[Xen-devel] intercept interrupts from guest domains and find rootkits

[Elena <elena.junk@xxxxxxxxx>]

Hello!!

I'd like to refer to this post: "RE: [Xen-devel] Re: How to intercept
interrupts from guest domains"
made by "Mads Bergdal" on 21 Sep 2006 in this list.

Mads try to intercept hypercalls made by a guest domain, from hypervisor.
I made this, modifying xen source (entry.S) and print on dmesg the
number of hypercall.

My question is: if in a guest domain an intruder install a rootkit
(for example an IDT hooking), my hypercall interception on Dom0 can
estabilished that there was a violation to that guest?? Is any rootkit
installed on guest detectable by my hypercall interception (for
example an rootkit that make a specific sequence of hypercalls)?

I hope that it isn't so complicated and I thanks you in advance for
comprehension.

Regards,
Elena

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel