[Question] Get exit qualification

[K]

Hey,

I am trying to extend this example by reading the exit qualification.
So, how do I get them? After looking at the documentation, I 'think' I found it:

intel_x64::vmcs::exit_qualification::ept_violation::data_read.is_enabled();

But the ept_violation namespace doesn't seem to have data_execute namespace member.
Since I only need to switch the page when the code is getting executed, I really need to know whether it is accessed that way.

After getting this to work, I plan on using shadow pages, instead of just changing the RIP.

[Rian Quinn]

It's called 'instruction_fetch' as that is what it's called in the Intel SDM. So the code would be:

intel_x64::vmcs::exit_qualification::ept_violation::instruction_fetch::is_enabled()

[K]

Ah, didn't know that 😄
Anyway, thanks.

[Rian Quinn]

no problem, glad I could help