sysprogs / virtualkd Goto Github PK

• New revision just dropped 08/09/2018
• PatchGuard caught an illegal modification
  PatchGuardInfo.txt
• If requested, I can provide a !analyze and/or a full dump - just share google drive etc and I'll copy it up.
• Running on VMWare 14 Work Station Pro 14.1.1 build-7528167 on a Windows 10 x64 host

Followed instructions per:
http://virtualkd.sysprogs.org/tutorials/install/

However, in vmmon64, I can't get the "OS" column to say "yes" upon start-up.
It is interesting that when I shut down the guest OS, the OS column turns into "yes" - and then a brand new entry pops up - the row that has "yes" is an unusable, old entry, it seems.

In the host, the entry in the VM description file looks like:

In the guest VM, I captured a log of the operation performed by vminstall, using Process Monitor (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) -- see attachment Logfile.zip. There I can see that the installer overwrote kdcom.dll, at timestamp 2:48:39.9596648.

I can further confirm that by looking at the directory contents of windows\system32 - see attached dir.txt.

dir.txt

Logfile.zip

Looks as a very promising project, anyway just wondering if the VirtualKD is also availiable on non Windows hosts - such e.g. can we built it for Mac OS X ?

best

Carsten

Hello,
The readme says step 1 is to run VirtualKDSetup.exe , however, I cannot find it anywhere in the distribution. I am also getting a error on vmmon64 which says to regsvr32 VBoxKD64.dll which is also no where to be found.

According to the document, command-line option -b is no longer supported in windbg 10.0.10586.
So the DbgBreakPoint() on start option which is actually passing the -b to windbg don't work any more.
By the way, now we can set the initial break point by "sxe ibp".

According to the document, but when I run the virtualBoxIntergration.exe , it throw an execption .

when i use MmMapIoSpace map 0~640K space, it will cause bluescreen in win10
I debug driver with vwmare

Running vmware.exe as a different user than the one running vmmon64.exe does not work, even though both process are running in the same Terminal Services session.
The Pipe name column keeps saying "loading..." and the log is empty.

The usage scenario is not running VMware Workstation intentionally as a different user, but rather running VMware under a standard (non-administrator) account, while running vmmon64.exe as a different account, since it requires elevation.

Hi! I was using VMWare workstation 12 with windbg and virtualkd was working fine at that time. Now I've installed its latest version. VMware 15.5. Now VirtualKD only detects that there is something running in the VMware but OS column in VirtualKD is not showing "yes" , as a gesture that VirtualKD and VMWare are properly configured. also when we press "Run Debugger " and we also have given it full path to windbg. but it is not initializing it. Although when I run windbg.exe by double clicking, it starts immedietly.

...

VirtualKD is unable to find the table and function on 15.5.0 build-14665864. Here is a log from the Virtual Machine monitor.

*******************************************************************************
*VirtualKD patcher DLL successfully loaded. Patching the GuestRPC mechanism...*
*******************************************************************************
Searching patch database for information about current executable...
No information found.
Waiting for VMWare to initialize (5595 ms more to wait)
Analyzing VMWARE-VMX executable...
Building list of EXE sections... 21041K of data found.
Scanning for RPC command name strings...
Finished scanning. Found 56 strings.
Searching for string references...
Found 31 string references.
Found 3 structures resemblant to RPC dispatcher table.
(address 891E39A0, matched pointers: 1)
(address 891E39B0, matched pointers: 1)
(address 89633428, matched pointers: 29)
Analyzing potential RPC dispatcher tables...
Potential RPC table analyzis complete. Found 0 candidates.
Cannot determine RPC dispatcher table location.
Performing additional analyzis.
Analyzing VMWARE-VMX executable...
Building list of EXE sections... 21041K of data found.
Scanning for RPC command name strings...
Finished scanning. Found 6541 strings.
Searching for string references...
Found 1028 string references.
Found 78 structures resemblant to RPC dispatcher table.
Analyzing potential RPC dispatcher tables...
Potential RPC table analyzis complete. Found 0 candidates.
Still cannot find RPC dispatcher table. Try another VMWare version :-(

VMware Pro version: 15.0.2 build-10952284
Virtual machine OS: Windows 10 1809 32x
Host machine OS: Windows 10 1809 64x

I've run VMXPatch64.exe in an elevated prompt