Detecting attempts to change memory
AssigneeVMware, Inc.
InventorChristopher Li
Life of this patent
Estimating the term…
Abstract
A system and method for detecting changes of memory state. In accordance with one embodiment, memory locations to be observed are determined, and pages of these locations are marked as read-only. Then, guest instructions execute during a trial period. During the trial period, guest instructions attempting to write to the identified memory locations cause page faults which result in identifying the instructions. At the end of the trial period, the pages are returned to a writable status, and attempts to modify the memory locations by the guest code are detected based on the instruction identifier. The system and method can be used for efficient frame list topology monitoring, such as in a virtual USB controller of a virtual machine.
Claims18
A method for detecting attempts to change memory by a group of instructions comprising:
- during a trial period:
- temporarily marking as read-only a memory page that includes a memory location to be observed;
- catching an exception when an instruction attempts to write to the marked memory page;
- in response to the instruction attempting to write to the memory location to be observed, storing an identifier of the instruction in a watch list, wherein the identifier uniquely identifies the instruction based on a memory address from which the instruction is fetched;
- subsequent to the trial period:
- marking the memory page writable;
- and
- detecting attempts, based on the watch list, to execute the identified instruction.
A method for monitoring a data structure in memory for changes, the method comprising:
- identifying a plurality of memory locations that are occupied by the data structure;
- learning which instructions of a first software entity are responsible for updating the data structure by marking as read-only memory pages that include the plurality of memory locations, thereby triggering a exception when an attempt is made to write to the data structure, and recording in a watch list identifiers of each instruction that triggers the exception when writing to the memory locations occupied by the data structure, wherein a respective identifier uniquely identifies the corresponding instruction based on a memory address from which the instruction is fetched;
- removing the read-only marking from the memory pages after a selected number of the instructions of the first software entity are identified through the learning, the removing includes marking the memory pages writable;
- unmarking as read-only the memory pages previously marked;
- and
- notifying a second software entity that instructions that write to the memory locations occupied by the data structure were executed thereby indicating that the data structure might have been modified by the first software entity.
A non-transitory machine readable medium embodying computer instructions causing a processor to perform a method for monitoring a data structure in memory for changes, the method comprising:
- identifying a plurality of memory locations that are occupied by the data structure;
- learning which instructions of a first software entity are responsible for updating the data structure by marking as read-only memory pages that include the plurality of memory locations, thereby triggering a exception when an attempt is made to write to the data structure, and recording in a watch list identifiers of each instruction that triggers the exception when writing to the memory locations occupied by the data structure, wherein a respective identifier uniquely identifies the corresponding instruction based on a memory address from which the instruction is fetched;
- unmarking as read-only the memory pages previously marked after a selected number of the instructions of the first software entity are identified through the learning, the unmarking includes marking the memory pages writable;
- and
- subsequent to the unmarking, detecting execution of any of the instructions identified in the watch list, and notifying a second software entity that instructions that write to the memory locations occupied by the data structure were executed thereby indicating that the data structure might have been modified by the first software entity.
A method for detecting attempts to change memory by a group of instructions comprising:
- identifying an instruction that writes to memory locations to be observed, the identifying including temporarily marking as read-only a memory page that includes the memory locations to be observed, thereby causing an exception when an attempt is made to write to the marked memory page, and in response to the exception caused by the attempt to write to the marked memory page, determining if the memory locations to be observed share memory pages with other memory locations and upon determining that the instruction that triggered the exception is not attempting to write to a location in the other memory locations, storing an identifier of the instruction that triggered the exception in a watch list, wherein the identifier uniquely identifies the instruction based on a memory address from which the instruction is fetched;
- and
- detecting attempts, using the stored identifier, to execute the identified instruction.
Dependencies are inferred from the claim text.