Virtual machine memory mapping method and system

Abstract

The invention provides a virtual machine memory mapping method and a system, wherein the method comprises step 1 of selecting a memory mapping method according to an application layer mapping request, and executing step 2 or step 3; step 2 of binding machine pages to be mapped of a virtual machine to be mapped and physical pages of a monitoring virtual machine, directly reading and writing corresponding memory corresponding to the mapped virtual machine, and executing step 4; step 3 of enabling the monitoring virtual machine to decompose a virtual address space into corresponding physical pages combined by a plurality of pages after the monitoring virtual machine processes unused physical memory in the physical memory, obtaining the machine pages to be mapped of the virtual machine to be mapped, carrying out corresponding processing after judgment, then binding the physical pages of the monitoring virtual machine and the machine pages to be mapped of the virtual machine to be mapped, and executing step 4; step 4 of releasing the memory of the monitoring virtual machine corresponding to the mapping memory of the virtual machine to be mapped after mapping, setting a mapping list from the machine pages of the monitoring virtual machine to the physical pages, and setting a corresponding item to be an invalid machine page.

Description

technical field [0001] The invention relates to the field of virtual machine memory mapping, in particular to a virtual machine memory mapping method and system. Background technique [0002] Virtual machine out-of-band memory mapping is a method of mapping the memory of other virtual machines from the outside through a virtual machine as a monitoring virtual machine. As a key technology for building a security system, it is being more and more widely used. [0003] Current typical applications of this technology include virtual machine security monitoring, criminal forensics, especially local system live forensics, etc. However, at present, this technology has two inherent defects for these two types of applications. On the one hand, the existing out-of-band monitoring technology for virtual machines on virtualization platforms uses privileged virtual machines (such as Domain0 under the Xen platform) as monitoring virtual machines, ignoring privileged virtual machines. At ...

AI Technical Summary

Problems solved by technology

However, at present, this technology has two inherent defects for these two types of applications. On the one hand, the existing out-of-band monitoring technology for virtual machines on virtualization platforms uses privileged virtual machines (such as Domain0 under the Xen platform) as monitoring virtual machines, ignoring privileged virtual machines. The security threats brought by the huge user-level tools in the computer, and the paravirtualized privileged virtual machine cannot provide support for special applications on Windows and other closed-source operating systems

On the other hand, the existing out-of-band memory mapping methods all use one page as a unit for mapping

When large data mapping is required, it is necessary to repeat the mapping in a loop, which is inefficient

Images