Patent Document ID: 9575793
Application ID: 14469390
Patent Status: 1

Claim One:
1. A computer-implemented method for identifying a kernel data structure, comprising: under the control of one or more computer systems configured with executable instructions, creating, based at least in part on a virtual machine image, a pointer reachability graph, the pointer reachability graph including a set of nodes and a set of edges, each node of the set of nodes corresponding to a data structure within the virtual machine image, each edge of the set of the edges corresponding to a pointer, the pointer representing an association between a pair of data structures within the virtual machine image, the set of nodes including a set of terminal nodes, each terminal node of the set of terminal nodes corresponding to a candidate kernel data structure; using the virtual machine image to instantiate a virtual machine, the virtual machine configured based at least in part on the pointer reachability graph; updating the pointer reachability graph by at least: taking one or more memory snapshots of the virtual machine in a state of execution; traversing the pointer reachability graph, starting from a first node in the pointer reachability graph and traversing a set of target nodes in the pointer reachability graph that are selected based at least in part on one or more connections to the first node using the set of edges; in a selected snapshot of the one or more memory snapshots, associating the first node with a first memory location in the selected snapshot, and identifying a second memory location in the selected snapshot based at least in part on the first memory location and the one or more connections to the first node; generating a confidence score, the confidence score based at least in part on whether the second memory location satisfies a validation criteria; and removing, from the pointer reachability graph, at least a subset of the nodes from the set of target nodes based at least in part on whether the confidence score is less than a threshold score; and providing information based at least in part on the updated pointer reachability graph, the information indicating one or more kernel data structures, the one or more kernel data structures based at least in part on the one or more candidate kernel data structures.