The hypro's intro from jdk8

View Code? Open in Web Editor NEW

VMI on BitVisor to detect hidden rootkits.

Makefile 3.99% Assembly 2.21% Shell 0.69% C 80.15% Groff 0.25% Objective-C 0.23% C++ 3.19% Batchfile 0.25% Perl 6.79% DIGITAL Command Language 1.61% XS 0.02% eC 0.03% Emacs Lisp 0.01% HTML 0.01% Protocol Buffer 0.01% Scheme 0.02% Perl 6 0.14% Prolog 0.15% M4 0.26%

hypro's Introduction

Hypro - VMI on BitVisor to detect hidden rootkits.

tools/adore-ng is a well-known LKM(loadable kernel modules) rootkit for getting root privilege, hiding certain processes, files, ports, .etc.
tools/hypercall has the files to read VM's processes, loaded kernel modules, physical memory from VMM, so we can check the differences to find exceptions.
core/vmmcall_vmi.c implements the core VMI functions.
VMI/fs is a ported EXT4 file system from Uboot. With this module, we can reread block device to check to hidden files.
Guest's Fs/(attacked)    VMI/fs
  |_______________________|
  |
driver
  |
hardware
BitVisor uses parapass-through architecture that allows VM's device driver to handle the real device. So VMI/fs is ported to host's OS.

New features(such as capture of memory event and register event) are under developement.

How to build:
Hypro's build can be found in BitVisor's HomePage.

Recommend Projects