Hi, I am fairly new to xen. I have installed Xen to solve the following problem: I want to run an arbitrary binary in a sandboxed environment (like virtual machine) and get the execution trace ( that is all the instructions executed while running) of the application. With this execution trace, I am developing algorithm to compare with the static disassembly to check for mismatch and find out possibility of the binary being a malicious software. However I do not how to get the entire execution trace of an application in Xen. It would be great if some one can suggest how to get the execution trace on xen. Obviously I don''t want to run the application under debug / ptrace, because many malicious softwares are intelligent enough and act as good guys when run under debug mode. Regards Milind _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users
Hi, I am fairly new to xen. I have installed Xen to solve the following problem: I want to run an arbitrary binary in a sandboxed environment (like virtual machine) and get the execution trace ( that is all the instructions executed while running) of the application. With this execution trace, I am developing algorithm to compare with the static disassembly to check for mismatch and find out possibility of the binary being a malicious software. However I do not how to get the entire execution trace of an application in Xen. It would be great if some one can suggest how to get the execution trace on xen. Obviously I don''t want to run the application under debug / ptrace, because many malicious softwares are intelligent enough and act as good guys when run under debug mode. Regards Milind _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
First, please don''t cross-post. It''s impolite. You want to modify an emulator. QEMU or Bochs would be a good start. The only way to trace an applications execution at the instruction level in Xen would be put it in debug mode which you have said is not a possibility. Xen always runs application code on bare-metal. Regards, Anthony Liguori milind c wrote:> Hi, > > > > I am fairly new to xen. > > > > I have installed Xen to solve the following problem: > > I want to run an arbitrary binary in a sandboxed environment (like > virtual machine) and get the execution trace ( that is all the > instructions executed while running) of the application. With this > execution trace, I am developing algorithm to compare with the static > disassembly to check for mismatch and find out possibility of the > binary being a malicious software. > > > > However I do not how to get the entire execution trace of an > application in Xen. It would be great if some one can suggest how to > get the execution trace on xen. > > Obviously I don''t want to run the application under debug / ptrace, > because many malicious softwares are intelligent enough and act as > good guys when run under debug mode. > > > > Regards > > Milind > >------------------------------------------------------------------------ > >_______________________________________________ >Xen-users mailing list >Xen-users@lists.xensource.com >http://lists.xensource.com/xen-users >_______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users