Virtual Machine Introspection in Malware Analysis – LibVMI

August 8, 2018 by

Youness Zougar

In the last article in this series, we have seen what Virtual Machine Introspection is and how it works in general. Now, in this article, we'll see how we can set up VMI and what tools to use.

What is LibVMI?

LibVMI is a library written in C which allows users to set up an introspection system of virtual machines under Linux and Windows. It also allows access to a running virtual machine memory and does this by offering several already-made functions for accessing memory using physical or virtual addresses, or even with Kernel symbols. LibVMI even offers access to memory made from a snapshot of a physical memory, which can be especially interesting when doing debugging or forensics.

Become a certified reverse engineer!

Get live, hands-on malware analysis training from anywhere, and become a Certified Reverse Engineering Analyst.

Start Learning

In addition to memory access, LibVMI supports memory events. These events trigger notifications when a memory region is accessed in read, write or execution mode.

LibVMI was conceived to run under Linux. The most-used platform is Xen, but KVM can be used as well.

Multiple complex levels of abstraction exist when we talk about introspection. Those levels are hopefully handled by LibVMI and are completely transparent for us.

Use Cases

LibVMI offers by default a set of examples with the aim of testing the introspection concept or using them as basis to create a customized introspection system.

Process Listing

The following example allows you to list all running processes on the virtual machine from the hypervisor.

We start by initializing LibVMI contexts (LibVMI instance) which corresponds to the virtual machine on which we are running our program.

After that, initialization of the fields will be different, depending on which operating system we are looking to list the running processes of. In the given example, we consider three types of operating systems: Windows, Linux and FeeBSD.

After retrieving the interesting data, we are then going to loop on the processes list and print them to the console (PID, process name, memory address) one by one until the end of the processes chain.

Finally, we are going to call the function which is going to destroy every LibVMI instance created for the virtual machine and clean every memory region corresponding to it.

Events Monitoring

Besides its classic use demonstrated in the example above, LibVMI allows you to monitor memory events on the fly, not only by notifying the hypervisor for each memory access (read, write, execute) but also by reporting exceptions (breakpoints, access violation).

Below is an example extracted from LibVMI examples, allowing you to create interruption events.

Unlike the initialization part of the listing process example, we have a little modification to overcome. We will need to add the flag VMI_INIT_EVENTS so that the LibVMI instance will have the capacity to monitor events on the fly.

After initializing LibVMI and determining the use of the events, it is now possible for us to create callbacks to track the chosen event types. In the following example, the choice was done on interruption event INT3.

We initialize then our callback function, which will be executed each time the interruption is trapped. This callback function supposes that all INT3 events may be caused by a debugger and will simply reinject them without doing anything.

Finally, we call an infinite loop (unless it is interrupted by ctrl+c for example) which will continue to listen permanently to the coming events and process them.

...

while (!interrupted) {

    vmi_events_listen(vmi, 500);

}

...

Thank you for joining me for this brief look at the uses of LibVMI! We'll be continuing this and other such examinations in ongoing articles from InfoSec Institute.