search

KVM-VMI / nitro

GNU General Public License v3.0
46 stars 11 forks source link

process_event() will not necessarly return the right syscall #74

Open aghamir opened 5 years ago

aghamir commented 5 years ago

Hi @Wenzel , Pushing syscall and poping it will not return the right one in all situations. Consider the situation where context switch occurs in the middle of handling one syscall. I think the previous version of process_event which calculates the name every time was better than this version.

Wenzel commented 5 years ago

That's true, i wanted to fix this for a while but I had more pressing matters to deal with.

At the beginning, I wanted to maintain a table of [CR3] -> [syscall_stack] to solve this I think, but you have syscalls that return from kernel mode with iret that we cannot catch. so some stack would only get bigger with time ...

At this point I started to work on the Bitdefender patches which will provide the next official VMI interface on KVM, should be easier to implement something on top of it. Please look at the kvmi branches :+1: