Is there anyway that the memory controller can be hooked ? I would like to find out if the memory controller can be hooked or is there someway to intercept (by hooking) every memory read write and execute command for code that is loaded and executing in memory ? I'd like to write a program that can maintain a list of executing programs in memory along with maintaining behavior analysis characteristics of each program or executing code what each is doing in memory. Can this be done by way of a hypervisor (virtualization) technologies or possibly by straightforward hooking of memory management routines or something along these lines ?
Yes, it could. By using Intel Extended Page Table, or AMD Nested Page Table(or Rapid Virtualization Index), you could achieve that by setting page property as no-access.
Doing so, the hypervisor could intercept memory access by EPT Violation(on Intel Processor) and #NPF Exception(on AMD Processor).
Both EPT Violation and #NPF Exception would cause VM-Exit, which is the key matter of interception on virtualization.
However, the processor must support EPT or NPT feature.
Additionally, accessing DMA could not be intercepted by EPT/NPT and can access certain memory without being intercepted.
In order to intercept that, you should apply Intel VT-d(Virtualization Technology for Directed I/O) or AMD EAP(External Access Protection).
Nonetheless, the processor must support VT-d/EAP features.
