KFLAT - Selective Kernel Memory Serialization for Security and...
summary
KFLAT is a loadable kernel module that selectively serializes kernel variables into a flattened image by following typed pointers, replacing them with offsets, and restoring them quickly in a userspace C process. It hooks via kprobe hook at function entry, validates pointers by translating virtual to physical and checking RAM pages, freezes tasks when needed, and converts function pointers to names for mapping on restore. A 600k-interval tree becomes about 32 MB for 600k intervals and flattens in milliseconds; recipe generation uses FTDB JSON to cover ~15k types and ~23k pointer members while focusing on used fields (~10% used). KFLAT backs Auto Off-Target (AoT) state initialization and enables userspace fuzzing of kernel entry points.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:32Motivation
- 1:34Introduction
- 3:36How KFLAT works
- 7:15KFLAT internals
- 13:01Other approaches?
- 16:24On-Target vs Off-Target
- 17:37Overview of the process
- 21:50KFLAT recipes for Linux
- 24:08Linux recipe generation
related talks
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
38mTaking Kernel Hardening to the Next Level
43mpkernfs: Persisting guest memory and kernel/device state safely...
59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
50mBreaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
41mUsing Microarchitectural Design to Break KASLR and More
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL