0

Is possible use Virtual Machine Introspection (VMI) for monitoring system calls and internal system operations in Oracle VirtualBox machine (if I use Linux as quest system) in this time? I have read few research papers about VMI, but unfortunately these projects are dead today... I know about LibVMI project, but it does not have support for VirtualBox. I would use it for monitoring of high-interaction honeypot.

Thanks for replies...

  • I see that you used the honeypot tag but don't seem to mention honeypots in your question. Is the tag incorrect or are honeypots somehow relevant? You should probably edit your question to clarify. – Neil Smithline Nov 1 '15 at 0:38
  • @NeilSmithline tag is relevant I edited this yet. – Mato Nov 1 '15 at 9:04
  • I don't think you can do this with VirtualBox, but you can take a look at drakvuf.com for an example on how such monitoring could work using Xen. – buherator Nov 1 '15 at 10:56
  • @buherator thanks it looks amazing, but it supports only windows as quest system, do you know something similar with support Linux as quest system please? – Mato Nov 1 '15 at 11:30
  • @Mato Unfortunately I don't. But I think DRAKVUF can give you some insight about how such a system should work. Maybe you can even reuse some code after implementing kernel symbol parsing. – buherator Nov 1 '15 at 12:00
2

you should check the Winbagility project which provides the VMI APIs for VirtualBox (called FDP for Fast Debugging Protocol).

A library similar to libvmi has been written on top of it: icebox.

I don't believe that they will make a libvmi driver for FDP. The reason is that they used VirtualBox because it is a cross-platform hypervisor, so no need to be compatible with other hypervisors.

It's a late response, but it may help someone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.