TLDR: Even though VM Introspection has lots of applicable areas, it has not gained it's full potential yet, due to a fragmented ecosystem.
This talk will quickly review the state of the technology and we will present our solution: a Rust library aiming at solving the issue mentionned before, in order to make VMI a commodity in the future for apps developers, enabling them to do:
Targeting any VMI compatible hypervisor or emulator.
From stealth malware analysis to OS hardening through fuzzing, virtual machine introspection is expanding the possibilities offered by our hypervisors, shifting our view of virtual machines, from opaques containers to fully transparent and instrumentable systems.
Today the VMI ecosystem is made of a multitude of applications, targeting one hypervisor or emulator, with their own semantic library. (Examples includes Drakvuf, PANDA, PyREBox, icebox, etc...). If we want to make the most out of VMI in the future, we need to build the libraries that will unify this ecosystem and let the developers focus on what matters: building quality VMI apps.
This is where libmicrovmi comes into play. It aims to solve this problem, by providing a core, foundation library, written in Rust, to be cross-platform, hypervisor-agnostic and emulator-agnostic, on top of which higher-level libraries and apps can rebase.
Rust makes a lot of sense for VMI for 2 main reasons:
Therefore Rust is the de facto choice for VMI apps in the future, and we are building it today, by providing libmicrovmi, a new foundation for VMI.
Libmicrovmi has drivers for:
Vrtual Machine Introspection is a concept born in a 2003 research paper titled "A Virtual Machine Introspection Based Architecture for Intrusion Detection". The idea resides in inspecting and understanding the real-time high-level state of a virtual machine, based on the hardware layer, for security purposes.
Since then the technology has made its way, from research and academic developments to being fully integrated and supported into mainstream hypervisors, like Xen.
The initial population who adopted VMI has been malware sandbox providers. Since common malware had a tendency to hide from debuggers, the level of stealth reached with this technology made it perfectly suited for this job, alongside the full system view.
Today VMI has grown to be applied in various domains:
As of today, Xen is the leading hypevisor, haivng VMI APIs since 2011. And since 2017, both KVM and VirtualBox have patches available, and even reviewed on the mailing list for KVM.
Regarding the libraries available, LibVMI stands out, as it provides a unified, hypervisor-agnostic, VMI API to applications, and a well-known malware analysis framework (Drakvuf) is based on it.
However, most of VMI applications today do not share the same common set of core libraries, which makes the ecosystem fragmented and hard to deal with, where a lot of efforts is spent solving the same problems everyone has, isolated by their own stacks.
This is where Rust comes into play. The language itself combines 3 important features:
Building this core library that will unify the ecosystem is the goal of libmicrovmi.
I have been building a hypervisor-level debugger, based on LibVMI. It can introspect a Windows guest and debug a specific process, while providing a GDB stub to be plugged into your favorite GDB fronted (IDA, radare2, etc ....)
The audience will need a bit of familiarity with virtualization concepts, this will be enough to understand the idea of introspection.
They can be totally new to Rust, as I once was a few months ago.
Speakers: Mathieu Tarral