A student seeking help: HVMI instruction emulation crashes on Windows guest (tried many approaches, still stuck)

[xf zhang <zhangxf344@xxxxxxxxx>]

Dear HVMI maintainers and Xen community,

Hello! I am a China student currently learning and researching Virtual Machine Introspection (VMI) technology. I have been working with HVMI and encountered several persistent issues. I would like to kindly ask if there are any known solutions or workarounds.

Background: To test and reproduce these issues, I have kept my Windows guest running for several days and tried many different approaches (including source code modifications and configuration changes). Unfortunately, nothing has worked so far. The issues keep recurring, and I am truly stuck. I would greatly appreciate your guidance.

Please forgive me if I have misunderstood anything.

---

My Environment

Item	Information
Host	Linux (Ubuntu [20.04])
Guest	Windows ([Windows 10_17763_x64])
Virtualization	[Xen]

---

Issues Encountered

When using HVMI to introspect a Windows guest, the introcore module crashes when handling certain instructions due to "spills in the next entry". Here are the specific issues:

Issue 1: MOVZX causes process crash

text

[ERROR] Access at 1aafa7 spills in the next entry, size 4, instruction 'MOVZX'
[ERROR] IntHookPtwEmulateWrite failed: 0xe1000508
process 48416 crashed

Issue 2: PUSH causes introspection engine shutdown

text

[ERROR] Access at 1aa975 spills in the next entry, size 8, instruction 'PUSH'
[ERROR] IntHookPtwEmulateWrite failed: 0xe1000508
Introcore shutdown complete

Issue 3: CMP instruction not supported

text

[ERROR] Instruction 'CMP dword ptr [rbx+0x108], esi' not supported
Introcore shutdown complete

Issue 4: Agent deployment fails (cascading effect)

text

[WARNING] Agent bdQL9CeR.exe will not be deployed as the guest is NOT initialized!

---

What I Have Tried (all failed)

I have spent several days trying the following approaches, but the issues persist:

1. Source code modifications: Commented out IntBugCheck(), forced INT_STATUS_SUCCESS return

2. Configuration changes: Tried disabling certain hook types, modified EPT protection parameters

3. Restarting services: Restarted hvmid and the guest VM multiple times

4. Different Windows versions: Tried both Windows 10 and Windows 7
   

5. Documentation search: Searched for HVMI-related resources but found no similar solutions

---

My Questions

1. Are there any known solutions or patches for these issues?

2. Are there any plans to fix these issues in future releases?

3. If no official fix is available yet, could you suggest any temporary workarounds? (e.g., disabling certain hook types, changing configuration parameters, etc.)

4. Do you have any advice for a student learning HVMI and VMI technology?

---

Thank you for your open-source work on HVMI and the Xen community, which has given students like me the opportunity to learn and explore VMI technology. I look forward to your reply.

Best regards,

[name]Xiaofei Zhang

[School Name] Beijing University of Posts and Telecommunications