Memory introspection engine for integrity protection of virtual machines
Described systems and methods allow protecting a computer system from malware, such as viruses and rootkits. In some embodiments, a hypervisor configures a hardware virtualization platform hosting a set of operating systems (OS). A memory introspection engine executing at the processor privilege level of the hypervisor dynamically identifies each OS, and uses an protection priming module to change the way memory is allocated to a target software object by the memory allocation function native to the respective OS. In some embodiments, the change affects only target objects requiring malware protection, and comprises enforcing that memory pages containing data of the target object are reserved exclusively for the respective object. The memory introspection engine then write-protects the respective memory pages.
1. A host system comprising at least one processor configured to execute:
an operating system configured to allocate a section of a virtualized physical memory of a virtual machine to a target software object executing within the virtual machine, the virtual machine exposed by a hypervisor executing on the host system, wherein the virtualized physical memory is partitioned into pages, a page being the smallest unit of memory individually mapped between the virtualized physical memory and a physical memory of the host system; and
a protection priming module configured, in response to a determination of whether the target software object satisfies a selection criterion for malware protection, when the target software object satisfies the selection criterion, to change a memory allocation of the target object, wherein changing the memory allocation comprises ensuring that any page containing at least part of the target software object is reserved for the target software object.
2. The host system of claim 1 , further comprising a memory introspection engine connected to the protection priming module, the memory introspection engine configured, in response to the protection priming module changing the memory allocation, to write-protect all pages containing at least part of the target software object.
3. The host system of claim 2 , wherein the memory introspection engine is further configured to:
determine whether the target software object has been initialized, and
in response, when the target software object has been initialized, write-protect all pages containing at least part of the target software object.
4. The host system of claim 1 , wherein the selection criterion comprises selecting the target software object according to a type of the operating system.
5. The host system of claim 4 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises identifying the type of the operating system according to a content of a model specific register (MSR) of the virtual machine.
6. The host system of claim 4 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises identifying the type of the operating system according to a content of memory pointed to by a model specific register (MSR) of the virtual machine.
7. The host system of claim 1 , wherein changing the memory allocation comprises hooking a memory allocation function of the operating system.
8. The host system of claim 1 , wherein changing the memory allocation comprises instructing a memory allocation function of the operating system to allocate any page containing at least part of the target software object exclusively to the target software object.
9. The host system of claim 8 , wherein instructing the memory allocation function comprises changing a size of the target software object to an integer multiple of page size.
10. The host system of claim 9 , wherein instructing the memory allocation function further comprises aligning the section to a page boundary.
11. The host system of claim 1 , wherein the protection priming module is further configured to establish a reserved pool of pages, the pool reserved for allocation to malware-protected software objects, and wherein changing the memory allocation comprises allocating the section within the reserved pool of memory pages.
12. The host system of claim 1 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises:
determining whether the target software object is a driver object; and
in response, when the target software object is a driver object, determining that the target software object satisfies the selection criterion for malware protection.
13. The host system of claim 1 , wherein the protection priming module is further configured to change a de-allocation of the target object, wherein changing the de-allocation comprises:
determining whether a page containing at least part of the target software object is write-protected, and
in response, when the page is write-protected, removing the write protection from the page.
14. The host system of claim 12 , wherein changing the de-allocation further comprises hooking a memory de-allocation function of the operating system.
15. A method comprising:
employing at least one processor of a host system to form an operating system configured to allocate a section of a virtualized physical memory of a virtual machine to a target software object executing within the virtual machine, the virtual machine exposed by a hypervisor executing on the host system, wherein the virtualized physical memory is partitioned into pages, a page being the smallest unit of memory individually mapped between the virtualized physical memory and a physical memory of the host system; and
in response to a determination of whether the target software object satisfies a selection criterion for malware protection, when the target software object satisfies the selection criterion, employing the at least one processor to change a memory allocation of the target software object, wherein changing the memory allocation comprises ensuring that any page containing at least part of the target software object is reserved for the target software object.
16. The method of claim 15 , further comprising, in response to changing the memory allocation, write-protecting all pages containing at least part of the target software object.
17. The method of claim 16 , further comprising:
determining whether the target software object has been initialized, and
in response, when the target software object has been initialized, write-protecting all pages containing at least part of the target software object.
18. The method of claim 15 , wherein the selection criterion comprises selecting the target software object according to a type of the operating system.
19. The method of claim 18 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises identifying the type of the operating system according to a content of a model specific register (MSR) of the virtual machine.
20. The method of claim 18 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises identifying the type of the operating system according to a content of memory pointed to by a model specific register (MSR) of the virtual machine.
21. The method of claim 15 , wherein changing the memory allocation comprises hooking a memory allocation function of the operating system.
22. The method of claim 21 , wherein changing the memory allocation comprises instructing a memory allocation function of the operating system to allocate all pages containing at least part of the target software object exclusively to the target software object.
23. The method of claim 22 , wherein instructing the memory allocation function comprises changing a size of the target software object to an integer multiple of page size.
24. The method of claim 23 , wherein instructing the memory allocation function further comprises aligning the section to a page boundary.
25. The method of claim 15 , wherein changing the memory allocation comprises:
establishing a reserved pool of pages, the pool reserved for allocation to malware-protected software objects, and
allocating the section within the reserved pool of memory pages.
26. The method of claim 15 , wherein the determination of whether the target software object satisfies the selection criterion for malware protection comprises:
determining whether the target software object is a driver object; and
in response, when the target software object is a driver object, determining that the target software object satisfies the selection criterion for malware protection.
27. The method of claim 15 , further comprising employing the at least one processor to change a de-allocation of the target software object, wherein changing the de-allocation comprises:
determining whether a page containing at least part of the software object is write-protected, and
in response, when the page is write-protected, removing the write protection from the page.
28. The method of claim 27 , wherein changing the de-allocation further comprises hooking a memory de-allocation function of the operating system.
29. A non-transitory computer-readable medium encoding instructions which, when executed by at least one processor of a host system, cause the at least one processor to:
allocate a section of a virtualized physical memory of a virtual machine to a target software object executing within the virtual machine, the virtual machine exposed by a hypervisor executing on the host system, wherein the virtualized physical memory is partitioned into pages, a page being the smallest unit of memory individually mapped between the virtualized physical memory and a physical memory of the host system; and
in response to a determination of whether the target software object satisfies a selection criterion for malware protection, when the target software object satisfies the selection criterion, change a memory allocation of the target software object, wherein changing the memory allocation comprises ensuring that any page containing at least part of the target software object is reserved for the target software object.