SPIDER: Stealthy Binary Program Instrumentation and Debugging Via Hardware Virtualization

The ability to trap the execution of a binary program at de sired instructions is essential in many security scenarios such as malware analysis and attack provenance. However, an in creasing percent of both malicious and legitimate programs are equipped with anti-debugging and anti-instrumentation techniques, which render existing debuggers and instrumen tation tools inadequate. In this paper, we present Spi der, a stealthy program instrumentation framework which enables transparent, efficient and flexible instruction-level trapping based on hardware virtualization. Spider uses in visible breakpoint, a novel primitive we develop that inher its the efficiency and flexibility of software breakpoint, and utilizes hardware virtualization to hide its side-effects from the guest. We have implemented a prototype of Spider on KVM. Our evaluation shows that Spider succeeds in re maining transparent against state-of-the-art anti-debugging and anti-instrumentation techniques; the overhead of in visible breakpoint is comparable with traditional hardware breakpoint. We also demonstrate Spider’s usage in various security applications. 1