Full Virtual Machine State Reconstruction for Security Applications
Christian Schneider · 2013
This work explores the possibilities and implications of bridging the semantic gap between the hypervisor and its virtual machines to support security applications using a technique called virtual machine introspection (VMI). We define a formal model for VMI to describe and compare such approaches. We then propose, implement and evaluate a novel VMI framework that applies knowledge of the operating system and derived through a source code analysis to reconstruct the kernel state from physical memory.