Re: Mem_event API and MEM_EVENT_REASON_SINGLESTEP

[Razvan Cojocaru <rzvncj@gmail.com>]

> Not sure what the difference is between first write operation and
> first write mem_event.

The difference is this: a write operation will only trigger a write
event for a page marked rx. So if we're in single step mode and a write
happens on a page marked rwx, this will not trigger a write mem_event.

>> My scenario is this: I'd like to mark _all_ of the domain's pages rw,
>> then when I get a write mem_event, mark only one page rwx, allow that
>> write (single stepping), then mark that one page rw again. This would
> 
> Do you mean rx? If you mark a page rw you will not get a write mem_event for it.

Yes, I meant rx. Sorry (it's late where I'm writing from).

> You could track the EIP and GFN and if you single step more than one
> instruction you can mark the page RX and stop single stepping. You
> will get control again on the next write. Though if there are jmp,
> things could get tricky.

So if I understand you correctly, simply single-stepping for only the
duration of one MEM_EVENT_REASON_SINGLESTEP, which should be the write
operation (ignoring the gfn/gla fields of the mem_event), should do the
trick?

Thanks,
Razvan Cojocaru