From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tim Deegan Subject: (no subject) Date: Thu, 15 Nov 2012 12:08:36 +0000 Message-ID: <20121115120836.GA75988@ocelot.phlegethon.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Cutter 409 Cc: Aravindh Puthiyaparambil , xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org Bcc: Tim Deegan Subject: Re: [Xen-devel] Guest memory access hooking Reply-To: In-Reply-To: Hi, At 10:56 -0500 on 13 Nov (1352804161), Cutter 409 wrote: > I'm trying to do some research with malware, and I'm trying to get > notifications on arbitrary guest page accesses (similar to what Ether > does.) I've noticed the mem-event API and it seems like it might be close > to what I need, but I can't find much documentation about how it works or > how to use it. Yes, the mem-event api, and in particular the HVMOP_set_mem_access hypercall, looks like what you want. As you say, there isn't much documentation for it, except the xen-access.c client and the mailing list archive. CC'ing Aravindh, who has worked on this code most recently and might be able to help with specific questions. > I know that that mem-event API works only with EPT, but is the code to > change permissions modifying the guest page tables, or does it work via > EPT? (Can the guest detect it?) It works by EPT. The guest can't detect it by looking at its pagetables or page fault patterns, though it might be able to detect it by looking at timings. > I'm also interested monitoring arbitrary page access via the shadow page > tables. I've been reading through the code, but if anyone has any insight > or some kind of push in the right direction, I'd really appreciate it. Your best bet is to modify _sh_propagate. Look at how it handles shadow_mode_log_dirty() -- any time a writeable mapping is shadowed, the shadow PTE is made read-only until the guest is actually doing a write, then mark_dirty can be called. You should be able to do the same thing for other kinds of access. Cheers, Tim.