Kernel state data collection in a protected kernel environment

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• allocating a first portion of a memory for a first kernel and reserving a second portion of the memory for a second kernel;
• storing the second kernel in the second portion of the memory;
• providing, to a hypervisor, at least one memory address corresponding to the second portion of the memory;
• disabling, by the hypervisor, write and execute access privileges corresponding to the second portion of the memory;
• attempting to execute the second kernel that is stored in the second portion of the memory;
• detecting, by the hypervisor, the attempted execution of the second kernel;
• enabling, by the hypervisor, execute access privileges corresponding to the second portion of the memory;
• and
• executing the second kernel to collect data corresponding to the first kernel.

A system comprising:

• a non-transitory machine readable medium that includes a first portion of a memory allocated for a first kernel and a second portion of the memory allocated for a second kernel;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
• providing, to a hypervisor, at least one memory address corresponding to the second portion of the memory;
• disabling, by the hypervisor, write and execute access privileges corresponding to the second portion of the memory;
• attempting to execute the second kernel that is stored in the second portion of the memory;
• detecting, by the hypervisor, the attempted execution of the second kernel;
• enabling, by the hypervisor, execute access privileges corresponding to the second portion of the memory;
• and
• executing the second kernel to collect data corresponding to the first kernel.