To Flexibly Tame Kernel Execution With Onsite Analysis

## Overview

The presentation, delivered at Black Hat by an associate professor from the School of Computing and Information Systems at Singapore Management University (SMU), introduces **OASIS**, an on-site dynamic software analysis infrastructure designed for kernel and kernel malware analysis. Although previously published in an academic paper at IEEE S&P (Oakland) the prior year, the speaker presented OASIS at Black Hat to make the framework accessible to security practitioners. The primary objective of OASIS is to bridge the gap between intrusive, in-guest code instrumentation and out-of-band, hardware-assisted introspection.

---

## Limitations of Existing Kernel Analysis Approaches

The speaker outlines two dominant paradigms for dynamic kernel analysis, identifying critical drawbacks in both:

### 1. In-Kernel Code Instrumentation Analysis code is inserted into the kernel either via static instrumentation (requiring source code recompilation) or in-situ dynamic instrumentation. * **Advantages:** Because the analysis code merges into the kernel's binary, execution flow, and address space, it benefits from native access to kernel objects and memory. * **Drawbacks:** * **Intrusive and Inflexible:** Requires kernel modifications and recompilation, making it impractical for pre-existing production kernels running inside virtual machines. * **Security and Tampering Risks:** If the kernel is compromised by rootkits or kernel-level malware, the adversary can readily detect, tamper with, or disable the co-located analysis code, invalidating results.

### 2. Out-of-Band Hardware-Assisted Introspection To maintain transparency and security, academic approaches shift the analyzer outside the guest kernel into a more privileged hardware execution layer (such as a hypervisor using virtualization extensions, or System Management Mode (SMM) triggered by Performance Monitoring Units (PMUs)). * **Advantages:** The analyzer is isolated in a higher privilege tier, preventing the guest kernel or kernel malware from reading, detecting, or modifying it. * **Drawbacks:** * **Lack of Direct Control:** Interception events rely strictly on rigid hardware triggers rather than flexible, fine-grained program control. * **Semantic Gap / Memory Introspection Issues:** The external analyzer typically reads raw physical memory rather than the guest kernel's virtual address space, forcing analysts to manually reconstruct data structures ("fumbling in the dark"). * **Challenging Development Environment:** Environments such as SMM lack operating system services, runtime libraries, and software abstractions, leaving developers with only bare-metal CPU execution.

---

## The OASIS Approach: On-Site Analysis

OASIS seeks to combine the strengths of both paradigms while eliminating their drawbacks. The framework aims to provide: * **Transparency and Security:** Strong isolation from the target kernel to resist detection and tampering by kernel malware. * **Native-Level Flexibility:** On-site execution capabilities that retain direct access to the kernel's virtual memory and objects, allowing developers to perform rich introspection and runtime modification without the programming hurdles of raw hardware execution layers.