bdpayne/libvmi — pull request #117 by tklengyel (2013-10-26 21:34:52+00:00)
Title: RFC: Introduce get_va_pages function

While working with a 32-bit PAE Windows 7 I encountered a problem with LibVMI being unable to fully initialize. The problem has been tracked down to the init_kdversion_block function which reads the first addr off the physical address found during the KDBG search. On most systems this is the VA of the KDBG block, but this trick is not guaranteed to work.

However, Volatility was still able to initialize on the VM, hence I went through the trouble of finding out what we are missing. Volatility doesn't loop through all physical pages during the KDBG scan phase, instead it takes the CR3 value and loops through the page tables to find all the valid virtual addresses of the pages present. Using only the virtual addresses this way we can significantly cut down the number of pages that need to be examined during the KDBG scan using just a pure physical scan.

And this way we can also get rid of the old trick of reading the first address of the KDBG block as we get the virtual address and the physical address at the same time.

I tested it on the Win7 SP1 PAE VM that was failing to initialize before and it's working perfectly.