I want to build simple emulator using Intel VT-x.
Suppose we've allocated memory (guest RAM), of course from paged pool, and built EPT. Everything working.
Now host OS (Win10 x64) decide to swap out those pages or move or smth else, so physical addresses in EPT are not valid anymore. VMM needs to update EPT entries accordinly (not present), and when guest will use such page, an EPT violation will happen. Then VMM performs a dummy read, so host OS will swap page back to memory, and updates EPT entry as present.
So the question: is there any way do detect swap or physical address change for particual linear addresses range of the current thread? Kernel or user mode. I've googled couple of days, but found nothing.
If there is no such way, what approach I can use in this situation? Where I can read about that?
Thanks in advance!
