System and method for virtualization-assisted debugging
Disclosed are systems and methods for debugging program code using a computing system. The disclosed method includes designating a control point in a software application subject to a debugging procedure, and then executing the program code for the software application as a guest application executing within a virtual machine. Upon detection of a virtualization event, the hardware processor transfers program control to a hypervisor which then determines whether the virtualization event corresponds to the designated control point based on an execution state of the guest application. If so, the virtualization event handler may generate a debugging event that is used by a debugger.
1 . A method comprising:
executing a specially configured hypervisor (hypervisor) upon a computer system which manages execution upon the computer system of a guest application within a virtual machine (VM);
establishing an occurrence of a virtualization event relating to the VM with a virtual event handler forming part of the hypervisor during execution of the guest application;
determining whether the occurrence of the virtualization event relates to a normal virtualization event associated with the guest application or whether the occurrence of the virtualization event corresponds to a virtualization event to be handled by debugging program code (debugger);
upon a determination that the occurrence of the virtualization event corresponds to a normal virtualization event handling the virtualization event with the hypervisor or a virtual machine monitor of the VM; and
upon a determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger handling the virtualization event with the debugger; wherein
the virtual event handler exploits nested page table (NPT) faults; and
the virtual event handler clears or changes access rights to one or more entries within an NPT associated with the VM to establish a control point to suspend execution of the guest application to trigger a VM-EXIT and upon a VM-ENTRY back into the guest application the virtual event handler restores the cleared or changed access rights to one or more entries within an NPT.
2 . The method according to claim 1 , wherein
the hypervisor is configured to hook the virtualization event when the virtualization event corresponds to a virtualization event to be handled by the debugger to support debugging of the guest application executing within the VM in combination with another debugging method; and
the another debugging method is selected from the group comprising a software breakpoint method, a hardware breakpoint method, a watchpoint method and a hardware-assisted tracing method.
3 . The method according to claim 1 , wherein
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger is established in dependence upon determining that a control point within the guest application matches a designated control point of a set of designated control points established by a user via the debugger; and
each designated control point of the set of designated control points established by the user is defined by one of an indication of a label or identifier within code instructions of the guest application, a line number within the code instructions of the guest application, a function name defined by the user within code instructions of the guest application and a condition relating to an internal variable of the guest application established by the user.
4 . The method according to claim 1 , wherein
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger is established in dependence upon analyzing another virtualization event triggered by a transition by the guest application or the VM from a non-root operation to a root operation (VM-EXIT).
5 . The method according to claim 1 , wherein
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger is established in dependence upon analyzing another virtualization event triggered by a transition by the guest application or the VM from a non-root operation to a root operation (VM-EXIT); and
the VM-EXIT is associated with a model-specific register (MSR) of a model of a microprocessor forming part of the computer system; and
the MSR is conditional in triggering the VM-EXIT.
6 . The method according to claim 1 , wherein
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger is established in dependence upon analyzing another virtualization event triggered by a transition by the guest application or the VM from a non-root operation to a root operation (VM-EXIT); and
the VM-EXIT is associated with a model-specific register (MSR) of a model of a microprocessor forming part of the computer system; and
the MSR is unconditional in triggering the VM-EXIT.
7 . The method according to claim 1 , wherein
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger is established in dependence upon analyzing another virtualization event triggered by a transition by the guest application or the VM from a non-root operation to a root operation (VM-EXIT); and
the determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger causes a VM virtual processor state to be saved into a guest state area of the computer system which comprises contents of one or more virtual registers (VRs) and one or more model specific registers (MSRs).
8 . The method according to claim 1 , wherein
the hypervisor enables tracing of all events within the execution of the guest application.
9 . The method according to claim 1 , wherein
the hypervisor enables tracing of one or more events within the execution of the guest application; and
each event of the one or more events relates to a debugging exception.
10 . The method according to claim 1 , wherein
the hypervisor enables tracing of one or more events within the execution of the guest application; and
each event of the one or more events is traced independent of any dependency upon a trace flag.
11 . The method according to claim 1 , wherein
the hypervisor enables tracing of one or more events within the execution of the guest application; and
the guest application comprises program code employing one or more techniques which prevent reverse engineering or debugging of the guest application.
12 . The method according to claim 1 , wherein
the virtual event handler enables or disables a single-stepping execution configuration of a processor executing a software application whilst the software application is in execution by modifying a setting of a VM control data structure associated with the VM; and
the VM control data structure is employed by a logical processor of the VM to manage at least one of transitions in and out of non-root operations and behaviour of the logical processor during non-root operations.
13 . The method according to claim 1 , wherein
the virtual event handler enables or disables a single-stepping execution configuration of a processor executing a software application whilst the software application is in execution by modifying a setting of a VM control data structure associated with the VM.
14 . A method comprising:
executing a specially configured hypervisor (hypervisor) upon a computer system which manages execution upon the computer system of a guest application within a virtual machine (VM);
establishing an occurrence of a virtualization event relating to the VM with a virtual event handler forming part of the hypervisor during execution of the guest application;
determining whether the occurrence of the virtualization event relates to a normal virtualization event associated with the guest application or whether the occurrence of the virtualization event corresponds to a virtualization event to be handled by debugging program code (debugger);
upon a determination that the occurrence of the virtualization event corresponds to a normal virtualization event handling the virtualization event with the hypervisor or a virtual machine monitor of the VM; and
upon a determination that the occurrence of the virtualization event corresponds to a virtualization event to be handled by the debugger handling the virtualization event with the debugger; wherein
the virtualization event is a nested page table fault;
the virtualization event is generated by clearing an access right for a page of code;
the debugger modifies a nested page table in dependence upon a selection made by a user; and
the virtual event handler VMM resets the access right upon completion of a debugging process applied by the debugger.