Methods and systems to track kernel calls using a disassembler

Patent metadata

Field	Value
Publication number	US-10866808-B2
Application number	US-201916402949-A
Country	US
Kind code	B2
Filing date	May 3, 2019
Priority date	May 3, 2019
Publication date	Dec 15, 2020
Grant date	Dec 15, 2020

Abstract

This disclosure and the exemplary embodiments described herein, provide methods and systems to trace/verify kernel calls of interest operatively associated with an operating system platform of a device. According to an exemplary embodiment, the mount/unmount kernel call associated with a Linux operating system platform is traced/verified to initiate an incremental backup of a memory of a device during the execution of the mount/unmount kernel call.

First claim

What is claimed is:

1. A processor implemented method for tracing a kernel call of interest associated with an operating system platform of a device, the method comprising:
determining a memory location of a kernel system call table within a kernel memory space of the device, the kernel system call table including a plurality of kernel call entries, each kernel call entry including a pointer to a memory address of an opcode and associated operand within the kernel memory space;
determining a memory location of a kernel call of interest entry within the memory location of the kernel system call table, and extracting a pointer associated with the kernel call of interest entry within the memory location of the kernel system call table;
performing a disassembler search process to validate the kernel call of interest entry points to an opcode and associated operand which transfers control of execution of the kernel call of interest to a memory address identical to a target memory address associated with the kernel call of interest included in a kernel system call map table, the kernel system call map including a plurality of kernel calls mapped to a plurality of respective target memory addresses within the kernel memory space, and the disassembler search process setting a kernel call entry condition as valid if the kernel call of interest entry points to an opcode and associated operand which transfers control of execution of the kernel call of interest to the target memory address associated with the kernel call of interest included in the kernel system call map table.

2. The method for tracing a kernel call of interest according to claim 1 , wherein the operating system platform is a Linux operating system platform.

3. The method for tracing a kernel call of interest according to claim herein the device is one of a PC, workstation, server, mobile computing device, cell phone, web appliance, network router, switch, bridge, tablet PC, set-top box (STB), and personal digital assistant (PDA).

4. The method for tracing a kernel call of interest according to claim 1 , wherein the disassembler search process is iteratively performed on a plurality of sequential opcodes and operands associated with the kernel call of interest until the kernel call entry condition is set to valid or a next sequential opcode is determined to be associated with a Return instruction.

5. The method fog tracing a kernel call of interest according to claim 1 , further comprising:
a kernel module operatively associated with the operating system platform configured to perform the method, and the kernel module configured to direct the execution of the kernel call of interest using a modified kernel system call table operatively associated with the operating system platform of the device, the modified kernel system call table including a pointer which redirects the kernel call of interest, prior to execution by the operating system platform, to the kernel module, and the kernel module subsequently directing the execution of the kernel call of interest by the operating system platform by calling a memory address associated with an original kernel system call table entry associated with the kernel call of interest,
wherein the modified kernel system call table is generated by a kernel module function modifying the original kernel system call table if a kernel call verification process sets the kernel call entry condition as valid, the kernel call verification process including the disassembler search process.

6. The method for tracing a kernel call of interest according to claim 1 , wherein the kernel call of interest is associated with a file system logical volume attachment command.

7. The method for tracing a kernel call of interest according to claim 1 , wherein the kernel call of interest is one of a mount kernel call and unmount kernel call.

8. The method for tracing a kernel call of interest according to claim 7 , wherein the method is performed by a kernel module operatively associated with a backup agent configured to perform a backup of a memory operatively associated with the device during an execution of one of a mount kernel call and an unmount kernel call associated with the operating system platform of the device.

9. The method for tracing a kernel call of interest according to claim 8 , further comprising:
the kernel module operatively associated with the operating system platform and configured to direct the execution of the kernel call of interest using a modified kernel system call table operatively associated with the operating system platform of the device, the modified kernel system call table including a pointer which redirects the kernel call of interest, prior to execution by the operating system platform, to the kernel module, and the kernel module subsequently directing the execution of the kernel call of interest by the operating system platform by calling a memory address associated with an original kernel system call table entry associated with the kernel call of interest,
wherein the modified kernel system call table is generated by a kernel module function modifying the original kernel system call table if a kernel call verification process sets the kernel call entry condition as valid, the kernel call verification process including the disassembler search process.

10. The method for tracing a kernel call of interest according to claim 8 , wherein the backup of a memory includes one of an incremental backup, a full backup and a differential backup.

11. A processor implemented method for creating a backup of a memory operatively associated with a device during an execution of a kernel call of interest associated with an operating system platform of the device, the kernel call of interest including one of a mount kernel call and an unmount kernel call, the device including a backup agent operatively associated with the operating system platform, and the backup agent operatively associated with a backup system to store backups of the memory operatively associated with the device during the execution of the kernel call of interest, the method comprising:
a modified kernel system call table including a pointer which redirects the kernel call of interest, prior to execution by the operating system platform, to the backup agent to perform the backup of the memory during execution of the kernel call of interest; and
a kernel module executing the kernel call of interest by the operating system platform by calling a memory address associated with an original kernel system call table entry associated with the kernel call of interest,
wherein the modified kernel system call table is generated by a kernel module function modifying the original kernel system call table if a kernel call verification process sets a kernel call entry condition as valid, the kernel call verification process including a disassembler search process configured to validate the original kernel system call table entry associated with the kernel call of interest points to an opcode and associated operand which transfers control of execution of the kernel call of interest to a memory address identical to a target memory address associated with the kernel call of interest included in a kernel system call map table, the kernel system call map including a plurality of kernel calls mapped to a plurality of respective target memory addresses within the kernel memory space, and the disassembler search process setting the kernel call entry condition as valid if the kernel call of interest entry points to an opcode and associated operand which transfers control of execution of the kernel call of interest to the target memory address associated with the kernel call of

Assignees

• Datto Inc

Inventors

• Mark Stuart

Classifications

• G06F9/45541

  Bare-metal, i.e. hypervisor runs directly on hardware · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• G06F11/1461 Primary

  Backup scheduling policy · CPC title

• G06F11/1451

  by selection of backup contents · CPC title