Detecting Hang on the Virtual Machine using LibVMI

This paper discusses how to monitor the operation of guest OS on the virtualization environment. There are several forensic applications which are useful for analyzing events that run on operating systems specifically memory, CPU, and I/O. We use the LibVMI library to create a new plugin for Drakvuf in order to detect Hang on a guest OS that runs on top of the Xen Hypervisor. The experiment shows that libVMI able to monitor the state of the guest OS. However, the a problem arises when LibVMI start to detect the hang condition. The EPT violation occurs during hang monitoring process.