IP Library Granted Patent US 8,448,165
Granted Patent B1
US 8,448,165 · App. 12/559,990 · Granted May 21, 2013

System and method for logging operations of virtual machines

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,448,165
App. No.
12/559,990
Granted
May 21, 2013
Kind
B1
Abstract

A system and method for logging operations of guest virtual machines are provided. An execution event is triggered, in response to a request to load a software module in a virtual machine. A processor sends an indication to a hypervisor that the software module is loaded in the virtual machine, in response to the triggering of the execution event. A security appliance accesses, using the hypervisor, a first memory location in the virtual machine, in response to the indication. A value is stored in the first memory location. The value identifies the software module. The security appliance returns the value to the hypervisor.

Claims (89)

1. A method, comprising:

redirecting a reference from a first address to a second address, wherein

the reference initially refers to the first address,

the first address is an address of a function to be executed by a virtual machine, and

the second address is an address of a second memory location in a memory page within the virtual machine;

installing an execution event at the second memory location;

in response to a request to load a software module in the virtual machine, triggering the execution event, wherein

the execution event, when triggered, is configured to cause an indication to be sent to a hypervisor;

in response to the triggering of the execution event, sending the indication to the hypervisor that the software module is loaded in the virtual machine;

in response to the sending, accessing a first memory location in the virtual machine, wherein

the accessing is performed using the hypervisor,

a value is stored in the first memory location, and

the value identifies the software module; and

returning the value to the hypervisor.

2. The method of claim 1 , wherein

the function is a debug service function,

the indication is a message, and

the message indicates that the software module is loaded in the virtual machine.

3. The method of claim 2 , further comprising:

saving an original association between the reference and the first address.

4. The method of claim 2 , wherein

the request to load the software module in the virtual machine results in the second memory location being accessed.

5. The method of claim 4 , further comprising:

in response to triggering the execution event, retrieving the original association; and

executing the debug service function at the first address.

6. The method of claim 2 , wherein

the memory page is a non-pageable memory page, and

the memory page is located in a kernel memory of the virtual machine.

7. The method of claim 2 , wherein the message is sent by a processor executing the debug service function.

8. A computer system comprising:

at least one processor;

a computer-readable storage medium coupled to the at least one processor; and

computer code, encoded in the computer-readable storage medium, configured to cause the at least one processor to

redirect a reference from a first address to a second address, wherein

the reference initially refers to the first address,

the first address is an address of a function to be executed by a virtual machine, and

the second address is an address of a second memory location in a memory page within the virtual machine,

install an execution event at the second memory location,

trigger the execution event, in response to a request to load a software module in the virtual machine, wherein

the execution event, when triggered, is configured to cause an indication to be sent to a hypervisor,

send the indication to the hypervisor that the software module is loaded in the virtual machine, in response to the triggering of the execution event,

access a first memory location in the virtual machine, in response to the indication, wherein

the accessing is performed using the hypervisor,

a value is stored in the first memory location, and

the value identifies the software module, and

return the value to the hypervisor.

9. The computer system of claim 8 , wherein

the function is a debug service function,

the indication is a message, and

the message indicates that the software module is loaded in the virtual machine.

10. The computer system of claim 9 , wherein the computer code is further configured to cause the processor to:

save an original association between the reference and the first address.

11. The computer system of claim 9 , wherein

the request to load the software module in the virtual machine results in the second memory location being accessed.

12. The computer system of claim 11 , wherein the computer code is further configured to cause the processor to:

retrieve the original association, in response to triggering the execution event; and

execute the debug service function at the first address.

13. The computer system of claim 9 , wherein

the memory page is a non-pageable memory page, and

the memory page is located in a kernel memory of the virtual machine.

14. The computer system of claim 9 , wherein the message is sent by a processor executing the debug service function.

15. A non-transitory computer-readable storage medium comprising computer code, when executed, the computer code is configured to cause a processor to:

redirect a reference from a first address to a second address, wherein

the reference initially refers to the first address,

the first address is an address of a function to be executed by a virtual machine, and

the second address is an address of a second memory location in a memory page within the virtual machine;

install an execution event at the second memory location;

trigger an execution event, in response to a request to load a software module in the virtual machine, wherein

the execution event, when triggered, is configured to cause an indication to be sent to a hypervisor;

send the indication to the hypervisor that the software module is loaded in the virtual machine, in response to the triggering of the execution event;

access a first memory location in the virtual machine, in response to the sending wherein

the accessing is performed using the hypervisor,

a value is stored in the first memory location, and

the value identifies the software module; and

return the value to the hypervisor.

16. The non-transitory computer-readable storage medium of claim 15 , wherein

the function is a debug service function,

the indication is a message, and

the message indicates that the software module is loaded in the virtual machine.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the computer code, when executed, is further configured to cause the processor to:

save an original association between the reference and the first address.

18. The non-transitory computer-readable storage medium of claim 16 , wherein

the request to load the software module in the virtual machine results in the second memory location being accessed.

19. The non-transitory computer-readable storage medium of claim 18 , wherein the computer code, when executed, is further configured to cause the processor to:

retrieve the original association, in response to triggering the execution event; and

execute the debug service function at the first address.

20. The non-transitory computer-readable storage medium of claim 16 , wherein

the memory page is a non-pageable memory page, and

the memory page is located in a kernel memory of the virtual machine.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 21, 2019
From: SYMANTEC CORPORATION
To: CA, INC.
Reel/Frame 051144/0918 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 15, 2009
From: CONOVER, MATTHEW
To: SYMANTEC CORPORATION
Reel/Frame 023233/0488 →