views:

132

answers:

2

Is there a debugger which works from a virtual machine's host?

That is, instead of using interrupts inside the machine, I expect this debugger to recognize the virtual machine's OS routines, memory locations etc, and to recognize when the OS is launching a certian EXE. Then I want to be able to set hardware-like breakpoints per process through the host computer. I'll clarify. The virtualized computer and OS would never know that the breakpoint was set or occurred. All debug handling would be done by the host computer which emulates a virtual computer.

This would enable much stronger breakpoint mechanism, for example "break when a certain data is read from the CDROM drive", or "break when a certain file on the disk contains the following byte sequence".

This approach will also, for example, eliminate anti-debugger techniques which are suppose to alter the executable's behavior when running under a debugger. (OTOH it opens up a new area of anti-virtualization techniques which relies upon slight differences between emulated computer and real hardware).

Is there such a product? Does it look like a good idea?

+1  A: 

VMware has offered VM debugging plugins for Visual Studio and Eclipse for some time now. It is even possible to record a VM run (which logs input from all devices, allowing to replay the execution of the VM precisely as when it was recorded), then step through the recording with a debugger.

CyberShadow
I wish I could accept two answers. Thanks anyhow.
Elazar Leibovich
A: 

Recent versions of IDA Pro include a debugger interface which, among other setups, can inspect a BOCHS virtual machine.

hillu