Use case planning

[kvm-vmi]

Use case planning

[Wenzel]

I think you have already the right use cases.

• monitoring
• altering the execution by rewriting syscall arguments values or just sysall return values.

Could you be more specific about the last one ? Extending or altering an OS system call handler ?

[Soft]

Regarding the second and third point, I've made a small proof-of-concept test case. It does not do everything correctly but it still seemed to work in the case of this very limited test case. Of course it probably still messes up machine state but for this test it didn't seem to matter

[Soft]

Hmm based on our latest discussion it seems that my approach for system call bypass cannot possibly work, I am wondering why that happened. Maybe I made a mistake in testing it or the test was flawed in some other way. In any case, I'll look into the kernel-side approach of bypassing system call handlers.