基于Intel VT硬件虚拟化的Rootkit技术  

Rootkit Technology Based on the Intel VT Hardware Virtualization

作　　者：孔维亮 曾光裕[1,2] 周登元[1,2] 

机构地区：[1]信息工程大学,河南郑州450001 [2]数学工程与先进计算国家重点实验室,河南郑州450001

出　　处：《信息工程大学学报》2016年第5期579-585,共7页Journal of Information Engineering University

基　　金：国家科技重大专项资助项目(2013JH00103)

摘　　要：Intel VT硬件虚拟化技术使Rootkit可以利用底层优势实现深度隐藏。首先结合木马协同隐藏的思想,提出了基于Intel VT硬件虚拟化的Rootkit(HVRootkit)的协同隐藏模型,并给出形式化描述;然后根据该模型,在深入分析进程切换过程和操作系统内核数据结构的基础上,设计并实现了HVRootkit原型,该原型能够监控系统进程的切换过程,并通过修改与内核层进程视图和用户层进程视图相关的数据结构,隐藏系统进程。实验表明,HVRootkit原型符合协同隐藏的思想,能够实现对进程的深度隐藏,隐藏性能明显优于传统的内核级Rootkit。Intel VT Hardware virtualization technology helps Rootkit realize deep hiding. By referring to Trojans cooperative concealment, this paper first puts forward a formal model of Rootkit based on the Intel VT Hardware Virtualization （HVRootkit） to realize cooperative concealment. It then studies the process switch and data structure of the operating system, based on which the prototype of HVRootkit is designed, which can monitor process switching and realize highly stealthy process by modifying data structure related to kernel level process view and user level process view. Experiment shows that HVRootkit prototype meets the idea of cooperative concealment. Furthermore, it can real- ize highly stealthy process and has better hiding property than traditional kernel level Rootkit.

关 键 词：内核级Rootkit 硬件虚拟化 协同隐藏 进程切换 进程视图 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]