Systems and methods for active operating system kernel protection
Systems and methods for intercepting computing device system calls for a computing device including a kernel having a system call table. A hypervisor is executed on the computing device, the hypervisor configured to control at least one of the computing device processor registers. At least one modified kernel structure is created, the modified kernel structure including a modified system call table. A memory address of an original system call handler is determined, the original system call handler configured to receive kernel operation commands. A size of a loaded image of the original system call handler is determined. A copy of the original system call handler as a second system call handler is created, and the second system call handler intercepts a computing device system call.
1. A computing device kernel comprising:
an address space;
an original system call handler loaded on the address space and configured to receive and execute computing device kernel operation commands; and
a substitute system call handler loaded on the address space, wherein the substitute system call handler is generated as a copy of the original system call handler by determining a memory address of the original system call handler and determining a size of a loaded image of the original system call handler,
wherein the substitute system call handler is configured to intercept a computing device system call as directed by a hypervisor operably coupled to the address space.
2. The computing device kernel of claim 1 , further comprising a modified system call table loaded on the address space, the modified system call table being a copy of an original system call table used by the original system call handler, the modified system call table configured for use with the substitute system call handler.
3. The computing device kernel of claim 2 , wherein the original system call table comprises a System Service Dispatch Table (SSDT).
4. The computing device kernel of claim 1 , further comprising one or more exception tables loaded on the address space, the one or more exception tables related to execution code of the substitute system call handler.
5. The computing device kernel of claim 1 , wherein the hypervisor is configured to control at least one computing device processor register through the substitute system call handler.
6. The computing device kernel of claim 5 , wherein the at least one computing device processor register comprises a Machine Specific Register (MSR).
7. The computing device kernel of claim 6 , wherein the substitute system call handler is configured to interface with a Kernel Patch Protection (KPP) engine without detection of the substitute system call handler.