关键词: 函数调用关系, 操作系统内核, 硬件虚拟化

Abstract: To improve the compatibility of operating system kernel function call relations generation，a generation method based on hardware virtualization is proposed． This method replaces the kernel instructions in specific position with special instructions． These special instructions trigger virtualization interrupt trapping when the function is calling or called． So the virtual machine monitor can dynamically generate the operating system's kernel calling relations in the interrupt trapping． Experimental results show that this method can generate either open-source or closed-source，32 bit or 64 bit operating system's kernel function calling relations without relying on kernel source code or compilers． The accuracy of the generation is 100% and recall is 85%． This method can be used in the operating system kernel security analysis and whitelist generation．

Key words: function calling relation, operating system kernel, hardware virtualization