[Xen-devel] intercept interrupts from guest domains and find roo

To:	xen-devel@xxxxxxxxxxxxxxxxxxx
Subject:	[Xen-devel] intercept interrupts from guest domains and find rootkits
From:	Elena <elena.junk@xxxxxxxxx>
Date:	Tue, 9 Feb 2010 20:59:22 +0100
Delivery-date:	Tue, 09 Feb 2010 11:59:45 -0800
Dkim-signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:date :x-google-sender-auth:message-id:subject:from:to:content-type; bh=pBuctbblvVoEl4bcU4J3KywugOzWeJyWQ2Zn/n8g0yY=; b=UuHusYsIgmvjYSB4pYO6lqHU3Vgi/lWwynEZiaL05XADX7/sw63dkVnu2uoo7YP+FD gzj9dQhO+zv2kQehO0CjgRs29LwJK9qmHVq+TOsHqxGK6E1ri0zp2Ktk313fdI+vAVRC DgB0yzja7OrYRqsjaGTQj4AAqT5mLOSl+7RSs=
Domainkey-signature:	a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:date:x-google-sender-auth:message-id:subject :from:to:content-type; b=JaLDEGYPcQn5Y8WIVlzDGcfyBkv3YlohbrQn2Icdv+u3Q8RWhXgLFPnCWp8d3394ca n7izMcr3KtTULMzo2P8+wJ+rKzVFl9qZlhJPCmD1xpci2ehlBMrQ+dJ2xB+VEXoJqsAY Xex+3MZ4i9aU2fiYvvknrlQKRO6qKZT35Wets=
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxxx
List-help:	<mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id:	Xen developer discussion <xen-devel.lists.xensource.com>
List-post:	<mailto:xen-devel@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender:	xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

Hello!!

I'd like to refer to this post: "RE: [Xen-devel] Re: How to intercept
interrupts from guest domains"
made by "Mads Bergdal" on 21 Sep 2006 in this list.

Mads try to intercept hypercalls made by a guest domain, from hypervisor.
I made this, modifying xen source (entry.S) and print on dmesg the
number of hypercall.

My question is: if in a guest domain an intruder install a rootkit
(for example an IDT hooking), my hypercall interception on Dom0 can
estabilished that there was a violation to that guest?? Is any rootkit
installed on guest detectable by my hypercall interception (for
example an rootkit that make a specific sequence of hypercalls)?

I hope that it isn't so complicated and I thanks you in advance for
comprehension.

Regards,
Elena

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

WARNING - OLD ARCHIVES

xen-devel

[Xen-devel] intercept interrupts from guest domains and find rootkits