Required DRAKVUF patch for SNIPER - How to remove this requirement ?

[ohault]

SNIPER is an accurate, robust, and transparent tracing solution for Windows APIs.

SNIPER comes in two implementation variants. One builds on DBI (dynamic binary instrumentation) and another one for CPU virtualization extensions (Intel VT-x) that ships as an extension of the DRAKVUF analysis system, relying on its invisible breakpoints for out-of-guest instrumentation*.

(*) Unfortunately, the SNIPER extension for DRAKVUF relies on a dedicated DRAKVUF patch -
patch-drakvuf-376c03d.diff

According to the roadmap of DRAKVUF, how DRAKVUF design and implementation should be enhanced to enable a future version of SNIPER that will no longer require a dedicated DRAKVUF patch ?

[tklengyel]

Patches are always welcome, consider opening a PR and working on upstreaming it

[tklengyel]

I looked at the patch briefly and it looks like a good addition. It would still need to be cleaned up and ideally split into multiple PRs but I don't see a blocker for it being upstreamed.