{"action":"created","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/106","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/106/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/106/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/106/events","html_url":"https://github.com/tklengyel/drakvuf/issues/106","id":143336135,"number":106,"title":"SYSCALLS broken?","user":{"login":"v-p-b","id":540246,"avatar_url":"https://avatars.githubusercontent.com/u/540246?v=3","gravatar_id":"","url":"https://api.github.com/users/v-p-b","html_url":"https://github.com/v-p-b","followers_url":"https://api.github.com/users/v-p-b/followers","following_url":"https://api.github.com/users/v-p-b/following{/other_user}","gists_url":"https://api.github.com/users/v-p-b/gists{/gist_id}","starred_url":"https://api.github.com/users/v-p-b/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/v-p-b/subscriptions","organizations_url":"https://api.github.com/users/v-p-b/orgs","repos_url":"https://api.github.com/users/v-p-b/repos","events_url":"https://api.github.com/users/v-p-b/events{/privacy}","received_events_url":"https://api.github.com/users/v-p-b/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-03-24T19:18:41Z","updated_at":"2016-03-24T20:17:38Z","closed_at":null,"body":"On the latest master enabling the SYSCALLS plugin makes DRAKVUF stuck after displaying the following debug output:\r\n\r\n```\r\nDRAKVUF v0.2\r\nInit VMI on domID 20 -> testx86\r\nRekall profile: '_KTRAP_FRAME' has no 'Rip' member\r\nFailed to find offset for _KTRAP_FRAME:Rip\r\nReservation increased? 0 with new gfn: 0x39942c\r\nXen altp2m view created with idx: 1 idr: 2\r\n```\r\n\r\nMeanwhile the drakvuf process consumes ~95% of the available memory. Can't exit the program, have to kill it. Guest: Win7 32-bit."},"comment":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/comments/201002674","html_url":"https://github.com/tklengyel/drakvuf/issues/106#issuecomment-201002674","issue_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/106","id":201002674,"user":{"login":"tklengyel","id":3172829,"avatar_url":"https://avatars.githubusercontent.com/u/3172829?v=3","gravatar_id":"","url":"https://api.github.com/users/tklengyel","html_url":"https://github.com/tklengyel","followers_url":"https://api.github.com/users/tklengyel/followers","following_url":"https://api.github.com/users/tklengyel/following{/other_user}","gists_url":"https://api.github.com/users/tklengyel/gists{/gist_id}","starred_url":"https://api.github.com/users/tklengyel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tklengyel/subscriptions","organizations_url":"https://api.github.com/users/tklengyel/orgs","repos_url":"https://api.github.com/users/tklengyel/repos","events_url":"https://api.github.com/users/tklengyel/events{/privacy}","received_events_url":"https://api.github.com/users/tklengyel/received_events","type":"User","site_admin":false},"created_at":"2016-03-24T20:17:37Z","updated_at":"2016-03-24T20:17:37Z","body":"You can always just clone a fresh copy and try it with that just to make sure."}}