LibVMI is an introspection library focused on reading and writing memory from virtual machines (VMs). For convienence, LibVMI also provides functions for accessing CPU registers, pausing and unpausing a VM, printing binary data, and more. LibVMI is designed to work across multiple virtualization platforms. LibVMI currently supports VMs running in either Xen or KVM. LibVMI also supports reading physical memory snapshots when saved as a file.
Memory introspection is useful because it allows you to monitor (read memory values) and control (write (present tense) memory values) an operating system from a protected location. But this is a difficult task.
Essentially, memory introspection is the process of viewing the memory of one virtual machine from a different virtual machine. On the surface, this sounds rather simple. In fact, Xen even provides a function to facilitate this type of memory access (although KVM does not).
What makes memory introspection difficult, and where LibVMI comes in, is the semantic gap between the two virtual machines. For example, to look up virtual addresses, LibVMI must walk the page tables inside the user virtual machine; however, in order to walk these page tables, LibVMI must first know where the page directory is located. And this location depends on the process address space you are viewing.
The more you think about the process of memory introspection, the clearer the complexities become. One must know a lot of details about the user operating system in order to build these higher levels of abstraction. LibVMI fills this knowledge gap.
Previous research has shown that introspection can be used for a wide variety of security applications, but more ideas are coming out all the time. Using LibVMI, you can quickly experiment with your new ideas and help advance this new and exciting research direction.
Figure 1. LibVMI must take several steps to access memory based on a kernel symbol. For example, this figure shows the steps that LibVMI takes to access a page of memory using a kernel symbol in Linux. The procedure for Windows is more complicated. In Windows, instead of using the System.map file, LibVMI converts kernel symbols to virtual addresses by parsing the kernel exports table in the memory of the running user VM.
LibVMI grew out of the XenAccess Project. While XenAccess was focused exclusively on Xen, LibVMI aims to be extensible to a wide variety of virtualization platforms. Furthermore, LibVMI provides a more intuitive API by transparently handling reads and writes across memory page boundaries. You can read more details about XenAccess in our research paper from ACSAC 2007 titled, “Secure and Flexible Monitoring of Virtual Machines”.
©1997-2011 Sandia Corporation | Questions and Comments | Privacy and Security | 
News release RSS feed