Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
distro
doc
src
tools
.gitignore
AUTHORS
COPYING
ChangeLog
Makefile.am
NEWS
PERFORMANCE
README
autogen.sh
configure.ac
libguestrace-0.0.pc.in

README

We use the following convention here:
	DOM0>   Prompt which indicates you should run the command on Dom0
	ULINUX> Prompt which indicates you should run the command on DomU/Linux
	UWIN>   Prompt which indicates you should run the command on DomU/Windows

For both Linux and Windows:

	Install Rekall and its dependencies (this assumes a DNF-based
	system; similar steps apply on distributions which use other
	package managers):

		DOM0> sudo dnf install json-c json-c-devel virtualenv
		DOM0> virtualenv /tmp/MyEnv
		DOM0> source /tmp/MyEnv/bin/activate
		DOM0> pip install --upgrade setuptools pip wheel
		DOM0> pip install IPython
		DOM0> pip install rekall

For Linux DomU (monitoring target running Linux):

	1. Download the Rekall source code to DomU using:

		ULINUX> git clone https://github.com/google/rekall.git

	2. From the rekall/tools/linux directory of the Rekall source
	tree run (this assumes a Red Hat-like placement of the kernel
	source code):

		ULINUX> KHEADER=/usr/src/kernels/<version> make profile

	3. Copy <version>.zip to Dom0.

	4. Run:

		DOM0> rekall convert_profile <version>.zip <guest-name>.json

	5. On Dom0, update /etc/libvmi.conf to include:

		<guest-name> {
			ostype         = "Linux";
			rekall_profile = "<path-to>/<guest-name>-rekall-profile.json";
		}

For Windows DomU (monitoring target running Windows):

	1. First, you must find the GUID and PDB filename corresponding
	to the image you plan to run. To find this:

		a. Run libvmi's dump-memory example, and save its output
		to a file named "memory-dump":

			DOM0> ./examples/vmi-dump-memory <guest-name> memory-dump

		b. Obtain the GUID and PDB filename corresponding to
		your memory dump:

			DOM0> ./tools/windows-offset-finder/getGUID memory-dump

		(See the libvmi README for this tools dependencies.)

	2. Run Rekall to create the Rekall file needed by guestrace:

		DOM0> rekall fetch_pdb <PDB filename> <GUID>
		DOM0> rekall parse_pdb <PDB filename> > <guest-name>-rekall-profile.json

	3. On Dom0, update /etc/libvmi.conf to include:

		<guest-name> {
			ostype         = "Windows";
			rekall_profile = "<path-to>/<guest-name>-rekall-profile.json";
		}

For both Linux and Windows, perform the following steps on Dom0:

	1. Add

		GRUB_CMDLINE_XEN_DEFAULT="altp2m=1"

	to /etc/default/grub, and add

		altp2mhvm = 1

	to the configuration file which defines each guest.

	2. Restart each Xen DomU guest.

	3. Build guestrace and run "guestrace <guest name>" on the Xen
	Dom0 guest.