virtual machine monitor (VMM) can inspect programs on a VM at hardware breakpoints, the programs themselves can detect hardware breakpoints by reading debug registers. Malicious programs may change their behavior to avoid introspection and other security mechanisms if a hardware breakpoint is detected. To prevent introspection evasion, methods for hiding hardware breakpoints by returning a fake value to the VM are proposed. These methods detect the read and write operations of the debug register from the VM and then return the processing to the VM as if their access has succeeded. However, VM introspection remains detectable from the VM by confirming the availability of the debug exception in the address set. While the previous work handles the read and write operations of the debug register, the debug exception is not delivered to the VM program. To address this problem, this study presents a method for making hardware breakpoints compatible with VM introspection. The proposed method uses surplus debug address registers to deliver the debug exception at the hardware breakpoint set by the VM program. If a VM program attempts to write a value to a debug register, the VMM detects and stores the value in a real debug register that is not used for VM introspection. Because debug exception at the hardware breakpoint was delivered to the VM, hardware breakpoints set by the VM were compatible with VM introspection. The evaluation results showed that the proposed method had a low performance overhead.

Original languageEnglish
Title of host publicationProceedings - 2022 12th International Congress on Advanced Applied Informatics, IIAI-AAI 2022
EditorsTokuro Matsuo, Kunihiko Takamatsu, Yuichi Ono
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages113-117
Number of pages5
ISBN (Electronic)9781665497558
DOIs
Publication statusPublished - 2022
Event12th International Congress on Advanced Applied Informatics, IIAI-AAI 2022 - Kanazawa, Japan
Duration: Jul 2 2022Jul 7 2022

Publication series

NameProceedings - 2022 12th International Congress on Advanced Applied Informatics, IIAI-AAI 2022

Conference

Conference12th International Congress on Advanced Applied Informatics, IIAI-AAI 2022
Country/TerritoryJapan
CityKanazawa
Period7/2/227/7/22

Keywords

  • anti-evasion
  • hardware breakpoints
  • virtual machine introspection

ASJC Scopus subject areas

  • Computer Science Applications
  • Information Systems
  • Information Systems and Management
  • Decision Sciences (miscellaneous)

Fingerprint

Dive into the research topics of 'Improving Transparency of Hardware Breakpoints with Virtual Machine Introspection'. Together they form a unique fingerprint.

Cite this