debugging windows guests

[Raindog <raindog@macrohmasheen.com>]

Hello,

I am researching KVM as a malware analysis platform and had some 
questions about debugging the guest OS. In my case I intend to use 
windows guests. So my questsions are as follows:

Questions:

1. What instrumentation facilities are their available?

2. Is it possible to extend the debugging interface so that debugging is 
more transparent to the guest OS? IE: there is still a limit of 4 HW 
breakpoints (which makes me wonder why a LIST is used for them...)

3. I'm not finding any published API for interfacing with KVM/KQEMU/QEMU 
at a low level, for example, for writing custom tracers, etc. Is there 
one? Or is there something similar?


Bugs:

1. I hit a bug w/ instruction logging using a RAM based temp folder. If 
I ran w/ the following command line:
(Version info: QEMU PC emulator version 0.10.50 (qemu-kvm-devel-88))

qemu-system-x86_64 -hda debian.img -enable-nesting -d in_asm

It would successfully log to the tmp log file, but obviously, KVM would 
be disabled.

If I use sudo, it won't log to the file, is this a known issue?

2. -enable-nesting on AMD hardware using a xen guest OS causes xen to 
GPF somewhere in svm_cpu_up. Is nesting supposed to work w/ Xen based 
guests?