Techniques Based On Virtual Machine In Anti-Rootkit

With the development of information technology, Linux has been applied to the server and desktop systems widely. In recent years, with the popularity of embedded system Linux also has been a dominant operating system in embedded fields such as communications, industrial control, aerospace military, health care and consumer electronics. Research shows that device driver?s code accounts for 70% of Linux kernel code and the dominant operating system at present contains about 35,000 device drivers.In order to improve the operating system?s performance and satisfy the requirement of privileged instructions such as I/O instructions, device drivers often run in the kernel space. The code runs in the kernel space is trusted by kernel unconditionally. Therefore a small bug in device driver will lead to a system-wide failure. What?s more, programming in kernel must comply with a lot of restrictions and it?s difficult to ensure the reliability of drivers because of lack of development, debugging and testing tools.Based on the research of Linux device driver model, this paper proposes and implements a new user-mode device driver framework called U2MDF(Unified User-Mode Driver Framework). The core idea of U2MDF is splitting the traditional device driver into two parts. One called kernel-mode driver component contains the hot code related to performance or critical paths, such as interrupt handler, and the other called user-mode driver component contains the performance-independent code, such as the device initialization. To take network device RTL8139 for an example, the prototype system of U2MDF is implemented. Experiments show that U2MDF reduces the driver code that runs in the kernel mode effectively and isolates the driver and kernel roughly. Therefore it ultimately improves the reliability of operating systems.