./nitro usage: qemu pid guest ram filename

[WelcomeToEarth]

hello
I can get qemu pid by ps -aux ,

but how can i get the guest ram filename?

thanks a lot

[Wenzel]

Hi !
I already used this project and I had the same issue.
If you look at the code, you can see that ram_filename is not used anywhere, apart from being open.
You can safely remove this parameter from the command line and run nitro [pid].

Apart from that, i forked that project i have been working on an improved version which can display
more information like the process name or the syscall name for example.
Here is the link if you think is might be useful for you.

Regards.

[WelcomeToEarth]

Thank you so much for helping, but I still have some problems:

1. Does this project really need the kernel version above 3.X?
2. Does the usage likes pfohjo_version ? to make kvm.ko and kvm_intel.ko replace the original kvm.ko and kvm_intel.ko?

What i want do is to trap the syscalls to monitor a running virtual machine during my project , but more information like the process name or the syscall name will be better.

I have started this project for a very short time and my english is not very well, so your relpy means a lot to me .

Sincerely.

[WelcomeToEarth]

And one more question :

Does this project only supports for now Windows XP x64 and Windows 7 x64?

In my experimental environment ，physical os is centos6.5 and guest os is centos7.

[Wenzel]

Hi,

1. It is based on Linux kernel v4.5.0. Reason for that upgrade is that I could not compile the original kernel module based on linux v3.13 on a recent distro, GCC 5.0 would break the compilation.
2. Yes, the usage is exactly the same. I added a python interface and a backend to interpret the raw data.
3. It only supports Windows XP and Windows 7 because when i tested the project on Windows 8 or Windows 10, the guest would freeze. And I'm focusing on Windows, the backend only works for this platform for now because it searches for well known Windows kernel symbols to walk through process structures as well as displaying the system call name.
   I remember that i tested i on Ubuntu x64 and it was working. Not sure though.
   In any case, you have to try, because the traps are guest independant, they work on the syscall ABI.
   I think the 64 bits traps is more stable than the 32 bits.

Regards.

[WelcomeToEarth]

Thank you very much!

I have to try this project on Linux under my mentor's requirement.

Does it work when you use the pfohjo_version ? If it works,can you show me the procedures precisely? Maybe some screenshots~

谢谢
nickzhang920513@gmail.com

[JackNine]

I have the same problem. With one argument [PID] Nitro does't work. The information as follows:

[Wenzel]

Hi,
please read the first comments.
basically you have to modify the code and remove the check for the guest ram filename argument.

[JackNine]

Thank you. I have modified the code. As the paper Nitro did, I am compiling the Apache web server and Nitro is running now. But it can not trap any system calls.

Whether need me to set the rules in advance? Could you help me to solve this problem? Thank you very much. @Wenzel

[Wenzel]

Hi,
i would like to help you @JackNine , but you didn't provided a lot of information...
What operating system are you trying to monitor ?
What OS is on the host ?
Are you sure you are running on the modified KVM modules ?
Did it ever worked before ?
What did you do from the beginning ?

[bigbigbanana]

Hi,Wenzel.I have changed the code and remove the guest ram filename argument.But when i run the project,i got the wrong result.My host machine is ubuntu14.04(kernel is 3.13),and the guest machine is win7,how do i solve this problem?@Wenzel

[Wenzel]

Hi @bigbigbanana , it seems that attach_vm failed here (are you using the right kernel ?).

This Nitro project is not maintained anymore.
I discussed with the maintainer and forked the project.
We created a Github organization named KVM-VMI and moved our repositories there.
Also, there is already an integration to read/write the memory with libvmi.

KVM-VMI link.

Please try our project, and post an issue if you have some troubles troubles to setup any component or if you find a bug in the API.

We even have a Slack for a quick chat ! :)

[bigbigbanana]

Hi,Wenzel!
Here is the link to bulid nitro:http://nitro.pfoh.net/setup.html
I build the nitro according to this,and i would like to know the environment you use(like the version of linux,is it also ubuntu or others?),and can i use the same step to build your project，i am a new guy and i am not very good at this,so i am very glad to your help!@Wenzel
Regards!

[Wenzel]

@bigbigbanana i know how to build Nitro, i used it before.
I'm not depending on the C version anymore, and neither on the Linux kernel 3.13.

I'm working fully on kvm-vmi now, and i will not really be able to help you on this Nitro setup.
Also, Linux support is coming soon on kvm-vmi, we will be able to analyze Nitro events and deduce syscall name, parameters and process name.