Fix find_kpgd_method0 for live VMs

This is an attempt to fix an issue during init of a live VM where PsActiveProcessHead can be resolved by kdbg but PsInitialSystemProcess can't, where the EPROCESS at PsActiveProcessHead is not the system process.

The test setup I have for this is:
1) a paused VM where PsActiveProcessHead is not the System process
2) a memory snapshot of the VM at that time

For the live VM, the values being used for win_sysproc/kpgd by kpgd_method0 are for a current process that is not the System process.  For 2, find_kpgd_method2 is used to brute force scan for the System process, which results in the correct values.

+1 to tracking as a bug -- we've vascillated a bit on how to handle that
issue for a while now, might as well

On Mon, Oct 20, 2014 at 1:55 PM, Bryan Payne <notifications@github.com>
wrote:

> In libvmi/os/windows/process.c:
>
> >
> >      if (vmi->os_data == NULL) {
> >          return 0;
> >      }
> >
> > +    if (VMI_FAILURE == vmi_read_addr_ksym(vmi, "PsInitialSystemProcess", &list_head)) {
>
> I'm ok with this. Perhaps file a bug so we don't forget to address them
> later?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/bdpayne/libvmi/pull/214/files#r19101307>.
>