bdpayne/libvmi — pull request #134 by tklengyel (2014-02-22 17:51:32+00:00)
Title: Limit kdbg search to the .data section of the kernel

So instead of following in the footsteps of Volatility which examines the pages mapped into a process to find the KDBG structure, it is actually a lot faster to do a raw search for the kernel based on the knowledge that the kernel's PE header is page aligned (see win-guid in examples).

Once the kernel is located, the string search for KDBG can be limited to the .data section of the kernel, which speed up the initialization process about 10x:

Current speed of process-list with kdbg scan on 2GB Win7 SP1 x64 VM:
time ./examples/process-list windows7-sp1-x64
LibVMI Suggestion: set win_kdvb=0xf800028510a0 in libvmi.conf for faster startup.
Process listing for VM windows7-sp1-x64 (id=242)
Next list entry is at: fffffa80028e71c8
[ 4] System (struct addr:fffffa800184ab30)
[ 216] smss.exe (struct addr:fffffa80028e7040)
[ 296] csrss.exe (struct addr:fffffa8002853950)
[ 344] csrss.exe (struct addr:fffffa8002887b30)
[ 352] wininit.exe (struct addr:fffffa8003004b30)
[ 408] winlogon.exe (struct addr:fffffa8003099b30)
[ 452] services.exe (struct addr:fffffa80030e8910)
[ 460] lsass.exe (struct addr:fffffa80030fdb30)
[ 468] lsm.exe (struct addr:fffffa8003100b30)
[ 580] svchost.exe (struct addr:fffffa8003194b30)
[ 644] svchost.exe (struct addr:fffffa80031cfb30)
[ 696] svchost.exe (struct addr:fffffa80031ffb30)
[ 804] svchost.exe (struct addr:fffffa80027eab30)
[ 856] svchost.exe (struct addr:fffffa800336e120)
[ 968] svchost.exe (struct addr:fffffa8003395630)
[ 240] svchost.exe (struct addr:fffffa80033c4060)
[ 892] spoolsv.exe (struct addr:fffffa800286d060)
[ 336] svchost.exe (struct addr:fffffa80030f51f0)
[ 1112] svchost.exe (struct addr:fffffa80031f6340)
[ 1644] taskhost.exe (struct addr:fffffa800355d950)
[ 1708] dwm.exe (struct addr:fffffa8003588b30)
[ 1720] explorer.exe (struct addr:fffffa800358f3e0)
[ 1572] wmpnetwk.exe (struct addr:fffffa800277f060)
[ 268] taskmgr.exe (struct addr:fffffa8003738780)
[ 1672] SearchIndexer. (struct addr:fffffa8003519b30)
[ 1148] svchost.exe (struct addr:fffffa80035df740)
[ 2648] svchost.exe (struct addr:fffffa80019216f0)

real	0m3.368s
user	0m3.196s
sys	0m0.156s

With this PR:

time ./examples/process-list windows7-sp1-x64
LibVMI Suggestion: set win_kdvb=0x28510a0 in libvmi.conf for faster startup.
Process listing for VM windows7-sp1-x64 (id=242)
Next list entry is at: fffffa80028e71c8
[ 4] System (struct addr:fffffa800184ab30)
[ 216] smss.exe (struct addr:fffffa80028e7040)
[ 296] csrss.exe (struct addr:fffffa8002853950)
[ 344] csrss.exe (struct addr:fffffa8002887b30)
[ 352] wininit.exe (struct addr:fffffa8003004b30)
[ 408] winlogon.exe (struct addr:fffffa8003099b30)
[ 452] services.exe (struct addr:fffffa80030e8910)
[ 460] lsass.exe (struct addr:fffffa80030fdb30)
[ 468] lsm.exe (struct addr:fffffa8003100b30)
[ 580] svchost.exe (struct addr:fffffa8003194b30)
[ 644] svchost.exe (struct addr:fffffa80031cfb30)
[ 696] svchost.exe (struct addr:fffffa80031ffb30)
[ 804] svchost.exe (struct addr:fffffa80027eab30)
[ 856] svchost.exe (struct addr:fffffa800336e120)
[ 968] svchost.exe (struct addr:fffffa8003395630)
[ 240] svchost.exe (struct addr:fffffa80033c4060)
[ 892] spoolsv.exe (struct addr:fffffa800286d060)
[ 336] svchost.exe (struct addr:fffffa80030f51f0)
[ 1112] svchost.exe (struct addr:fffffa80031f6340)
[ 1644] taskhost.exe (struct addr:fffffa800355d950)
[ 1708] dwm.exe (struct addr:fffffa8003588b30)
[ 1720] explorer.exe (struct addr:fffffa800358f3e0)
[ 1572] wmpnetwk.exe (struct addr:fffffa800277f060)
[ 268] taskmgr.exe (struct addr:fffffa8003738780)
[ 1672] SearchIndexer. (struct addr:fffffa8003519b30)
[ 1148] svchost.exe (struct addr:fffffa80035df740)
[ 2648] svchost.exe (struct addr:fffffa80019216f0)

real	0m0.162s
user	0m0.060s
sys	0m0.084s