h33p / vmread

A library to read/write memory to Windows on KVM

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Initialization Error 3

wakemaster39 opened this issue · comments

Fresh install of win10 Home (International UK English if that somehow matters). Running on a second gen threadripper setup where everything is pinned to be run in numa nodeset 1.

VM is setup with 14 cores and 12GB of RAM.

I was originally running to exit code 1 when running the example until I moved the qemu process under my account.

Now I am running into exit code 3 and I really have no idea where to start the debugging process. I tried investigating the CheckLow function, CLion likes to believe there is unreachable code which can't be right.

I tried bypassing this check just to see, and it immediately fails with an exit code of 4, which is expected but I had to try.

commented

Are you running as root? The default setup requires ptrace privileges for process reads/writes. I should probably add a return value check for the MemRead call so it is more obvious.

running as my main user which is the same as what is running qemu as.

Tried running the program as root and it failed as well.

I tried to make sure it wasn't Fedora, I disabled SELinux fully instead of just permissive but still no go.

commented

Could you check if MemRead returns 0? If it is not 0, then it is a Linux memory operation failure (check which pread error the number corresponds to). If it is 0, could you give me all windows version information you have? I also have a ryzen machine, so will check with it if it is an AMD related issue

buddy has it running on Ryzen, so if it is an issue its a threadripper problem.

My C is a little weak, but I think you are refering to this pread http://man7.org/linux/man-pages/man2/pwrite.2.html

All the MemRead return 65336 from this line: https://github.com/Heep042/vmread/blob/b9a130b1e9f8c4595c9964b7095f6ac0186beb44/wintools.c#L402

Which based on the documentation means the operation was a success since it read 0x1 bytes which is what was requested.

commented

I made a mistake. The full syscall is process_vm_readv, but the op seems successful regardless. This could mean a few things. Either the low stub does not exist on your VM, it has been updated recently to have different code, or the proc maps parsing is incorrect and the wrong memory base is found. I will have to try the same windows version as yours to see if it is one of the first 2 issues. Other than that, not much I can do with current information

Fresh download and install today.

Windows 10 Home
1909
18363.418

I did download the international English version, I am not sure if this makes a difference or not but I an downloading the US English version and reinstalling to see if it makes a difference.

OK, it looks like I have a solution. Back when I first started virtualization you use to need to whitelist UEFI to make it a BIOS options. So you would edit qemu.conf and adjust the nvram option.

Obviously things have evolved since then and a UEFI bios is available by default without the need to edit the nvram option. In fact setting the nvram to the original "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd" causes the explosions.