Full Virtual Machine State Reconstruction for Security Applications

This work explores the possibilities and implications of bridging the semantic gap between the hypervisor and its virtual machines to support security applications using a technique called virtual machine introspection (VMI). We define a formal model for VMI to describe and compare such approaches. We then propose, implement and evaluate a novel VMI framework that applies knowledge of the operating system and derived through a source code analysis to reconstruct the kernel state from physical memory.