{"action":"created","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/139","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/139/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/139/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/139/events","html_url":"https://github.com/tklengyel/drakvuf/issues/139","id":151996693,"number":139,"title":"win-guid returning error for win7x86sp1 VM","user":{"login":"JimmyTwoShoes","id":18746226,"avatar_url":"https://avatars.githubusercontent.com/u/18746226?v=3","gravatar_id":"","url":"https://api.github.com/users/JimmyTwoShoes","html_url":"https://github.com/JimmyTwoShoes","followers_url":"https://api.github.com/users/JimmyTwoShoes/followers","following_url":"https://api.github.com/users/JimmyTwoShoes/following{/other_user}","gists_url":"https://api.github.com/users/JimmyTwoShoes/gists{/gist_id}","starred_url":"https://api.github.com/users/JimmyTwoShoes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JimmyTwoShoes/subscriptions","organizations_url":"https://api.github.com/users/JimmyTwoShoes/orgs","repos_url":"https://api.github.com/users/JimmyTwoShoes/repos","events_url":"https://api.github.com/users/JimmyTwoShoes/events{/privacy}","received_events_url":"https://api.github.com/users/JimmyTwoShoes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-04-30T01:08:13Z","updated_at":"2016-05-16T21:09:42Z","closed_at":null,"body":"Following the install guide, but have run into this error:\r\n```\r\n\r\n[root@drakvuf ~]# win-guid name win7x86sp1\r\nVMI_ERROR: --requesting PA [0xff000000] beyond max physical address [0xff000000]\r\nVMI_ERROR:      paddr: fefff000, length 1000, vmi->max_physical_address ff000000\r\nVMI_ERROR: create_new_entry failed\r\n[root@drakvuf ~]#\r\n```\r\n\r\n```\r\n[root@drakvuf ~]# xl list\r\nName                                        ID   Mem VCPUs      State   Time(s)\r\nDomain-0                                     0  1023     4     r-----     205.3\r\nwin7x86sp1                                   1  2048     2     -b----      45.0\r\n[root@drakvuf ~]# uname -a\r\nLinux drakvuf.box 4.5.1-1.el7.elrepo.x86_64 #1 SMP Sat Apr 16 11:42:12 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux\r\n[root@drakvuf ~]# cat /etc/redhat-release\r\nCentOS Linux release 7.2.1511 (Core)\r\n[root@drakvuf ~]# xen-detect\r\nRunning in PV context on Xen v4.6.\r\n[root@drakvuf ~]#\r\n```\r\n```\r\n-------------------------------------------------------------------------------\r\nLibVMI is configured as follows. Please verify that this configuration\r\nmatches your expectations.\r\n\r\nHost system type: x86_64-unknown-linux-gnu\r\nBuild system type: x86_64-unknown-linux-gnu\r\nInstallation prefix: /usr/local\r\n\r\nFeature      | Option                    | Reason\r\n-------------|---------------------------|----------------------------\r\nXen Support  | --enable-xen=yes          | yes\r\nXen Events   | --enable-xen-events=yes   | yes\r\nKVM Support  | --enable-kvm=no           | libvirt missing\r\nFile Support | --enable-file=yes         | yes\r\nShm-snapshot | --enable-shm-snapshot=no  | no\r\n-------------|---------------------------|----------------------------\r\n\r\nOS           | Option\r\n-------------|--------------------------------------------------------\r\nWindows      | --enable-windows=yes\r\nLinux        | --enable-linux=yes\r\n\r\n\r\nTools        | Option                    | Reason\r\n-------------|---------------------------|----------------------------\r\nExamples     | --enable-examples=yes     | yes\r\nVMIFS        | --enable-vmifs=yes        | yes\r\n\r\nExtra features\r\n----------------------------------------------------------------------\r\nSupport of Rekall profiles: yes\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/comments/219548882","html_url":"https://github.com/tklengyel/drakvuf/issues/139#issuecomment-219548882","issue_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/139","id":219548882,"user":{"login":"jeinstos","id":2086366,"avatar_url":"https://avatars.githubusercontent.com/u/2086366?v=3","gravatar_id":"","url":"https://api.github.com/users/jeinstos","html_url":"https://github.com/jeinstos","followers_url":"https://api.github.com/users/jeinstos/followers","following_url":"https://api.github.com/users/jeinstos/following{/other_user}","gists_url":"https://api.github.com/users/jeinstos/gists{/gist_id}","starred_url":"https://api.github.com/users/jeinstos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeinstos/subscriptions","organizations_url":"https://api.github.com/users/jeinstos/orgs","repos_url":"https://api.github.com/users/jeinstos/repos","events_url":"https://api.github.com/users/jeinstos/events{/privacy}","received_events_url":"https://api.github.com/users/jeinstos/received_events","type":"User","site_admin":false},"created_at":"2016-05-16T21:09:42Z","updated_at":"2016-05-16T21:09:42Z","body":"@tklengyel: In the end I was not able to properly create a rekall profile from using the libvmi compiled from the drakvuf branch. I compiled and installed libvmi from the latest commit in master, generated the rekall profile, and then re-installed the drakvuf libvmi branch. The rekall profile generated works well with libvmi tools and DRAKVUF is working as expected.\r\n\r\n@JimmyTwoShoes, you may want to generate the rekall profile like I did."}}