EPT Switching vs. Instruction Repair vs. Instruction Emulation: A Performance Comparison of Hyper-Breakpoint Variants

Virtual Machine Introspection (VMI) is a powerful technology used to detect and analyze malicious software inside Virtual Machines (VMs) from outside. Asynchronously accessing the VM’s memory can be insufficient for efficiently monitoring what is happening inside of a VM. Active VMI introduces breakpoints to intercept VM execution at relevant points. Especially for frequently visited breakpoints, and even more so for production systems, it is crucial to keep their performance overhead as low as possible. In this paper, we present an empirical study that compares the performance of four VMI breakpoint implementation variants–EPT switching (SLAT view switching) with and without fast single-stepping acceleration, instruction repair and instruction emulation–from two VMI applications (DRAKVUF, SmartVMI), with the XEN hypervisor, on 20 Intel Core i processors ranging from the 4th to the 13th generation. Regarding the time required to process a breakpoint hit, we found that on all platforms: instruction repair > EPT switching EPT switching fast single-step > instruction emulation. More modern processors such as the Intel Core i7 12700H and Intel Core i9 13900HX achieved median breakpoint processing times as low as 15μs.