Patent ID: 9003402
Filing Date: 2015-04-07
Classification: G06F

Abstract:
1. A computing system implemented process for injecting function calls into a virtual machine comprising: implementing a Guest Virtual Machine (GVM) on a host computing system, the GVM including associated CPU registers and at least one memory stack associated with at least one thread implemented, at least in part, by the GVM; implementing a hypervisor on the host computing system under the control of at least one processor associated with the host computing system; implementing a Security Virtual Machine (SVM) on the host computing system; implementing a security API on the host computing system under the control of at least one processor associated with the host computing system, the security API providing a hypercall interface between the hypervisor, the SVM, and the GVM; defining a SVM invocation point; suspending a state of the GVM at the SVM invocation point; saving the state of the GVM at the SVM invocation point; while the state of the GVM is suspended, using the SVM and the security API to modify the CPU registers and/or the contents of at least one memory stack associated with at least one thread implemented, at least in part, by the GVM to trigger a desired function call invocation when the GVM is resumed, wherein a return address of the desired function call is initially set to a memory location in an active code segment that has no actual code and a hypervisor-enabled execution breakpoint is placed in the memory location; resuming the GVM; executing the desired function call in the same manner as the desired function call would be executed if the desired function call had been invoked by the GVM; suspending the state of the GVM when the function call return address occurs; restoring the saved GVM state at the SVM invocation point; and resuming execution of the GVM at the SVM invocation point.