Hidden Process Detection Based on Virtual Machine Monitor

摘要：

A Virtual Machine Monitor(VMM)has ready access to the raw state of its guest registers and memory even though it is separated from guests by a secure barrier. Hidden process detection based on VMM use this advantage to read out the memory of guests in hexadecimal without modifying the memory. By analyzing the hexadecimal data combined with windows system kernel structure, we present an original and effective solution to reveal processes hidden by Direct Kernel Object Manipulation(DKOM) and API Hook technique. In this paper, we use VMware ESX as the virtual platform and Windows XP SP3 as the guest OS. For other virtual platforms such as Xenserver and Virtualbox, a similar way can be adopted to reveal hidden processes in their guests.

关键词： Hidden process VProbes Windows kernel structure VMM

作者: Jingsong Cui Shasha Zhu Yuzhong Wen Xuhui Liu Yu Yang

作者单位: School of Computer Science Wuhan University Wuhan, China

会议类型: 国际会议

会议名称: 2010 International Conference on Future Information Technology(2010年未来信息技术国际会议 ICFIT 2010)

会议地点: 长沙

会议语种:英文

页码: 434-437

在线出版日期: 2010-12-14（万方平台首次上网日期，不代表论文的发表时间）