System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events
A system and method for dynamic software analysis operable to describe program behavior via instrumentation of virtualization events.
1. A method to create a number of passive breakpoints in a virtual machine for dynamic software analysis of program behavior, the method comprising:
instrumenting, by an analysis engine, a guest virtual machine to provide a user with programmatic control configured to (i) register to receive a virtualization trapping event and (ii) modify guest virtual machine execution behavior;
responsive to instrumenting the guest virtual machine to receive the virtualization trapping event,
triggering the virtualization trapping event in a hardware-assisted virtualization platform, during an application software or operating system execution within the guest virtual machine, wherein the hardware-assisted virtualization platform comprises an event driven hooking engine that is further configured to manipulate at least one page permission in the guest virtual machine and utilize at least one virtual machine trap to provide execution at an address within a memory allocated to a process of the guest virtual machine,
intercepting the virtualization trapping event via a hardware-assisted virtualization hypervisor, and
reading the memory within the guest virtual machine by the analysis engine to enable the analysis engine to determine whether the virtualization trapping event includes any unexpected software execution; and
responsive to instrumenting the guest virtual machine to modify the guest execution behavior,
modifying one or more page permissions,
operating in a single-stepping mode by controlling instruction processing by the guest virtual machine to enable the analysis engine to determine any unexpected software execution, and
resetting the one or more page permissions.
2. The method according to claim 1 , wherein the triggering is performed by at least one of (i) the operating system, and (ii) the application software.
3. The method according to claim 1 , wherein when the guest virtual machine attempts to execute any code contained within a physical page, (i) a permission of the physical page is set to executable, and (ii) a single stepping flag is turned on.
4. The method according to claim 1 , wherein the modifying of the guest virtual machine execution behavior is conducted based on controlling instruction processing by the guest virtual machine by at least placing the guest virtual machine in a single-stepping mode.
5. The system according to claim 1 , wherein the modifying of the one or more page permissions includes setting the one or more page permissions to an executable permission.
6. The system according to claim 5 , wherein the resetting of the one or more page permissions includes setting the one or more page permissions to a non-executable permission.
7. The method according to claim 1 , wherein the virtualization trapping event is an event that is registered with the analysis engine and operates as a breakpoint.
8. A system with a processor to create a number of passive breakpoints in a virtual machine via instrumentation of common virtual machine trapping events, the system including:
a hardware-assisted virtualization hypervisor to intercept a virtualization trapping event, the virtualization trapping event triggered (i) in the guest virtual machine, and (ii) during software execution within the guest virtual machine, wherein the hardware-assisted virtualization hypervisor comprises an event driven hooking engine that is further configured to manipulate at least one page permission in the guest virtual machine and utilize at least one virtual machine trap to provide execution at an address within a memory allocated to a process of the guest virtual machine; and
an analysis engine that is separate from the guest virtual machine and the hardware-assisted virtualization hypervisor, the analysis engine to (i) instrument the guest virtual machine to provide a user with programmatic control configured to (i) register to receive a virtualization trapping event and (ii) modify guest virtual machine execution behavior, (ii) read the memory within the guest virtual machine to enable the analysis engine to determine whether the virtualization trapping event includes any unexpected arbitrary software execution, and (iii) modify the guest virtual machine execution behavior by at least modifying one or more page permissions, operating in a single-stepping mode by controlling instruction processing by the guest virtual machine to enable the analysis engine to determine any unexpected software execution, and resetting the one or more page permissions.
9. The system according to claim 8 , further comprising: an operating system that triggers the virtualization trapping event.
10. The system according to claim 8 , wherein the virtualization trapping event is triggered by application software.
11. The system according to claim 8 , wherein the analysis engine to modify the one or more page permissions to an executable permission.
12. The system according to claim 9 , wherein the resetting of the one or more page permissions includes setting the one or more page permissions back to a non-executable permission.
13. The system according to claim 8 , wherein the analysis engine to, when the virtual machine attempts to execute any code contained within a physical page, (i) set a permission of the physical page to executable, and (ii) turn a single stepping flag on.
14. The system according to claim 8 , wherein the analysis engine to modify the guest virtual machine execution behavior based on at least controlling instruction processing by the guest virtual machine by at least placing the guest virtual machine in a single-stepping mode.
15. The system according to claim 8 , wherein the virtualization trapping event is an event that is registered with the analysis engine and operates as a breakpoint.