Automatically bridging the semantic gap in machine introspection

A method, comprising:

• determining, by a computing device, that a program executed by a first virtual machine of the computing device will be used to access data in a memory of a second virtual machine of the computing device;
• determining, by the computing device, a system call execution context of the program;
• identifying, by the computing device, a portion of kernel data in the memory of the second virtual machine based at least in part on the system call execution context;
• and
• dynamically instrumenting, by the computing device, the program to perform a data operation upon the portion of kernel data in the memory of the second virtual machine.

A non-transitory computer-readable medium embodying code executable by a computing device, comprising:

• code that determines that a program executed by a first virtual machine will be used to access data in a memory of a second virtual machine;
• code that determines a system call execution context of the program;
• code that identifies a portion of kernel data in the memory of the second virtual machine based at least in part on the system call execution context;
• and
• code that dynamically instruments the program to perform a data operation upon the portion of kernel data in the memory of the second virtual machine instead of a portion of kernel data in a memory of the first virtual machine.