NT5.2 : Windows Server 2003 (R2) x86/x64 and Windows XP pro x64 edition guest support

[ohault]

The aim of this ticket is to share information about Windows Server 2003 (R2) x64/x86 and Professional x64 Edition guest support by DRAKVUF.

NT 5.2

• Windows XP Professional x64 Edition
  • RTM(SP1) : (x64)
  • SP2 : (x64)
• Windows Server 2003
  • RTM : (x86)
  • SP1 : (x86 and x64)
  • SP2 : (x86 and x64)
• Windows Server 2003 R2
  • RTM(post SP1) : (x86 and x64)
  • SP2 : (x86 and x64)

[julie-nga]

I've tested drakvuf plugin support on a Windows Server 2003 SP2 x64 VM.

The tests were done by modifying this part of win.c into :

if ((vmi_get_winver(drakvuf->vmi) != VMI_OS_WINDOWS_VISTA) && (vmi_get_winver(drakvuf->vmi) != VMI_OS_WINDOWS_XP))
    {
        if (VMI_FAILURE == vmi_translate_ksym2v(drakvuf->vmi, "ObpInfoMaskToOffset", &drakvuf->ob_infomask2off) ||
            VMI_FAILURE == vmi_translate_ksym2v(drakvuf->vmi, "ObTypeIndexTable",    &drakvuf->ob_type_table))
        {
            return 0;
        }
    }

(as these symbols don't exist in a Windows Server 2003 SP2 x64)

Here is what I obtained :

Remark : Although it's a Windows Server 2003 SP2 x64 VM, vmi_get_winver(drakvuf->vmi) returns VMI_OS_WINDOWS_XP. This is due to how libvmi implements it, see core.c .