A Lightweight Access Log Filter of Windows OS Using Simple Debug Register Manipulation

Abstract

Recently, leveraging hypervisor for inspecting Windows OS which is called as VM instospection has been proposed. In this paper, we propose a thin debugging layer to provide several solutions for current VM instrospection. First, out-of-the box monitoring has not been develoed for monitoring complicated event such as registry access of Windows OS. Second, logging inside guest OS is resource-intensive and therefore detactable. Third, shared memory should be prepared for notifying events which makes the system so complicated. To solve these problems, we emdded a simple debug register manipulation inside guest VM and modify its handler of hypervisor. In proposed system, we only change a few generic and debug register to cope with highly frequent events without allocating memory and generating file I/O. As a result, resource utilization of CPU, memory and I/O can be drastically reduced compared with commodity logging software inside Windows OS. In experiment, we have shown the result of tracking registry access of malware running on Windos OS. It is shown that proposed system can achive the same function of ProcMon of Windows OS with reasonable resource utilization. Particularly, we have achieved more than 84% of memory usage and 97% of disk access reduction compared with the case of using ProcMon.