Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #8  
Old 12-03-2012, 02:48
pp2 pp2 is offline
Friend
 
Join Date: Jan 2002
Posts: 60
Rept. Given: 1
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 1
Thanks Rcvd at 16 Times in 12 Posts
pp2 Reputation: 2
VTx (or SVM in case of AMD) is very useful in debugging/reversing/patching. The only thing you need - small helper-hypervisor. Using it, you can execute almost any code under kind of virtual machine and watch it's execution, set breakpoints, read/write any cpu registers, and even debug switching modes (user<->kernel). This hypervisor works as a "filter": most of processor events are passing through into real OS, except critical/sensitive ones. Catching some events is needed to hide hypervisor from OS, minimize it's influence on execution flow and fake some sensitive data. Using hardware supported MTF (so called monitor trap flag) you can execute cpu commands one-by-one, logging/modifying cpu registers or memory as you need on each command.

Suggest reading intel/amd docs about VTx/SVM to understand the power of using it in debugging/reversing.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Code Virtualization Help tokk350 General Discussion 13 03-26-2009 17:57


All times are GMT +8. The time now is 23:26.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )