memflow / memflow

physical memory introspection framework

Home Page:https://memflow.github.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Question: How to read from remote host?

blastbeng opened this issue · comments

Hi, i don't know if this is a dumb question, but I haven't found any example about that.
I'm trying to read mem from a remote qemu virtual machine using:


    <qemu:arg value="-qmp"/>
    <qemu:arg value="tcp:192.168.1.1:9038,server,nowait"/>

But I haven't found anything in the docs and nothing in the examples. I guess i have to pass something as "args"

Actually I'm doing (Using memflow 1.4 btw, I'm using c++):

	inv = inventory_with_path("/var/memflow/connector");
	printf("inv: %p\n", inv);
	char *conn_name = "qemu_procfs";
	char *conn_arg = "";
	proc_name = "myexe.exe";
	dll_name = "mydll.dll";
	conn = inventory_create_connector(inv, conn_name, conn_arg);

Inside /var/memflow/connector I have a compiled old 1.4 version of libmemflow_qemu_procfs.so

Actually this is working good to local unix socket. /tmp/mysock.sock

But in the conn_arg how to specify i want to connect to a remote host 192.168.1.1:9038?

commented

That is currently not supported, we would want to eventually support this usecase, though.

So actually memflow-qemu looks for a qemu process running in local machine and then noway to connect to a remote IP?

I was also thinking about mount the remote /tmp/mysock.sock and try to read from there. But I'm not a genius about these types of things and I don't know if it will work.

Also... I guess the performance will be very poor.