memflow icon indicating copy to clipboard operation
memflow copied to clipboard

Question: How to read from remote host?

Open blastbeng opened this issue 1 year ago • 2 comments

Hi, i don't know if this is a dumb question, but I haven't found any example about that. I'm trying to read mem from a remote qemu virtual machine using:


    <qemu:arg value="-qmp"/>
    <qemu:arg value="tcp:192.168.1.1:9038,server,nowait"/>

But I haven't found anything in the docs and nothing in the examples. I guess i have to pass something as "args"

Actually I'm doing (Using memflow 1.4 btw, I'm using c++):

	inv = inventory_with_path("/var/memflow/connector");
	printf("inv: %p\n", inv);
	char *conn_name = "qemu_procfs";
	char *conn_arg = "";
	proc_name = "myexe.exe";
	dll_name = "mydll.dll";
	conn = inventory_create_connector(inv, conn_name, conn_arg);

Inside /var/memflow/connector I have a compiled old 1.4 version of libmemflow_qemu_procfs.so

Actually this is working good to local unix socket. /tmp/mysock.sock

But in the conn_arg how to specify i want to connect to a remote host 192.168.1.1:9038?

blastbeng avatar Jul 22 '22 09:07 blastbeng

That is currently not supported, we would want to eventually support this usecase, though.

h33p avatar Jul 22 '22 09:07 h33p

So actually memflow-qemu looks for a qemu process running in local machine and then noway to connect to a remote IP?

I was also thinking about mount the remote /tmp/mysock.sock and try to read from there. But I'm not a genius about these types of things and I don't know if it will work.

Also... I guess the performance will be very poor.

blastbeng avatar Jul 22 '22 09:07 blastbeng