To catch instruction execution patterns

[darshantank]

We have set up one VM (Virtual Machine) (Ubuntu Desktop 16.04) on VMM (virtual-manager) running QEMU / KVM. We are using Ubuntu Desktop 16.04 as our host OS.

We execute suspicious C language code on our guest VM.

We want to catch RDTSC and CLFLUSH instructions executed in the form of suspicious C language code on our guest VM. We would like to trace assembly instruction execution patterns ( RDTSC - CLFLUSH - RDTSC ) running on our guest VM from our host OS.

May we use " Kvm-vmi " tool for the said task? How do we accomplish this task?

We would greatly appreciate it if you kindly give us some feedback and share your views.

[Wenzel]

cc @adlazar, @mdontu can kvm-vmi be used to intercept RDTSC or CLFLUSH ? 🤔

[tklengyel]

RDTSC can be trapped, yes. I don't think you can trap clflush.

[darshantank]

@ tklengyel

Thanks for your concern and response.

How do we trap RDTSC using kvm-vmi?