Methods and apparatuses for monitoring activities of virtual machines
AssigneeRaytheon Cyber Products, LLC
InventorJohn R. Wagner
Life of this patent
Estimating the term…
Abstract
Embodiments of a method and apparatus for monitoring activity on a virtual machine are generally described herein. The activity may be monitored by a first hypervisor and the virtual machine may be controlled by a second hypervisor. In some embodiments, the method includes setting a breakpoint in a kernel function of the virtual machine. The method may further include generating a page fault, responsive to the virtual machine halting execution at the breakpoint, to cause the second hypervisor to page in contents of a memory location accessed by the kernel function. The method may further include inspecting the contents of the memory location to detect activity in the virtual machine.
Claims22
A method comprising:
- setting, by a first hypervisor, a breakpoint in a kernel function of a virtual machine that is controlled by a second hypervisor;
- generating, by the first hypervisor, a page fault responsive to the virtual machine halting execution at the breakpoint to cause the second hypervisor to page in contents of a memory location accessed by the kernel function;
- and
- inspecting, by the first hypervisor, the contents of the memory location to detect activity in the virtual machine;
- wherein generating the page fault comprises:
- retrieving, by the first hypervisor, a parameter of the kernel function indicating the memory location to be inspected;
- and
- providing, by the first hypervisor, the parameter to the second hypervisor during generation of the page fault.
A non-transitory computer-readable medium embodying a computer program, the computer program comprising instructions that, when executed by at least one processor, cause the at least one processor to:
- use a first hypervisor to set a breakpoint in a kernel function of a virtual machine that is controlled by a second hypervisor;
- use the first hypervisor to generate a page fault responsive to the virtual machine halting execution at the breakpoint to cause the second hypervisor to page in contents of a memory location accessed by the kernel function;
- and
- use the first hypervisor to inspect the contents of the memory location to detect activity in the virtual machine;
- wherein the instructions to cause the at least one processor to use the first hypervisor to generate the page fault comprise instructions that cause the at least one processor to use the first hypervisor to:
- retrieve a parameter of the kernel function indicating the memory location to be inspected;
- and
- provide the parameter to the second hypervisor during generation of the page fault.
An apparatus comprising:
- a first hypervisor configured to:
- set a breakpoint in a kernel function of a virtual machine that is controlled by a second hypervisor;
- retrieve a parameter of the kernel function indicating a memory location to be inspected by the first hypervisor;
- generate a page fault responsive to the virtual machine halting execution at the breakpoint to cause the second hypervisor to page in contents of the memory location;
- and
- provide the parameter to the second hypervisor during generation of the page fault;
- a memory configured to page-in, for inspection by the first hypervisor, the contents of the memory location that were paged-out by the second hypervisor;
- and
- an address translation table configured to map virtual machine addresses to physical memory addresses.
A method comprising:
- installing a first bare-metal hypervisor;
- detecting, by the first bare-metal hypervisor, that a second hypervisor has initialized a virtual machine by examining a virtual memory table corresponding to the second hypervisor;
- determining, by the first bare-metal hypervisor, addresses for locations of interest on the virtual machine;
- and
- generating a page fault condition to cause the second hypervisor to provide memory contents for memory at the locations of interest, the page fault condition indicating that an entry is missing in the virtual memory table;
- wherein generating the page fault condition comprises:
- retrieving, by the first hypervisor, a parameter of a kernel function indicating a memory location among the locations of interest;
- and
- providing, by the first hypervisor, the parameter to the second hypervisor during generation of the page fault.
Dependencies are inferred from the claim text.