Re: [Xen-devel] Logging Access to HDD

[Michal Novotny <minovotn@xxxxxxxxxx>]

On 04/19/2011 12:02 PM, Heiko Wundram wrote:
> Am 19.04.2011 11:44, schrieb Sebastian Biedermann:
>> I dont need to log every single byte, it would be enough to know which
>> file is accessed by the domU inside its image.
>> So when I use HVM I need to modify qemu and not the xen source?
> Won't work: the outer layer only sees block accesses, and not "actual"
> file accesses, so you're only able to log (if patching qemu) which
> blocks of the virtualized hard disk of your Windows system are accessed.
> You'd need to correlate this to additional data that's stored on the
> disk itself to find out which file a block that's accessed by the system
> belongs to.
>
> Doing this kind of correlation from the outside is hard, and it should
> be much easier to plug a device driver into Windows itself which
> intercepts the filesystem calls in NTFS.sys (which implements the VFS
> for NTFS accesses under windows) to retrieve the accessed files from the
> system itself (namely at the layer which knows about the filesystem
> structure of an NTFS filesystem, which qemu as hardware virtualizer does
> not).
>

That's right. I remember some time ago I've been using API hooking
techniques to do similar stuff so if you implement an API hook directly
to Windows you can achieve the job of file changes. More over, I think
Windows is having some iNotify-like API as well - something like
FindFirstChange() or similar...

Michal

-- 
Michal Novotny <minovotn@xxxxxxxxxx>, RHCE
Virtualization Team (xen userspace), Red Hat


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel