bdpayne/libvmi — pull request #214 by awsaba (2014-10-14 20:38:54+00:00)
Title: Fix find_kpgd_method0 for live VMs

This is an attempt to fix an issue during init of a live VM where PsActiveProcessHead can be resolved by kdbg but PsInitialSystemProcess can't, where the EPROCESS at PsActiveProcessHead is not the system process.

The test setup I have for this is:
1) a paused VM where PsActiveProcessHead is not the System process
2) a memory snapshot of the VM at that time

For the live VM, the values being used for win_sysproc/kpgd by kpgd_method0 are for a current process that is not the System process. For 2, find_kpgd_method2 is used to brute for scan for the System process, which results in the correct values.