Question about setup test vm.

[bigbigbanana]

Sorry about hijack other people's issue,i just want to know can i use virt-manager to create win7 test vm or use qemu-img and virt-install orders?

[Wenzel]

The win7 VM is created using a packer template.
Then, with the import_libvirt.py script, you can view it in virt-manager.

Read closely the README.

[bigbigbanana]

When i run ./main.py --nobackend win7,it reports errors,how can i fix it?

[bigbigbanana]

And after i install libvmi,then i run ./main.py --nobackend win7,it still exits errors.

[Wenzel]

Read the error messages.
too many aruments to function X
There is an API mismatch between your installed libvmi version and the one i'm using in Nitro.

Have you installed the nitro branch version of libvmi ? or just pulled master ?

[bigbigbanana]

For the question exists in the first picture i uploaded,did it means i should install libvmi and then i can run ./main.py --nobackend win7?

[Wenzel]

the --nobackend option was meant to just listen to raw hardware events.
Libvmi is only required in the backend, to rebuild the context of the virtual machine.

In the first picture you uploaded, the error state that CFFI tried to compile the libvmi wrapper, but you were lacking a compiler, gcc for example.

[bigbigbanana]

But i have installed gcc,am i lack of other packages?

[Wenzel]

@bigbigbanana please to try google and search by yourself.
This was really easy to figure out.
First link on google.
https://stackoverflow.com/questions/26053982/error-setup-script-exited-with-error-command-x86-64-linux-gnu-gcc-failed-wit

[bigbigbanana]

I have solved the above questions by installing libvmi used in nitro,thank you for your suggestions!But i have a question,the rax register stores syscall number,but in th picture,i found 0x1002,0x10162 and so on,these syscall numbers should not be so big,are these results wrong?

[Wenzel]

Windows has 2 main SSDT : the NT and the win32k syscall tables.
To differentiate between them, Windows sets a prefix which will should which SSDT to use for a given syscall number.
Take a look at Windows Internals.

[bigbigbanana]

When i run ./main.py win7,there exists some errors,what's wrong with it?

[Wenzel]

Install docopt from your package manager. It's available in your distro.

Also nitro is python3 but you are using pip2 not pip3 here

[bigbigbanana]

But i indeed use python3 to install cffi,docopt,ioctl-opt and in nitro repo,i use python3 ./setup.py install order to install the required installation packages,but there still exists errors.

[Wenzel]

You need docopt for python2 also. Nitro is calling a symbols.py python2 with subprocess which imports docopt.

[bigbigbanana]

I used apt-get install python-docopt and after that i run ./main.py win7,it shows no module named rekall but i have installed rekall.