{"action":"created","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/154","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/154/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/154/events","html_url":"https://github.com/tklengyel/drakvuf/issues/154","id":156314193,"number":154,"title":"Drakvuf fails to introspect VM with 4GB of RAM","user":{"login":"jeinstos","id":2086366,"avatar_url":"https://avatars.githubusercontent.com/u/2086366?v=3","gravatar_id":"","url":"https://api.github.com/users/jeinstos","html_url":"https://github.com/jeinstos","followers_url":"https://api.github.com/users/jeinstos/followers","following_url":"https://api.github.com/users/jeinstos/following{/other_user}","gists_url":"https://api.github.com/users/jeinstos/gists{/gist_id}","starred_url":"https://api.github.com/users/jeinstos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeinstos/subscriptions","organizations_url":"https://api.github.com/users/jeinstos/orgs","repos_url":"https://api.github.com/users/jeinstos/repos","events_url":"https://api.github.com/users/jeinstos/events{/privacy}","received_events_url":"https://api.github.com/users/jeinstos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-05-23T16:46:14Z","updated_at":"2016-05-23T20:58:30Z","closed_at":null,"body":"Attempting to introspect a Windows 7 Pro SP1 VM with 4,096Mb of RAM. I've decreased the RAM to the suggested 3,000Mb and Drakvuf works as expected.\r\n\r\nI've tracked down the issue to line 936 of `libdrakvuf/vmi.c`, where `xc_domain_increase_reservation_exact()` is called.\r\n\r\nI'm not sure if this is an issue with Xen or Drakvuf, or if this is done on purpose. Any clarification is appreciated!"},"comment":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/comments/221094271","html_url":"https://github.com/tklengyel/drakvuf/issues/154#issuecomment-221094271","issue_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/154","id":221094271,"user":{"login":"jeinstos","id":2086366,"avatar_url":"https://avatars.githubusercontent.com/u/2086366?v=3","gravatar_id":"","url":"https://api.github.com/users/jeinstos","html_url":"https://github.com/jeinstos","followers_url":"https://api.github.com/users/jeinstos/followers","following_url":"https://api.github.com/users/jeinstos/following{/other_user}","gists_url":"https://api.github.com/users/jeinstos/gists{/gist_id}","starred_url":"https://api.github.com/users/jeinstos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeinstos/subscriptions","organizations_url":"https://api.github.com/users/jeinstos/orgs","repos_url":"https://api.github.com/users/jeinstos/repos","events_url":"https://api.github.com/users/jeinstos/events{/privacy}","received_events_url":"https://api.github.com/users/jeinstos/received_events","type":"User","site_admin":false},"created_at":"2016-05-23T20:58:30Z","updated_at":"2016-05-23T20:58:30Z","body":"I've tried setting `shadow_memory=64` and that didn't help. Everything works fine if I set `maxmem` and `memory` to `3000` instead of `4096`. Here is my VM configuration:\r\n```\r\narch = 'x86_64'\r\nname = \"cuckoo-agent\"\r\nmaxmem = 4096\r\nmemory = 4096\r\nvcpus = 1\r\nmaxcpus = 1\r\nbuilder = \"hvm\"\r\nboot = \"d\"\r\nhap = 1\r\nacpi = 1\r\non_poweroff = \"destroy\"\r\non_reboot = \"destroy\"\r\non_crash = \"destroy\"\r\nvnc=1\r\nvnclisten=\"0.0.0.0\"\r\nusb = 1\r\nusbdevice = \"tablet\"\r\naltp2mhvm = 1\r\nshadow_memory = 64\r\nvif = ['type=ioemu,model=e1000,bridge=xenbr0,mac=00:06:5B:BA:7C:02']\r\ndisk = ['phy:/dev/vms/cuckoo-agent,xvda,w']\r\n```\r\n\r\nAnd here is my debugging output from running DRAKVUF:\r\n```\r\nDRAKVUF v0.3-e545d5d\r\nInit VMI on domID 36 -> cuckoo-agent\r\nRekall profile: '_KTRAP_FRAME' has no 'Rip' member\r\nFailed to find offset for _KTRAP_FRAME:Rip\r\n[init_vmi] xc_domain_increase_reservation_exact failed\r\n[drakvuf_init] Failed to initialize VMI\r\nclose_vmi_drakvuf finished\r\nFailed to initialize DRAKVUF\r\nLibVMI Version 0.11.0\r\nLibVMI Mode 2\r\n--completed driver init.\r\n--got name from id (36 --> cuckoo-agent)\r\n**set image_type = cuckoo-agent\r\n**set hvm to true (HVM).\r\n--xen: setup live mode\r\n**set allocated_ram_size = 10004b000, max_physical_address = 0x11004f000\r\n**set pae = 1\r\n**set pse = 1\r\n**set lme = 0\r\n**PAE paging\r\n**sanity checking cr3 = 0x0000000000185000\r\n--succesfully completed architecture init.\r\n**Trying to init from Rekall profile\r\n--PAE PTLookup: lookup vaddr = 0x0000000082842000 dtb = 0x0000000000185000\r\n--MEMORY cache set 0x185000\r\n--xen_get_memory_pfn success on pfn=0x185\r\n--PAE PTLookup: pdpi_entry = 0x0000000000185010, pdpi_value = 0x0000000000188001\r\n--PAE PTLookup: pdpe = 0x188001\r\n--MEMORY cache set 0x188000\r\n--xen_get_memory_pfn success on pfn=0x188\r\n--PAE PTLookup: pgd_entry = 0x001880a0, pgd_value = 0x028009e3\r\n--PAE PTLookup: 2MB page\r\n--PAE PTLookup: paddr = 0x0000000002842000\r\n--V2P cache set 0x0000000082842000 -- 0x0000000002842000 (0x0000000000185000/0x0000000082842000)\r\n**KernBase PA=0x2842000\r\n**KernBase VA=0x82842000\r\n--MEMORY cache set 0x288c000\r\n--xen_get_memory_pfn success on pfn=0x288c\r\n**init from Rekall profile success\r\n--windows symbol lookup (PsActiveProcessHead)\r\n--trying Rekall profile\r\n--got symbol from kernel sysmap (PsActiveProcessHead --> 0x0000000082983ba8).\r\n--SYM cache set PsActiveProcessHead -- 0x0000000082983ba8\r\n--PAE PTLookup: lookup vaddr = 0x0000000082983ba8 dtb = 0x0000000000185000\r\n--MEMORY cache hit 0x185000\r\n--PAE PTLookup: pdpi_entry = 0x0000000000185010, pdpi_value = 0x0000000000188001\r\n--PAE PTLookup: pdpe = 0x188001\r\n--MEMORY cache hit 0x188000\r\n--PAE PTLookup: pgd_entry = 0x001880a0, pgd_value = 0x028009e3\r\n--PAE PTLookup: 2MB page\r\n--PAE PTLookup: paddr = 0x0000000002983ba8\r\n--V2P cache set 0x0000000082983ba8 -- 0x0000000002983ba8 (0x0000000000185000/0x0000000082983000)\r\n--MEMORY cache set 0x2983000\r\n--xen_get_memory_pfn success on pfn=0x2983\r\n--starting search from PsActiveProcessHead (0x00000000857299a0) using kpgd (0x0000000000185000).\r\n--PAE PTLookup: lookup vaddr = 0x00000000857299a0 dtb = 0x0000000000185000\r\n--MEMORY cache hit 0x185000\r\n--PAE PTLookup: pdpi_entry = 0x0000000000185010, pdpi_value = 0x0000000000188001\r\n--PAE PTLookup: pdpe = 0x188001\r\n--MEMORY cache hit 0x188000\r\n--PAE PTLookup: pgd_entry = 0x00188158, pgd_value = 0x056009e3\r\n--PAE PTLookup: 2MB page\r\n--PAE PTLookup: paddr = 0x00000000057299a0\r\n--V2P cache set 0x00000000857299a0 -- 0x00000000057299a0 (0x0000000000185000/0x0000000085729000)\r\n--MEMORY cache set 0x5729000\r\n--xen_get_memory_pfn success on pfn=0x5729\r\n--V2P cache hit 0x000000008572999c -- 0x000000000572999c (0x0000000000185000/0x0000000085729000)\r\n--MEMORY cache hit 0x5729000\r\n--MEMORY cache hit 0x5729000\r\n--Found System process at 857298e8\r\n--V2P cache hit 0x00000000857298e8 -- 0x00000000057298e8 (0x0000000000185000/0x0000000085729000)\r\n--MEMORY cache hit 0x5729000\r\n--Found System process physical address at 57298e8\r\n--MEMORY cache hit 0x5729000\r\n**set kpgd (0x0000000000185000).\r\n**set init_task (0x00000000857298e8).\r\n--kpgd method0 success\r\n--Starting single step on domain 36\r\nEnabling single step\r\nDisabling single step on vcpu: 0\r\n--Removing MTF flag from vcpu 0\r\n--Shutting down single step on domain 36\r\n--Removing MTF flag from vcpu 0\r\n```"}}
{"actor":{"display_login":"jeinstos"}}