bdpayne/libvmi — pull request #114 by tklengyel (2013-10-17 12:04:11+00:00)
Title: Add function to conveniently single-step over a memory event.

The current memory event system requires clearing the event after the page has been hit in order to let the guest progress with its execution. This also means that only the first event is ever caught on the page, and catching subsequent events on the page requires re-registering the event. In order to guarantee no events are missed on the page, after the event has been cleared we need to singlestep a single instruction and re-register the event. While this could be done by the user, implementing it inside the library is a lot more convenient.

This PR introduces the vmi_step_mem_event function which registers the given memory-event after singlestepping an instruction ahead.

The step-memevent-example shows how to catch all events on a page. It's output is something similar to:

libvmi# ./examples/step-memevent-example windows7-sp1
LibVMI Suggestion: set win_kdvb=0xfffff8000283c0a0 in libvmi.conf for faster startup.
LibVMI init succeeded!
Current value of RIP is 0xfffff88003d039c2
Preparing memory event to catch next RIP 0xfffff88003d039c1, PA 0x3b5649c1, page 0x3b564 for PID 4
PID 384 with CR3=19169000 executing on vcpu 0.
PID 4 with CR3=187000 executing on vcpu 0.
-- Enabling mem-event
Memevent: {
PID 4. RIP 0xfffff88003d039c0:
PAGE 3b5649c1 ACCESS: --x for GFN 3b564 (offset 0009c0) gla fffff88003d039c0 (vcpu 0)
Event on same page, but not the same RIP
}
Memevent: {
PID 4. RIP 0xfffff88003d039c1:
PAGE 3b5649c1 ACCESS: --x for GFN 3b564 (offset 0009c1) gla fffff88003d039c1 (vcpu 0)
Cought the original RIP executing again!
}
Finished with test.