bdpayne/libvmi — pull request #148 by tklengyel (2014-03-27 16:45:02+00:00)
Title: Use of Rekall system profiles for Windows

This PR adds the option to use Rekall system profiles for Windows, similar to the Linux System.map feature. With Rekall profiles LibVMI works natively on Windows 8 x64:

root@t0:/share/src/libvmi# ./examples/process-list windows8-x64
Process listing for VM windows8-x64 (id=59)
Next list entry is at: fffffa80037e5328
[ 4] System (struct addr:fffffa800241c940)
[ 288] smss.exe (struct addr:fffffa80037e5040)
[ 372] csrss.exe (struct addr:fffffa8003931940)
[ 428] smss.exe (struct addr:fffffa80038bf940)
[ 436] wininit.exe (struct addr:fffffa8003958400)
[ 444] csrss.exe (struct addr:fffffa8003984940)
[ 472] winlogon.exe (struct addr:fffffa80024a6340)
[ 532] services.exe (struct addr:fffffa8003c07080)
[ 540] lsass.exe (struct addr:fffffa8003c42080)
[ 628] svchost.exe (struct addr:fffffa8003c7d080)
[ 676] svchost.exe (struct addr:fffffa80038e3940)
[ 732] dwm.exe (struct addr:fffffa8003c8b080)
[ 740] svchost.exe (struct addr:fffffa8003c8a740)
[ 812] svchost.exe (struct addr:fffffa800394f940)
[ 840] svchost.exe (struct addr:fffffa8003d2f240)
[ 892] svchost.exe (struct addr:fffffa8003d21400)
[ 988] svchost.exe (struct addr:fffffa80038d9940)
[ 432] spoolsv.exe (struct addr:fffffa8003d7e640)
[ 708] svchost.exe (struct addr:fffffa80037c0940)
[ 1096] MsMpEng.exe (struct addr:fffffa8003768940)
[ 1720] LogonUI.exe (struct addr:fffffa8003f1a080)
[ 1188] SearchIndexer. (struct addr:fffffa8002497300)
[ 1564] wmpnetwk.exe (struct addr:fffffa80031c4580)
[ 1804] svchost.exe (struct addr:fffffa80031b6940)

Furthermore, using the Rekall system profile simplifies the configuration entry required for Windows domains, as all offsets are automatically extracted from the profile.

windows8-x64 {
ostype = "Windows";
sysmap = "/share/src/rekall/724821001c1c4a03aed8c4c71c2e8d1d2";
}