memflow
memflow copied to clipboard
Question: How to read from remote host?
Hi, i don't know if this is a dumb question, but I haven't found any example about that. I'm trying to read mem from a remote qemu virtual machine using:
<qemu:arg value="-qmp"/>
<qemu:arg value="tcp:192.168.1.1:9038,server,nowait"/>
But I haven't found anything in the docs and nothing in the examples. I guess i have to pass something as "args"
Actually I'm doing (Using memflow 1.4 btw, I'm using c++):
inv = inventory_with_path("/var/memflow/connector");
printf("inv: %p\n", inv);
char *conn_name = "qemu_procfs";
char *conn_arg = "";
proc_name = "myexe.exe";
dll_name = "mydll.dll";
conn = inventory_create_connector(inv, conn_name, conn_arg);
Inside /var/memflow/connector I have a compiled old 1.4 version of libmemflow_qemu_procfs.so
Actually this is working good to local unix socket. /tmp/mysock.sock
But in the conn_arg how to specify i want to connect to a remote host 192.168.1.1:9038?
That is currently not supported, we would want to eventually support this usecase, though.
So actually memflow-qemu looks for a qemu process running in local machine and then noway to connect to a remote IP?
I was also thinking about mount the remote /tmp/mysock.sock and try to read from there. But I'm not a genius about these types of things and I don't know if it will work.
Also... I guess the performance will be very poor.