Ether supports windows 7 monitoring mechanism

[Jack]

Hi all,
I was wondering to add Ether to support windows7 native system call
monitoring.
Is there any suggestion for me to accomplish this target?

I've found some native system call table numbers for windows7. I was
doubt that is fast system call mechanism used in ether still works in
windows7 environment?

Any recommendation is appreciate.

Best regards,
Jack

[Artem Dinaburg]

The fundamental syscall mechanism should still be the same, but the
internal windows structures that Ether looks at to get parameter
information are almost certainly different and would need updating.

Artem

[Jakarence]

Dear Artem,

Thanks for your advices.

However we met the problem when we tried to start a windows7 VM on ehter patched xen kernel.

The windows7 VM would be freeze during the startup process.

I believe that was due to the patch code from ether.( Because I could startup a win7 VM on original xen kernel)

Can you give me some recommendations to solve this problem? 

Thanks a lot.

Jack

2011/3/1 Artem Dinaburg <ar...@gtisc.gatech.edu>