Mapping kernel objects to enable systematic integrity checking

Abstract

Dynamic kernel data have become an attractive target for kernel-mode malware. However, previous solutions for checking kernel integrity either limit themselves to code and static data or can only inspect a fraction of dynamic data, resulting in limited protection. Our study shows that previous solutions may reach only 28% of the dynamic kernel data and thus may fail to identify function pointers manipulated by many kernel-mode malware.To enable systematic kernel integrity checking, in this paper we present KOP, a system that can map dynamic kernel data with nearly complete coverage and nearly perfect accuracy. Unlike previous approaches, which ignore generic pointers, unions and dynamic arrays when locating dynamic kernel objects, KOP (1) applies inter-procedural points-to analysis to compute all possible types for generic pointers (e.g., void*), (2) uses a pattern matching algorithm to resolve type ambiguities (e.g., unions), and (3) recognizes dynamic arrays by leveraging knowledge of kernel memory pool boundaries. We implemented a prototype of KOP and evaluated it on a Windows Vista SP1 system loaded with 63 kernel drivers. KOP was able to accurately map 99% of all the dynamic kernel data.To demonstrate KOP's power, we developed two tools based on it to systematically identify malicious function pointers and uncover hidden kernel objects. Our tools correctly identified all malicious function pointers and all hidden objects from nine real-world kernel-mode malware samples as well as one created by ourselves, with no false alarms.