| 摘要 |
The invention relates to a method for assisting with the analysis of the execution of at least one virtual machine hosted by a host server (10), the virtual machine comprising an operating system (OS1) communicating with a hypervisor (11) of the host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following steps: a step (E10) in which the hypervisor identifies, in a memory zone associated with the virtual machine, a first instruction corresponding to an entry point of a current function of the virtual machine; a step (E11) in which a second instruction corresponding to the end of said current function is identified; a step (E12) in which a hash of the instructions contained between the first instruction and the second instruction of the current function is calculated; a step (E13) in which said hash is sought in a reference database (BDR), said database comprising a set of hashes of functions of the kernel of the operating system of the virtual machine, which hashes are respectively associated with a prototype of said function of the kernel; and, when said hash is found in the reference database, a step (E14) in which an address of the entry point of the current function is recorded in association with the prototype of the function of the kernel. |
