Tracee Play/Pause functionality with persistent TraceeMem
pogobanane opened this issue · 2 comments
pogobanane commented
For the lifetime of inject_syscall::Process and thus Tracee (and thus TraceeMem and VmMem), the hypervisor stays stopped. Memory regions have to persist beyond a single 'hypervisor is stopped'-phase though. I'm currently writing a minimal example to find out how such a solution could be built to statisfy the borrow checker.
pogobanane commented
this endeavor resulted in basically a rewrite of kvm/mod.rs
. see feature/kvm-rewrite
pogobanane commented
is now merged