Patent ID: 8887139

Claim:
A virtual system, comprising: a physical hardware platform; a virtualization layer that virtualizes the physical hardware platform to create virtual hardware; a virtual machine monitor running on the physical hardware platform; a user domain operating on the virtual hardware; and a root domain operating on the virtual hardware and managing the user domain, wherein the virtual machine monitor analyzes operations performed by the user domain in real time and stores resulting analysis information in the root domain, wherein the virtual machine monitor comprises an execution tracer that traces information regarding a current instruction of a virtual central processing unit of the user domain, and wherein the execution tracer comprises: an instruction pointer (IP) tracker that reads an instruction address stored in an instruction pointer register and reads information regarding the current instruction from a memory region indicated by the instruction address; a decoder that disassembles the information read by the IP tracker, and extracts from the information a data address of a memory reference; an analyzer that converts the instruction address to a first physical address and converts the data address to a second physical address based on a page table; and a logger that stores the instruction address, the first physical address, the data address, the second physical address, and the disassembled information.