Transcript slides
Presenter: Chuong Ngo Comprehensive Kernel Instrumentation via Dynamic Binary Translation Peter Feiner, Angela Demke Brown, Ashvin Goel University of Toronto No parents, uncles, or girlfriends were killed during the creation of this presentation THE ORIGIN STORY STARTING IN MEDIAS RES DBT is the Answer! Emulation of one instruction set by another through translation of binary code during execution. More practical than static binary translation. ◦ Simplifies identification of executable code. ◦ Amortization of translation overhead costs over time. …and I Remember Everything! The Answer to What? Ports ◦ Abandonware Analysis Bug finding Security Assemble! Pin DynamoRio Valgrind User Level Power Level < 9K JIFL PinOS All the way from Earth-1610 via Cataclysm IT’S A BIRD! IT’S A PLANE! IT’S DRK! But Who Hides Behind the Mask? 4 Goals for kernel DBT framework: ◦ Full coverage of kernel code. ◦ No direct overhead for user level code. ◦ Preserve original concurrency and execution interleaving. ◦ Be transparent. DynamoRio for the kernel. DynamoRio Flashback! Code cache CTIs return control to dispatcher Direct branching patches Next Executing Tail Client callbacks Well Victor…I’ve been thinking. All kernel entry points point to dispatcher. ◦ Shadow descriptor table Self-contained dispatcher ◦ Custom heap allocator ◦ “Pull” I/O model CPU-private data Interrupts delayed in code cache, disabled in dispatcher. Exceptions use restored native states. A Carbonadium Skeleton DRK Initialization Allocates memory for heap ◦ Checks all processors for successful memory mapping. ◦ Must be within 2GB of text and data segments. Individual CPU initialization ◦ Allocate CPU resources ◦ All kernel entry points to dispatcher ◦ All interrupts redirected DRK Normal Operations Dispatcher creates and caches code fragment. Context switches to the code fragment. Determine target of control transfer instruction and dispatch. Kernel exit points executed via native instructions. You Can’t Escape This Timeline! Exceptions run native ◦ Native state must be restored. Interrupts are delayed and emulated. ◦ Other interrupts are disabled. ◦ Captured interrupt executed between block dispatches. How did--? This… you… What are you? HOW DOES IT STACK UP? I’ve always found hardware to be more reliable Test System: Dell Optiplex 980 ◦ 8 GB RAM ◦ 4x Intel Core i7s at 2.8 GHz, no hyperthreading 2 Clients: ◦ Null Client ◦ Instruction Count Filebench I’m the best at what I do? There’s a whole new master of magnetism in town! I know everything. I can’t help it. With great power… 4 Goals for kernel DBT framework: ◦ Full coverage of kernel code. ◦ No direct overhead for user level code. ◦ Preserve original concurrency and execution interleaving. ◦ Be transparent. I’ll be there…around every corner Full coverage of kernel code. Preserve original concurrency and execution interleaving. Fastest man alive with a limp No direct overhead for user level code. ◦ Increased cache and TLB misses. The cosmic rays…what did they do to us? Be transparent. ◦ No code cache consistency. ◦ Shadow descriptor tables readable via hardware registers. ◦ Page table inconsistencies. ◦ CPU-private data. …comes great responsibility. 4 Goals for kernel DBT framework: ◦ Full coverage of kernel code. ◦ No direct overhead for user level code. ◦ Preserve original concurrency and execution interleaving. ◦ Be transparent. This was the world that I had created. DRK APPLICATIONS DRK’s Shadow Memory Storing metadata about memory used. Ported UMBRA. ◦ Simple indirect mapping. ◦ Copy-on-write. ◦ 10x overhead vs. native. KAddrcheck Memory addressability checking tool. Scans slab allocator’s data structures to locate all pages and freelists. ◦ Triggers shadow memory allocations. Addressability checks run on every memory access. Stackcheck Stack overflow guard ◦ Checks for addressability errors. ◦ Kills calling thread and continues. Modified KAddrcheck Resolves overflow without system crash. Triumph! DRK is a kernel-level DBT. DynamoRIO “port”. Heavy implementation. Missing a number of features.