<br><br>On Thursday, April 6, 2017, W. Michael Petullo <<a href="mailto:mike@flyn.org">mike@flyn.org</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I am writing some software that monitors a guest VM using virtual-machine<br>
introspection and "hijacks" system calls under certain conditions. For<br>
example, the program might inject an int3/breakpoint into the guest<br>
kernel at the entry point to sys_open. When the breakpoint is hit, the<br>
program might set the guest instruction pointer to the address to which<br>
sys_open would have itself returned and set register RAX to some desired<br>
error-code return value.<br>
<br>
The problem I am encountering is that for some reason the process is<br>
triggering a "uprobe ... failed to handle uretprobe" message from the<br>
guest kernel. I do not yet know enough about uprobes to understand what<br>
might be causing this. Is there something in procedures such as sys_open<br>
which must execute to prevent the error which causes the kernel to print<br>
this message?<br>
<br><br>
</blockquote><div>What vm hypervisor do you use? </div><div><br></div><div>Regards,</div><div><br></div><div>Mulyadi</div><br><br>-- <br>regards,<br><br>Mulyadi Santosa<br>Freelance Linux trainer and consultant<br><br>blog: <a href="http://the-hydra.blogspot.com">the-hydra.blogspot.com</a><br>training: <a href="http://mulyaditraining.blogspot.com">mulyaditraining.blogspot.com</a><br>