CODEWITHSUNDEEP
debuggingvirtualizationreverse-engineeringvirtual-machine
Elazar Leibovich
Elazar Leibovich

Reputation: 33653

debugging code run in a virtual machine using the host

Is there a debugger which works from a virtual machine's host?

That is, instead of using interrupts inside the machine, I expect this debugger to recognize the virtual machine's OS routines, memory locations etc, and to recognize when the OS is launching a certian EXE. Then I want to be able to set hardware-like breakpoints per process through the host computer. I'll clarify. The virtualized computer and OS would never know that the breakpoint was set or occurred. All debug handling would be done by the host computer which emulates a virtual computer.

This would enable much stronger breakpoint mechanism, for example "break when a certain data is read from the CDROM drive", or "break when a certain file on the disk contains the following byte sequence".

This approach will also, for example, eliminate anti-debugger techniques which are suppose to alter the executable's behavior when running under a debugger. (OTOH it opens up a new area of anti-virtualization techniques which relies upon slight differences between emulated computer and real hardware).

Is there such a product? Does it look like a good idea?

Upvotes: 4

Views: 2472

Answers (2)

hillu
hillu

Reputation: 9631

Recent versions of IDA Pro include a debugger interface which, among other setups, can inspect a BOCHS virtual machine.

Upvotes: 1

Vladimir Panteleev
Vladimir Panteleev

Reputation: 25197

VMware has offered VM debugging plugins for Visual Studio and Eclipse for some time now. It is even possible to record a VM run (which logs input from all devices, allowing to replay the execution of the VM precisely as when it was recorded), then step through the recording with a debugger.

Upvotes: 3

Related Questions