How to implement HIPS Architecture based on Virtualization

This article introduces the knowledge of "how to implement a virtualization-based HIPS architecture". Many people will encounter this dilemma in the operation of actual cases, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

1. Preparatory work

First, we need to make sure that SVM is supported:

This is the beginning of everything.

After that, the VCPU structure area is assigned the same as the previous article. I took the code of the last article directly.

The only difference is that these are added to the vcpu area

Relative_hvm is equivalent to a global variable. In this part, I refer to zero-tang 's noir virtual machine, and I will put references at the end of the article.

Guest_vmcb and host_state are important information that represents:

User's VMCB area (intel is called VMCS), host status (AMD uses a msr called VM_HSAVE_PA to put host status)

They are all the same page_size.

By the way, the structure of vmcb is as follows: