Seeing Through The Same Lens...
summary
Prototype called ImEE creates a tiny helper VM that clones CR3 and EPT so guest virtual addresses translate via hardware MMU at native-speed introspection. Implemented on Linux KVM, the IME agent is a position‑independent single‑page routine that switches CR3 to read guest memory with hardware page walks; evaluation versus LibVMI shows several hundred× speedup (microsecond‑scale activation and reads). Design tracks mapping consistency and detects blind spots (execute‑only redirected pages trigger a VM exit and remap).
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:37Outline
- 0:53Problem
- 1:58Example
- 3:24Page Table Walk
- 7:18Immersive Execution Environment
- 8:51Design Environment
- 10:27Implementation Issues
- 12:23Address Spaces
- 13:10Target Address Space
- 14:13Target Address Space Example
- 15:26Local Address Space
- 16:43Local Address Translation
- 17:13Army Agent
- 18:38IME Agent
- 19:50Blind Spots
- 21:57Summary
- 22:42Implementation Evaluation
- 28:00Conclusion
- 28:26Questions
related talks
25mHigh Performance VM Introspection
14mInside Out: A Paradigm Shift in VM Introspection
18mGuest Memory Protection -- Current Status and Future
22mSupporting TEE on x86 Client Platforms with pKVM
23mIMIX: In-Process Memory Isolation EXtension
53mXenpwn: Breaking Paravirtualized Devices
39mHeki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
44mMoRE Shadow Walker: The Progression of TLB-Splitting on x86