How to set singlestep on-demand without VMI_EVENT_RESPONSE_TOGGLE_SINGLESTEP ?

[Wenzel]

Hi,

I would like to know if there is a way to register a singlestep event on a VCPU, (not enabled)
and to enable singlestepping on-demand, without using the callback response VMI_EVENT_RESPONSE_TOGGLE_SINGLESTEP ?

So if i understand correctly you can setup a singlestep event, enabled, and register it:

    SETUP_SINGLESTEP_EVENT(rio_vmi->sstep_event, 1u << 0, cb_on_sstep, true);
    // register event
    status = vmi_register_event(rio_vmi->vmi, rio_vmi->sstep_event);

Or you can setup a singlestep event, disabled (like you do in libdrakvuf), and use the callback to trigger the singlestep

SETUP_SINGLESTEP_EVENT(rio_vmi->sstep_event, 1u << 0, cb_on_sstep, false);
...

event_response_t cb_on_event(vmi_instance_t vmi, vmi_event_t *event) {
    return VMI_EVENT_RESPONSE_TOGGLE_SINGLESTEP;
}

...

event_response_t cb_on_sstep(vmi_instance_t vmi, vmi_event_t *event) {

}

-> Is there a way to enable the singlestep on-demand on an already registered singlestep event ?

    SETUP_SINGLESTEP_EVENT(rio_vmi->sstep_event, 1u << 0, cb_on_sstep, false);
    // register event
    status = vmi_register_event(rio_vmi->vmi, rio_vmi->sstep_event);
    ...
    rio_vmi->sstep_event->ss_event->enable = true ????

I would like to use a single vmi_event_t for singlestepping in my plugin, so registering it at the init, and then toggle the singlestep on 2 conditions:

• I'm processing a software breakpoint (int3): toggle singlestep
• the user wants to singlestep the instruction (like calling step in GDB): not in a callback, my event is already registered on the VCPU, what should i do ???

Thanks.

[Wenzel]

My temporary hack around that is:

• vmi_pause_vm
• vmi_clear_event
• SETUP_SINGLESTEP_EVENT(....., true)
• vmi_register_event
• vmi_resume_vm
  process one callback...

And then resetup the event, disabled by default, to be used in callbacks:

• vmi_pause_vm
• vmi_clear_event
• SETUP_SINGLESTEP_EVENT(....., false)
• vmi_register_event
• vmi_resume_vm

[tklengyel]

Is there a way to enable the singlestep on-demand on an already registered singlestep event ?

The only way to do that is via event_response_t. You can implement an API for it you think you have a use for it as we already have vmi_stop_single_step_vcpu, so you could add vmi_start_single_step_vcpu.

[Wenzel]

The only problem is that I will need to be in a callback, but i have no specific event in the event buffer to use.

I will stick with my solution for now, but i think opening an API in LibVMI for that use case is a good idea.