Trace memory and directly manipulate memory

[RosenZhu]

Trace memory and directly manipulate memory

[RosenZhu]

Thanks!

[0vercl0k]

Hello,

Thanks for the kind words 🙏🏽

1. You can directly manipulate memory with every backend; they all give you virtual or physical memory access (VirtRead/Write, PhyReadWrite)

2. For this question I am not 100% sure I understand exactly which memory you'd like to trace. But if you would like to trace memory accesses to certain guest memory regions it would be very easy to do with bochscpu as it receives a callback every time memory is accessed. With the hypervisors backend you would have to implement this on your own somehow; like you would need to do it from a hypervisor

Does this answer your questions?

Cheers

[RosenZhu]

Thanks for your quick response.
As for the second question. Assume the emulation starts at function func(char *p, ...), and our test cases are inserted by the parameter char *p. If there is another function in the target mend(), which changes the test case (say encrypt) and stores the result into a new memory. In this case, if we change the test case, the encrypted result will also be changed because the source of the encrypting is the test case. The memory that holds the result is the one I want.

Is it possible to trace that?

[0vercl0k]

Based on your description it seems like you know where the 'encrypted' version of the testcase is stored at; in which case you can simply read its content if this is what you want. If you don't know its location in memory, then it seems like you know where mend is so you could instrument the guest by setting breakpoints in mend and dump the address or the content of the 'encrypted' buffer.

Am I understanding the question right this time? 😅

Cheers