XTRec: Secure Real-Time Execution Trace Recording on Commodity Platforms

Abstract

We propose XTRec, a primitive that can record the instruction-level execution trace of a commodity computing system. Our primitive is resilient to compromise to provide integrity of the recorded execution trace. We implement XTRec on the AMD platform running the Windows OS. The only software component that is trusted in the system during runtime is XTRec itself, which contains only 2,195 lines of code permitting manual audits to ensure security and safety. We use XTRec to show whether a particular code has been executed on a system, or conversely to prove that some malware has not executed on the system. This is a highly desirable property to ensure information assurance, especially in critical e-government infrastructure. Our experimental results show that the imposed overhead is 2x-4x for real-world applications. This overhead is primarily due to CPU Branch Trace Messages(BTM), a ubiquitous debugging feature used to record control-flow instructions. Hardware improvements to BTM would therefore enable XTRec to run with minimal overhead.

ProTracer: Towards Practical Provenance Tracing by Alternating Between Logging and Tainting

“…In [43], researchers proposed a primitive that provides the integrity of execution trace. It works on instruction-level execution traces.…”

Low Overhead Hardware-Assisted Virtual Machine Analysis and Profiling

“…By following these change-of-flow instructions, it is quite easy to generate a complete program flow with the help of additional offline binary disassembly at the decoding phase. Dedicated hardware blocks in the Intel architecture, such as Last Branch Record, Branch Trace Store [15], and more recently Intel Processor Trace (PT) follow this approach. A detailed study of hardwareassisted tracing and profiling with Intel PT has been recently presented in [12].…”

Design, Implementation and Verification of an eXtensible and Modular Hypervisor Framework

“…TrustVisor [7] and Lockdown [2] are fully functional, and their code sizes are precise. The development of HyperDbg [8], XTRec [6] and SecVisor [10] is sufficiently advanced to enable estimation of their final sizes via manual inspection of their existing sources and differentiation between the hypervisor core and hypapp-specific logic. Figure 6 shows that the XMHF core forms 48% of a hypapp's TCB, on average.…”

“…These systems are designed to provide interesting security and functional properties including secrecy of security sensitive application code and data [7], trusted user and application interfaces [2], [4], [13], application integrity and privacy [3], [5], [10], [11], [17], debugging support [8], malware analysis, detection and runtime monitoring [6], [9], [14]- [16] and trustworthy resource accounting [1]. A majority of these hypervisor-based solutions are designed and written from scratch with the primary goal of achieving a low Trusted Computing Base (TCB) while providing a specific security property and functionality in the context of an operating system or another (more traditional) hypervisor [2]- [10].…”