-
Notifications
You must be signed in to change notification settings - Fork 4
Unofficial mirror of
License
tklengyel/guestrace
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
We use the following convention here: DOM0> Prompt which indicates you should run the command on Dom0 ULINUX> Prompt which indicates you should run the command on DomU/Linux UWIN> Prompt which indicates you should run the command on DomU/Windows For both Linux and Windows: Install Rekall and its dependencies (this assumes a DNF-based system; similar steps apply on distributions which use other package managers): DOM0> sudo dnf install json-c json-c-devel virtualenv DOM0> virtualenv /tmp/MyEnv DOM0> source /tmp/MyEnv/bin/activate DOM0> pip install --upgrade setuptools pip wheel DOM0> pip install IPython DOM0> pip install rekall For Linux DomU (monitoring target running Linux): 1. Download the Rekall source code to DomU using: ULINUX> git clone https://github.com/google/rekall.git 2. From the rekall/tools/linux directory of the Rekall source tree run (this assumes a Red Hat-like placement of the kernel source code): ULINUX> KHEADER=/usr/src/kernels/<version> make profile 3. Copy <version>.zip to Dom0. 4. Run: DOM0> rekall convert_profile <version>.zip <guest-name>.json 5. On Dom0, update /etc/libvmi.conf to include: <guest-name> { ostype = "Linux"; rekall_profile = "<path-to>/<guest-name>-rekall-profile.json"; } For Windows DomU (monitoring target running Windows): 1. First, you must find the GUID and PDB filename corresponding to the image you plan to run. To find this: a. Run libvmi's dump-memory example, and save its output to a file named "memory-dump": DOM0> ./examples/vmi-dump-memory <guest-name> memory-dump b. Obtain the GUID and PDB filename corresponding to your memory dump: DOM0> ./tools/windows-offset-finder/getGUID memory-dump (See the libvmi README for this tools dependencies.) 2. Run Rekall to create the Rekall file needed by guestrace: DOM0> rekall fetch_pdb <PDB filename> <GUID> DOM0> rekall parse_pdb <PDB filename> > <guest-name>-rekall-profile.json 3. On Dom0, update /etc/libvmi.conf to include: <guest-name> { ostype = "Windows"; rekall_profile = "<path-to>/<guest-name>-rekall-profile.json"; } For both Linux and Windows, perform the following steps on Dom0: 1. Add GRUB_CMDLINE_XEN_DEFAULT="altp2m=1" to /etc/default/grub, and add altp2mhvm = 1 to the configuration file which defines each guest. 2. Restart each Xen DomU guest. 3. Build guestrace and run "guestrace <guest name>" on the Xen Dom0 guest.
About
Unofficial mirror of
Resources
License
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published