Re: [Vol-dev] Breakpoints On Instruction calls

Tamas, Nir, Michael, Thank you all for the replies. I suspected something similar about Vmware not synching the vmem file too often. Michael, WinpMem seems to be a very good method (from the video), I deliberately didn't look into the source code yet, because I think I need to develop something similar, and would like to do so from scratch. We cannot use any existing code. I tried to avoid writing a driver since it complicated maintenance and release cycles, typically extending them, but if there is no easy way, perhaps that is the way to go. For my previous driver experience (and please correct me if I am wrong), this driver needs to interpret Windows memory management and open sections of memory and furnish the contents and contexts through IOCTLs to the user mode service for further analysis. A few quick questions : 1. This can be done completely agentless? Which means we need to insert nothing inside the VMs? Everything stays in the hyper-visor. 2. Have you guys tried constructing the call stack for such a break point? So when one hits a memory location and that is a function call, I would like to interpret the frames to get a call stack for the function call? (perhaps this is already mentioned in the video, and I didnt pay enough attention) Thanks amit On Sat, Jun 1, 2013 at 3:33 AM, Michael Cohen <scudette(a)gmail.com> wrote: -- - ab