1

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.

Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could change its kernel/userspace data structures, trace it, modify it and so on. Without the need of its cooperativity.

My favorite virtualization software is qemu, but anything is okay if I can do it.

However, I would need some software support for the task. I need something, what can interact with the virtual machine, and most ideally, some support to track its memory content, find the processes and trace, what are they doing.

Does anything exist for the task?

  • AFAIK not possible without a somewhat modified hypervisor or an agent inside the VM. This has been done for KVM in the past (~2013) and is sold as VMRay these days. You can find the thesis papers and plenty of information by looking for CXPInspector (short one, full dissertation). I attended their VB2013 presentation. – 0xC0000022L Dec 20 '19 at 13:41
  • @0xC0000022L I think hypervisors could (should?) have some debugging support. For example, qemu has something like this. The next step would be some library or anything what can dig into the windows memory structures. – peterh - Reinstate Monica Dec 20 '19 at 14:16
  • Yep, I am aware Qemu has some. So does DOSBox. But your question doesn't really make clear how invasive your introspection capabilities are allowed to be. It sounds as if you want non-invasive (quote: Without the need of its cooperativity.). Debug functionality can offer this, but will be slow. The charm with the CXPInspector approach is that it also allows to trace function calls and stuff at a coarse level but without the (performance) penalty that comes with typical debugging features. The penalty is a lot smaller, because hardware support is used ... – 0xC0000022L Dec 20 '19 at 14:29
1

This is called Virtual Machine Introspection (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead of relying on the built-in OS support (such as used by WinDbg kernel debugger).

You can check for an example of how it could be done using IDA over VMWare's GDB protocol (disclaimer: post written by me):

http://www.hexblog.com/?p=94

I'm not aware of any active projects supporting it out-of-the-box but you can probably start with something like Volatility or MemProcFS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.