Dynamic discovery of internal kernel functions and global data

A non-transitory, computer-readable storage medium encoded with instructions executable by a processor to implement a hypervisor to dynamically discover internal address information of a guest kernel on a virtual machine, the instructions comprising:

• locating, by the hypervisor, a kernel system call or exported function in an image of the guest kernel in guest memory of the virtual machine based on parsing an export table comprising addresses associated with one or more exported functions or exported data in the image of the guest kernel to locate an address of the kernel system call or the exported function, wherein the guest memory corresponds to virtual memory allocated by the hypervisor;
• disassembling, by the hypervisor, machine code of the kernel system call or exported function in the image into assembly code;
• detecting, by the hypervisor, a pattern from memory references in the assembly code, wherein the pattern includes at least one of:
• a call to a specific exported function with a first internal global data as a parameter for the specific exported function;
• a call to an internal function with a specific exported global data as a parameter for the internal function;
• a specific exported function returning a value at an offset in an internal data structure;
• and
• a specific instruction that operates on a second internal global data;
• and
• after detecting the pattern, determining, by the hypervisor, the internal address information of the guest kernel associated with the first internal global data, the internal function, the internal data structure, or the second internal global data from the assembly code.

A computer system, comprising:

• a memory;
• a secondary memory storing code for a hypervisor;
• a processor configured to load the code from the secondary memory to main memory and execute the code to:
• locate, by the hypervisor, a kernel system call or exported function in an image of a guest kernel in memory of a virtual machine based on parsing an export table comprising addresses associated with one or more exported functions or exported data in the image of the guest kernel to locate an address of the kernel system call or the exported function, wherein the memory corresponds to virtual memory allocated by the hypervisor;
• disassemble, by the hypervisor, machine code of the kernel system call or exported function in the image into assembly code;
• detect, by the hypervisor, a pattern from memory references in the assembly code, wherein the pattern includes at least one of:
• a call to a specific exported function with a first internal global data as a parameter for the specific exported function;
• a call to an internal function with a specific exported global data as a parameter for the internal function;
• a specific exported function returning a value at an offset in an internal data structure;
• and
• a specific instruction that operates on a second internal global data;
• and
• after detecting the pattern, determine, by the hypervisor, the internal address information of the guest kernel associated with the first internal global data, the internal function, the internal data structure, or the second internal global data from the assembly code.