A Tool for Discovering Software Dependencies
Total Page：16
File Type：pdf, Size：1020Kb
WinResMon: A Tool for Discovering Software Dependencies, Configuration and Requirements in Microsoft Windows Rajiv Ramnath – National University of Singapore Sufatrio – Temasek Laboratories, National University of Singapore Roland H. C. Yap and Wu Yongzheng – National University of Singapore ABSTRACT This paper describes WinResMon, a system tool for determining resource usage and interactions among programs in Microsoft Windows environments. Think of WinResMon as a debugging tool to assist with software maintenance in a Microsoft Windows environment. It shows the current system state in terms of how resources are used and explains how the system arrived at that state. WinResMon can be used to determine how a program uses the registry and which files are needed by that program. WinResMon differs from other systems/tools in that it is integrated, designed to answer queries about resource usage and dependencies over time, and extensible, allowing the addition of new functions and tools. Introduction clear. The confusion is further compounded by many implicit software interdependencies, e.g., registry keys The tasks of software maintenance and configu- which are part of shared software configurations. As a ration require a precise understanding of system result, it is difficult to know whether to remove a file resources, the individual requirements of each piece of when uninstalling an application. File removal might software, and interdependencies between every soft- lead to problems with another piece software or might ware program on the system. We use the term software create security vulnerabilities. maintenance to describe the system administration task of ensuring that software on a system is config- When installing two or more programs that share ured and maintained correctly over time. Examples of files, one program may cease to function correctly software dependencies include: because the installation of the second blindly over- wrote shared libraries (DLL files). There is also the file sharing: including dynamic libraries and • question of when to perform a major software external data storage upgrade. System administrators may delay upgrading sharing of software configurations: usually in • for fear of breaking existing software; yet such a the form of registry keys in Microsoft Windows choice has its own risks. • interprocess communication and synchronization. This paper focuses on the problem of software Although software maintenance tasks might maintenance in Microsoft Windows NT-based operat- seem conceptually trivial, they can be time consuming ing systems (Microsoft Windows XP, Microsoft Win- and difficult, especially in large or complex environ- dows 2000, Microsoft Windows 2003).1 We present ments. System administrators often rely on documen- Wi n R e s M o n, a discovery and system debugging tool for tation and on-line information such as FAQs or determining a program’s resource usage as well as the forums, but such information is often incomplete. resource usage interactions between multiple programs. In various distributions of Linux, software dependency issues are partly addressed by the use of a Motivation and Applications package manager. The Red Hat Package Manager We believe that the key to solving the software (RPM) [1], for example, records the currently installed maintenance problem is to understand the life cycle of packages and the files required and provided by these the system and programs therein. We also wish to packages in a centralized database. RPM checks empower ordinary users, removing the requirement of dependencies before removing a package to ensure knowing every minutiae of Microsoft Windows. that files required by other installed packages are not Although WinResMon is not tailored specially for system removed. Similar checks are done to prevent installing security, it can also be utilized as a security auditing tool. a package which contains files that conflicts with We designed WinResMon to act as both an infra- other existing packages. structure or framework and a system utility. As a In Microsoft Windows, however, software instal- 1While an appropriate version of a tool similar to WinRes- lation can be complex, and the exact dependencies Mon could also be of use in UNIX, its value is much greater between different software programs might not be in a Microsoft Windows environment. 20th Large Installation System Administration Conference (LISA ’06) 175 WinResMon: A Tool for Discovering Software Dependencies ... Ramnath, Sufatrio, Yap, & Wu framework, it is extensible, and one can therefore add elevated privileges and configure the system to new functionality and build customized tools. As a limit the use of privileges. If it finds applications tool, it comes with pre-built modules to answer typical that require certain administrator privileges to questions about resource usage and dependencies. function correctly, the system administrator can When used as a debugger, WinResMon investi- set up a policy that restricts the administrator gates the current system state, i.e., which program privileges to the needed resources (files, registry uses which registry keys, and determines how the sys- keys, etc.). We remark that this approach can be tem has arrived at that state. WinResMon accom- contrasted with confinement systems such as plishes this by recording information about the evolu- systrace [2] in UNIX. WinResMon is an audit- tion of system software dependencies and resource ing tool, it does not confine system calls, but usage over time. To solve general problems in soft- provides useful input for system administrators ware maintenance, WinResMon monitors: files, the to create policies on resource access which can registry, and interprocess communication and synchro- then be used to limit privileges. nization. However, it is not feasible to continuously 3. Monitoring sensitive registry locations to and permanently record all changes to the system detect spyware. since the required space would be prohibitive. Win- Managing the Microsoft Windows registry is ResMon employs a reasonable compromise by main- difficult due to its complexity. Spyware often taining detailed usage records over the current time takes advantage of this complexity to bury period and a subset of information that can be main- itself in the registry, making it difficult for the tained over the lifetime of all software in the system. user to remove it completely. In [3], the authors have listed the most common entry points for We illustrate the software maintenance problem spyware to enter a Windows NT system. The with some simple examples. One attack vector for following are some of the configuration settings spyware is to register itself as a start-up program, WinResMon can monitor: thereby hiding itself from the end user. Also consider Autostarts: monitor which programs load a music player which may require some sound decod- on startup. ing libraries. This application only functions correctly Internet explorer hooks: track hooks which with certain versions of the libraries. Thus, replacing a define the default search page, toolbars and library can lead to software failure. Various pieces of browser helper objects (BHO), etc. software may also conflict, e.g., two mail transfer Winlogon: look for applications that hook agents (MTAs) usually do not co-exist. into system resources. Some common system administration questions Services: monitor services such as auto- and tasks which WinResMon can assist with include: matic startup services (e.g., task scheduler) 1. Can we safely remove a particular DLL file? or drivers which are installed as services. Some applications provide shared libraries DLL injection: monitor DLL injection (DLL files) for use with other applications. attacks (any application that uses user32.dll When the system administrator uninstalls an can be hijacked by having a DLL injected application, she can also choose to remove the into its process space). DLLs. Removing a DLL can cause other pro- File associations: monitor the registration of grams which still use it to malfunction. On the file extensions with applications. For exam- other hand, blindly retaining all DLLs will ple, .DOC is registered to Microsoft Word. cause the system to keep growing and may cre- ate security vulnerabilities. The system admini- System Design strator generally lacks adequate information to The WinResMon system infrastructure shown in determine whether another program uses a Figure 1 consists of the following components: logger, shared library. WinResMon can be used to archiver, query API, and user-log API. The logger record the utilization of each DLL so that the generates resource-access traces which are later used system administrator can determine which pro- by the analyzer. The archiver performs log com- grams use which DLLs. paction/summarization of old traces. Query and user- 2. Why does a program need administrator privi- log API provide the interface to the trace database. lege to run? Running programs with administrator privilege The Logger is discouraged because malware such as The logger consists of a system call (syscall) viruses/spyware or poorly written applications interceptor and a trace generator module. The syscall can damage the system. However, some pro- interceptor is an in-kernel driver which monitors system grams may need to run as the administrator calls made by each process and sends the monitored without an obvious reason. WinResMon can event information to the trace generator. The trace