Visible to the public Biblio

Filters: Author is Fursova, Natalia  [Clear All Filters]
2021-07-08
Dovgalyuk, Pavel, Vasiliev, Ivan, Fursova, Natalia, Dmitriev, Denis, Abakumov, Mikhail, Makarov, Vladimir.  2020.  Non-intrusive Virtual Machine Analysis and Reverse Debugging with SWAT. 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS). :196—203.
This paper presents SWAT - System-Wide Analysis Toolkit. It is based on open source emulation and debugging projects and implements the approaches for non-intrusive system-wide analysis and debugging: lightweight OS-agnostic virtual machine introspection, full system execution replay, non-intrusive debugging with WinDbg, and full system reverse debugging. These features are based on novel non-intrusive introspection and reverse debugging methods. They are useful for stealth debugging and analysis of the platforms with custom kernels. SWAT includes multi-platform emulator QEMU with additional instrumentation and debugging features, GUI for convenient QEMU setup and execution, QEMU plugin for non-intrusive introspection, and modified version of GDB. Our toolkit may be useful for the developers of the virtual platforms, emulators, and firmwares/drivers/operating systems. Virtual machine intospection approach does not require loading any guest agents and source code of the OS. Therefore it may be applied to ROM-based guest systems and enables using of record/replay of the system execution. This paper includes the description of SWAT components, analysis methods, and some SWAT use cases.