From mboxrd@z Thu Jan  1 00:00:00 1970
From: big strong <fangtuo90@gmail.com>
Subject: Re: how can I find hypercall page address?
Date: Tue, 11 Aug 2015 10:44:29 +0800
Message-ID: <CAFnE1f0aYVktuy8fNFVjjcDnngpWnjkY-E5+pc5mz5Z4kh-2vA@mail.gmail.com>
References: <CAFnE1f1oyRwqb9ZEXEgb+bQ+5+1f6n7HJdJqtd82zuRboqNpLw@mail.gmail.com>
	<55C32DB4.6020203@citrix.com>
	<CAFnE1f3+gsigvhvP-BrSODK9xKsaw9RaE69sFthw2K5tUWd-1g@mail.gmail.com>
	<CAFnE1f0cz+Vnmccyp7Y+0TD=VLH=uoHe47Dgnx7W1kGWskVUkA@mail.gmail.com>
	<55C4AD58.5060300@citrix.com>
	<CAFnE1f3VeOr6anoH1fSwEjp_oScco+ohQJjtvYXe12QrrQWLJA@mail.gmail.com>
	<1439219058.24583.4.camel@citrix.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3187048650057837920=="
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1439219058.24583.4.camel@citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Dario Faggioli <dario.faggioli@citrix.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>, xen-devel@lists.xen.org
List-Id: xen-devel@lists.xenproject.org

--===============3187048650057837920==
Content-Type: multipart/alternative; boundary=001a11349f9ec67410051d0014ea

--001a11349f9ec67410051d0014ea
Content-Type: text/plain; charset=UTF-8

My goal is to intercept hyprcalls to detect malicious calls. So I need
firstly find where the hypercalls are. My plan is to locate hypercall page
first, then walk through the hypercall page to get address of hyperccalls.
If there is any other solutions, please let me know. Thanks very much.

2015-08-10 23:04 GMT+08:00 Dario Faggioli <dario.faggioli@citrix.com>:

> On Sat, 2015-08-08 at 08:02 +0800, big strong wrote:
> > I think I've stated clearly what I want to do.
> >
> Well...
> >
> > |I want to locate the hypercall page address when creating a new domU,
> > so as to locate hypercalls.
> >
> Ok. What for?
>
> Dario
>
> --
> <<This happens because I choose it to happen!>> (Raistlin Majere)
> -----------------------------------------------------------------
> Dario Faggioli, Ph.D, http://about.me/dario.faggioli
> Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)
>

--001a11349f9ec67410051d0014ea
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">My goal is to intercept hyprcalls to detect malicious call=
s. So I need firstly find where the hypercalls are. My plan is to locate hy=
percall page first, then walk through the hypercall page to get address of =
hyperccalls. If there is any other solutions, please let me know. Thanks ve=
ry much.</div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">201=
5-08-10 23:04 GMT+08:00 Dario Faggioli <span dir=3D"ltr">&lt;<a href=3D"mai=
lto:dario.faggioli@citrix.com" target=3D"_blank">dario.faggioli@citrix.com<=
/a>&gt;</span>:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D"">On Sat, =
2015-08-08 at 08:02 +0800, big strong wrote:<br>
&gt; I think I&#39;ve stated clearly what I want to do.<br>
&gt;<br>
</span>Well...<br>
<span class=3D"">&gt;<br>
&gt; |I want to locate the hypercall page address when creating a new domU,=
<br>
&gt; so as to locate hypercalls.<br>
&gt;<br>
</span>Ok. What for?<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
Dario<br>
<br>
--<br>
&lt;&lt;This happens because I choose it to happen!&gt;&gt; (Raistlin Majer=
e)<br>
-----------------------------------------------------------------<br>
Dario Faggioli, Ph.D, <a href=3D"http://about.me/dario.faggioli" rel=3D"nor=
eferrer" target=3D"_blank">http://about.me/dario.faggioli</a><br>
Senior Software Engineer, Citrix Systems R&amp;D Ltd., Cambridge (UK)<br>
</font></span></blockquote></div><br></div>

--001a11349f9ec67410051d0014ea--


--===============3187048650057837920==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

--===============3187048650057837920==--