Fix find_kpgd_method0 for live VMs

This is an attempt to fix an issue during init of a live VM where PsActiveProcessHead can be resolved by kdbg but PsInitialSystemProcess can't, where the EPROCESS at PsActiveProcessHead is not the system process.

The test setup I have for this is:
1) a paused VM where PsActiveProcessHead is not the System process
2) a memory snapshot of the VM at that time

For the live VM, the values being used for win_sysproc/kpgd by kpgd_method0 are for a current process that is not the System process.  For 2, find_kpgd_method2 is used to brute force scan for the System process, which results in the correct values.

Hm, according to
http://www.slideshare.net/ahmsallam/an-analysis-and-solution-for-the-problem-of-hidden-orphan-processes-on-windows-nt-platforms
slide 5, PsActiveProcessHead is not a full EPROCESS, so I guess that's why
we had that extra read in there. In fact, when you run process-list, this
is the struct that's showing up at the end of the list. By some accident it
might that the memory at the pid offset is 4 for that false struct so we
will need to be more careful if its used within LibVMI to init.

On Wed, Oct 15, 2014 at 5:56 PM, Antony Saba <notifications@github.com>
wrote:

> In libvmi/os/windows/core.c:
>
> >          dbprint(VMI_DEBUG_MISC, "--failed to resolve PsActiveProcessHead\n");
> >          goto error_exit;
> >      }
> > -    if (VMI_FAILURE == vmi_read_addr_va(vmi, sysproc, 0, &sysproc)) {
> > +    if (VMI_FAILURE == vmi_read_addr_va(vmi, active_process_head, 0, &active_process_head)) {
>
> OK, removed the extra read, but leaving in the search, which should just
> be a sanity on the first thing in the list in the error case I am seeing,
> and still work for whatever reason the next pointer was being read.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/bdpayne/libvmi/pull/214/files#r18902884>.
>