Home / Swift / Detect Memory Leaks

Hypervisor Memory Introspection Core Library

HVI stands for Hypervisor Introspection. The term is used interchangeably with HVMI, which is a bit more specific, and stands for Hypervisor Memory Introspection.
Information
Category: Swift / Detect Memory Leaks
Watchers: 11
Star: 61
Fork: 5
Last update: Aug 1, 2020
Resource links
https://github.com/hvmi/hvmi

Hypervisor Memory Introspection

logo

HVI stands for Hypervisor Introspection. The term is used interchangeably with HVMI, which is a bit more specific, and stands for Hypervisor Memory Introspection.

Virtual Machine Introspection is defined as the technique of analyzing the state and behavior of a guest virtual machine from outside of it. In addition, Introspection can also leverage virtualization extensions to provide security.

The main purpose of this project is to provide unmatched security from outside the virtual machine, by leveraging the hardware isolation provided by Intel VT-x. The main categories of attacks HVI prevents are:

  • Binary exploits inside protected processes
  • Code and data injection techniques inside protected processes
  • Function hooks inside protected processes, on designated system DLLs
  • Rootkits (various techniques are blocked, such as inline hooks inside the kernel or other drivers, SSDT hooks, Driver-object hooks, system register modifications, etc.)
  • Kernel exploits
  • Privilege escalation
  • Credentials theft
  • Deep process introspection (prevents process creation if the parent process has been compromised)
  • Fileless malware (powershell command line scanning)

For more details check the HVMI specification.

Checkout

Get Introcore and all the dependencies by running:

git clone --recurse-submodules https://github.com/hvmi/hvmi.git

This will clone the HVMI repository and the bddisasm submodule.

Build

Introcore can be built both as a Windows DLL, and as a Linux library. Only the 64-bit configuration is supported.

Linux build

To build the project on Linux you need:

  • gcc >= 7.0
  • cmake >= 3.13
  • make

To integrate the library (libintrocore.so) you can use the pkg-config file (introcore.pc) that is generated by cmake.

Building Introcore is done by running cmake from the root of the repository:

# generate configuration
cmake -H. -G<generator> -B<build directory> -DCMAKE_BUILD_TYPE=<build type> -DCMAKE_INSTALL_PREFIX=<install prefix directory> -DCMAKE_LIBRARY_OUTPUT_DIRECTORY=<binary output directory> -DCMAKE_TOOLCHAIN_FILE=<toolchain>

The default value of CMAKE_INSTALL_PREFIX is /usr/local/. The default value of CMAKE_LIBRARY_OUTPUT_DIRECTORY is $project_dir/bin.

Build for Debug

cmake -B_build -DCMAKE_BUILD_TYPE=Debug
cd _build
make

Build for Release

cmake -B_build -DCMAKE_BUILD_TYPE=Release
cd _build
make

Install

# install the introcore library (debug)
cd _build
make install

This builds the bddisasm dependency and then libintrocore, which can be found in bin/x64/Debug or bin/x64/Release.

Generate an SDK

Generating an SDK that will contain libintrocore Debug and Release versions, and the public header files is done with:

mkdir _build
cd _build

cmake .. -B. -DCMAKE_BUILD_TYPE=Debug
make

cmake .. -B. -DCMAKE_BUILD_TYPE=Release
make

make package

This creates a ZIP file in the root of the repo that contains the latest libintrocore you’ve built, together with the header files from the include/public directory.

Windows build

To build the project on Windows you need:

When you first open the hvmi.sln file, Visual Studio should prompt you to install any missing components. Building the introcore can be done directly from Visual Studio or with the build.cmd script:

# build for Debug
build.cmd Debug

# build for Release
build.cmd Release

This will create introcore.dll and introcore.pdb in bin/x64/Debug or bin/x64/Release.

CMake is not supported for Windows builds.

Documentation

Introcore comes with Doxygen code documentation, and a specification built with Sphinx.

Doxygen

For generating the Doxygen documentation on Linux, use:

cmake -B_build
cd _build
make doxy

For Windows, use:

make_doxy.cmd

Or invoke Doxygen directly:

doxygen Doxygen/Doxyfile

This assumes that you have Doxygen installed and in you're path.

The Doxygen documentation will then be found in docs/_static/Doxygen/html.

Specification

To build the specification you need:

To generate the HTML version of the documentation:

cd docs
make html

This will also build the Doxygen documentation. The result will be in docs/_build/html.

Repository structure

  • introcore - contains the introcore source and header files
  • include - contains the public header files and headers shared between multiple projects
  • cami - contains the Guest support mechanism files
  • exceptions - contains the Exception files
  • agents - contains the Windows special agents project files
  • docs - contains the documentation
  • build_disasm - contains the files used to build the bddisasm dependency
  • deserialize - contains the deserializer scripts
  • Doxygen - contains the Doxygen settings
  • windows_build - contains the scripts used during the Windows build
  • daemon - contains an integration example for Xen and KVM

Exceptions

Introcore has an exception mechanism, which is used to whitelist legitimate accesses to protected structures.

Sample exception files that should work for out-of-box installations of Windows 7 (SP1 and SP2) and Windows 10 1809 (RS5) are included in the exceptions directory.

To generate the exceptions binary, use:

cmake -B_build
cd _build
make exceptions

For more information see exceptions.

Guest support mechanism

Introcore needs to know certain information in order to properly hook and protect an operating system (for example, the layout of certain kernel structures, patterns for finding functions inside the guest memory, etc). These information are included in a CAMI data base file. Sample files that offer support for Windows 7 (SP1 and SP2), Windows 10 1809 (RS5), Ubuntu 18.04, and CentOS 8 can be found in the cami directory.

To generating the cami binary, use:

cmake -B_build
cd _build
make cami

For more information see CAMI.

Contacting us

There are several ways to contact us:

  • The public HVMI Slack - join here the public Slack to discuss ideas publicly, or privately, with both Bitdefender developers and other members of the community
  • Bitdefender HVMI OSS team contact - [email protected] - contact Bitdefender folks directly regarding any issue that is not well suited for public Slack discussions
  • HVMI security - [email protected] - report security issues and vulnerabilities; we kindly ask that you follow the guideline described here

v1.132.0(Oct 12, 2020)

Initial HVMI release.

Contents

    gamozolabs A hypervisor for fuzzing built with WHVP and Bochs
    asamy A fast, hackable and simple x64 VT-x hypervisor for Windows and Linux. Builtin userspace sandbox and introspection engine.
    dotnet Docker images for .NET Core and the .NET Core Tools.
    saurvs hypervisor-rs — Hardware-accelerated virtualization on OS X
    iPower Hook system calls on Windows by using Kaspersky's hypervisor
    Akaion A Windows virtual memory editing library with support for pattern scanning.
    DynamoRIO Memory Debugger for Windows, Linux, Mac, and Android
    blankwall OS X malloc introspection tool
    nodkz 🔥 Webpack plugin which tracks changes in your schema and generates its introspection in `json` and `txt` formats
    cjdelisle return-to-abort() - Using code introspection to prevent stack-smashing
    genuinetools Container introspection tool. Find out what container runtime is being used as well as features available.
    Brbb :rocket: GraphQL + Vue.js + D3.js schema viewer, powered by introspection.
    phpactor PHP completion, refactoring and introspection tool.
    thalium Virtual Machine Introspection, Tracing & Debugging
    gamozolabs A fuzzing introspection tool
    dfrg Font introspection, complex text shaping and glyph rendering.
    OrchardCMS Orchard Core is an open-source modular and multi-tenant application framework built with ASP.NET Core, and a content management system (CMS) built on top of that application framework.
    hyperhq HyperContainer Daemon
    atmanos Build Go programs that run directly on the Xen hypervisor
    changeofpace VivienneVMM is a stealthy debugging framework implemented via an Intel VT-x hypervisor.
    wbenny hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system
    Share this repo

    Related Repos


    Detect Memory Leaks
    61
    Hypervisor Memory Introspection Core Library
    hvmi HVI stands for Hypervisor Introspection. The term is used interchangeably with HVMI, which is a bit more specific, and stands for Hypervisor Memory Introspection.
     
    Detect Memory Leaks
    359
    Provides assert function that check memory leak in Swift.
    tarunon XCTAssertNoLeak Provides memory leak test cases for Swift. Found memory leak objects from traverse object tree using Mirror. Support version Swift Support Note 5.0 ○
     
    Detect Memory Leaks
    3.4k
    iOS tool that helps with profiling iOS Memory usage.
    facebookarchive FBMemoryProfiler An iOS library providing developer tools for browsing objects in memory over time, using FBAllocationTracker and FBRetainCycleDetector. About This library shows how FBAllocationTracker an
     
    Detect Memory Leaks
    2.9k
    Find retain cycles / memory leaks sooner.
    krzysztofzablocki LifetimeTracker Bar style Circular style LifetimeTracker can surface retain cycle / memory issues right as you develop your application, and it will surface them to you
     
    Detect Memory Leaks
    790
    Catch leaking view controllers without opening Instruments.
    fastred DeallocationChecker Learn about leaking view controllers without opening Instruments. Usage First, enable the library by calling (for example from your application delegate): #if DEBUG DeallocationChecker.sha
     
    Detect Memory Leaks
    368
    Series of tools to help you find and debug objects that are leaking / over-released in you...
    mindsnacks MSLeakHunter Series of tools to help you find and debug objects that are leaking in your iOS apps. There are very common cases where objects may be leaking (not being deallocated when you expect them to) and instrument
     
    Detect Memory Leaks
    1.8k
    Find memory issues & leaks in your iOS app without instruments
    tapwork HeapInspector Find memory issues &amp; leaks in your iOS app HeapInspector is a debug tool that monitors the memory heap with backtrace recording in your iOS app. You can discover memory leaks, no longer used ob
     
    Detect Memory Leaks
    511
    Detect memory leaks for your iOS project automatically.
    music4kid PLeakSniffer We are building controllers most of the time, memory leaks happen within controllers. Retain cycle stops controller from being released, UIView objects within controllers somehow get held by other objects, PLeakSniff