Abstract

This presentation will present a mechanism to analyse VMWare's inner operating system from outside and detect Rootkit in it. This method, which does not depend on any interface or backdoor provided by VMWare, can stably hidden detect and clear Rootkit outside the operating system . What will also be introduced here includes the method to read and write the physical memory of Vmware virtual machine at run time and how to achieve the complete Rootkit detection function using this method such as detect and dump of the hidden kernel module, detect and terminate hidden process,detect and clear inline hook and object hook. A Rootkit detecting tool, WMXARK, based on the Vmware virtual machine's memory access library will be published for the first time. WMXARK will implement the complete Anti-Rootkit function towards the inner operation system of VMWare virtual machine.