All Posts

I am learning about how to ues probes. When I was testing the dynamic probes , I got a problem.(defstring device) (vprobe GUEST:0x7c00 (printf "Executing boot sector!\n")) But there was an e... See more...
I am learning about how to ues probes. When I was testing the dynamic probes , I got a problem.(defstring device) (vprobe GUEST:0x7c00 (printf "Executing boot sector!\n")) But there was an error:invalid static probe : GUEST:0x7c00. And obviously I was using a dynamic probe, but the cmd told me that that is a static probe.I was confused. Please help me .
Hello, I have a vmware datacenter and i have try to mount a disk from a source linux machine (vpnssllog) to another linux machine (webapplnx) the OS version on this machines are the same. i ... See more...
Hello, I have a vmware datacenter and i have try to mount a disk from a source linux machine (vpnssllog) to another linux machine (webapplnx) the OS version on this machines are the same. i create a scripts and i run it: root@webapplnx:~$ vi vmMount.sh #!/bin/bash export LD_LIBRARY_PATH="/usr/lib/vmware-vix-disklib/lib64:$LD_LIBRARY_PATH" host="vceprdwin.corp.scmgroup.com" user="administrator" passwdfile="/root/vmpwd.txt" part_no="0" mount_dir="/mnt/xxx" img_path="[rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk" inv_path="SCM Group Rimini\vm\webapplnx" vmware-mount -v "${inv_path}" -u "${user}" -h "${host}" -F "${passwdfile}" "${img_path}" "${part_no}" "${mount_dir}" root@webapplnx:~$ root@webapplnx:~$ ./vmMount.sh Failed to open disk: The virtual machine cannot be found (4000) Failed to mount disk '[rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk': Cannot open the virtual disk root@webapplnx:~$ I take inv_path from the MOB (name field) and img_path from Edit settings of the virtual machine. From the log i take this messages: VixDiskLib: config options: libdir '/usr/lib/vmware', tmpDir '/tmp/vmware-root'. VixDiskLib: Attempting to locate advanced transport module in "/usr/lib/vmware/plugins64". VixDiskLib: Could not load default plugins from /usr/lib/vmware/plugins64/libdiskLibPlugin.so: Cannot open library: /usr/lib/vmware/plugins64/libdiskLibPlugin.so: cannot open shared object file: No such file or directory. DISKLIB-PLUGIN : Not loading plugin /usr/lib/vmware/plugins64: Not a shared library. VixDiskLib: Transport modes available: file:nbdssl:nbd. VixDiskLib: Advanced transport module not loaded. VMware VixDiskLib (5.0) Release build-427917 >>>>>>>>> Starting FuseMount Process [PID: 3616] <<<<<<<<< UTIL: Change file descriptor limit from soft 1024,hard 1024 to soft 2048,hard 2048. --- Mounting Virtual Disk: [rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk --- Current user owns '[rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk'. Allowing mount. Disk flat file mounted under /var/run/vmware/fuse/7935656355595286143 LIBFUSE   :Opening disk - vmSpec -vmPath=SCM Group Rimini\vm\webapplnx-, server -vceprdwin.corp.scmgroup.com-, disk -[rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk- VixDiskLibVimResolveHostName: Resolving IP address for hostname vceprdwin.corp.scmgroup.com. VixDiskLibVimResolveHostName: Resolved to 10.64.1.30. VixDiskLibVim: VixDiskLibVimLogin VixDiskLibVim: TicketFindVMByInvPath: vmxPath = -SCM Group Rimini\vm\webapplnx- VixDiskLibVim: TicketFindVMCb failure - VixError = 4000. VixDiskLibVim: VixDiskLibVimLogout LIBFUSE   : Failed to open disk: The virtual machine cannot be found (4000) Fuse initialization failed. Flat file '/var/run/vmware/fuse/7935656355595286143/flat' did not appear in the time limit. Maximum symlink level is 7 Cannot link target dir (null): Bad address Failed to mount disk '[rimini_prod_vmfs_cml3850_03] vpnssllog/vpnssllog.vmdk': Cannot open the virtual disk VixDiskLib: VixDiskLib_Exit called. Unmatched Init calls so far: 1. Please Help me !!!
Hi. Install WinDbg on the guest. Then once you know which DLL you want the symbols for run WinDbg and type x ntdll!* into WinDbg (replacing ntdll with the dll you want the symbols for)... See more...
Hi. Install WinDbg on the guest. Then once you know which DLL you want the symbols for run WinDbg and type x ntdll!* into WinDbg (replacing ntdll with the dll you want the symbols for). Then copy and paste the output into a text file.
Hello! I am a studnet from China, and I do not know how to do the step three you said to use WinDbg sumbol files .Can you make it more clear please? Thank you!
I am a student from China, I have some questions about symbol file.Can someone tell me that how can I let vprobes work with symbol files under WINDOWS XP. Thank you!
Fortunately, Cygwin works. Unfortunately, bash $(command) expansion removes newlines (true of both native Linux bash and the Cygwin port), so any single comment in a script will effectively co... See more...
Fortunately, Cygwin works. Unfortunately, bash $(command) expansion removes newlines (true of both native Linux bash and the Cygwin port), so any single comment in a script will effectively comment out every line starting from the first comment to the end of the program. This, however, I can deal with.
Thank you rugina, I surmised that my first approach was resulting in a race condition between the two probes. As for your #2 comment--I'll just have to try Cygwin, because the Microsoft comm... See more...
Thank you rugina, I surmised that my first approach was resulting in a race condition between the two probes. As for your #2 comment--I'll just have to try Cygwin, because the Microsoft command shell doesn't get the result you and I are expecting, and Cygwin is what the VProbes reference prescribes. It's a little unfortunate that the designers didn't foresee the very commonplace desire to input one's script into a file (and thus avoid any shell quoting and escaping idiosynchrasies). But ce'est la vie; maybe when I have some time to kill I'll upgrade my VMM!
1) Calling vmrun twice in a row won't work for what you need. The first call to vmrun loads the first script (with GUEST_IRQ). The second call to vmrun unloads the first script and loads the se... See more...
1) Calling vmrun twice in a row won't work for what you need. The first call to vmrun loads the first script (with GUEST_IRQ). The second call to vmrun unloads the first script and loads the second script (with GUEST_PF). This explains why you first see only GUEST_IRQ, and then you only see GUEST_PF. 2) Calling vmrun only once with 2 probes (both GUEST_IRQ and GUEST_PF) should work and you should see output from both probes. Are you sure there is no output from GUEST_PF? Note that GUEST_IRQ happens much more frequently than GUEST_PF, so the output will contain a lot of GUEST_IRQ and little GUEST_PF. 3) Loading a script directly from a file is supported in Workstation 7 via vmrun's vprobeLoadFile command. For example: vmrun vprobeLoadFile myvm.vmx myscript.vp See the documentation: http://www.vmware.com/pdf/ws7_f3_vprobes_reference.pdf Hope this helps. Radu
I am trying to use VProbes with VMWare Workstation 6.5 on Windows Vista SP2. When I create two VProbes using two back-to-back invocations of vmrun.exe, only the second probe takes effect: th... See more...
I am trying to use VProbes with VMWare Workstation 6.5 on Windows Vista SP2. When I create two VProbes using two back-to-back invocations of vmrun.exe, only the second probe takes effect: the log contains a few entries from the first one (for example, Guest_IRQ), and then contains only entries from the other (for example, Guest_PF). vmrun vprobeLoad %VMX% "(vprobe Guest_IRQ (printf \"%s: 0x%08x\n\" PROBENAME (getguest RSP)))" vmrun vprobeLoad %VMX% "(vprobe Guest_PF (printf \"%s: 0x%08x\n\" PROBENAME (getguest RSP)))" When I create two VProbes in a single invocation of VProbes, only the first probe listed in my argument takes effect: the log contains only entries from the first (for example, Guest_IRQ) and none from the second (for example, Guest_PF). vmrun vprobeLoad %VMX% "(vprobe Guest_IRQ (printf \"%s: 0x%08x\n\" PROBENAME (getguest RSP))) (vprobe Guest_PF (printf \"%s: 0x%08x\n\" PROBENAME (getguest RSP)))" How is a Windows user supposed to get two of these to coexist? Lastly, I want to mention that this would be a LOT easier if I could just write a script file for this and pass it into vmrun.exe.  Instead, I have been using Windows NT Command Scripts (.CMD files) and carefully experimenting to detect and fix quoting issues.  I see that fixitchris has been running around the same issues.  Eventually I'll probably break down and install cygwin and/or the vprobe-toolkit, but that seems really unnecessary--I mean, how hard is it for you to make vmrun.exe memory map a file and point its parser to the resulting buffer instead of using command-line arguments?  Superficial criticism aside, this tool has gained me two very valuable insights in as many days; props for adding it and providing usable documentation. -M.
Hi Jiri, That's correct, guest dynamic probes are the way to intercept the execution of arbitrary functions in your guest. To probe each entry to a function foo, use GUEST: . Regarding cur... See more...
Hi Jiri, That's correct, guest dynamic probes are the way to intercept the execution of arbitrary functions in your guest. To probe each entry to a function foo, use GUEST: . Regarding curprocname(), the script is indeed slightly incorrect, in that offatret and offatstrcpy expect integer constant arguments, not variables or arbitrary expressions. So just write the two lines in this script that refer to "setint" as: (setint _pidOffset (offatret 0xffffffff80096ea9)) (setint _nameOffset (offatstrcpy 0xffffffff800537a8 0xffffffff80052aa1))))) where 0xffffffff80096ea9, 0xffffffff800537a8, and 0xffffffff80052aa1 are the addresses of sys_getpid, get_task_comm, and strncpy, respectively. That should be all you need to do. Radu
Hello Radu, thank you for your explanation. I guess I have a more general question then. Can I use VProbes (or any other VMware product) to check if a certain function has been executed? For e... See more...
Hello Radu, thank you for your explanation. I guess I have a more general question then. Can I use VProbes (or any other VMware product) to check if a certain function has been executed? For example, let's say that I wrote a static library that has a function foo() and there are several binaries that use foo(). I would like to log all the calls to foo(). Is there for example a way how to check a symbol name for every function call inside of VM? --Jiri Update: I achieved a partial success by using dynamic probes. But it would be really handy if the sample implementation of curprocname from the vprobes reference manual was not broken. Could you please let me know if you have a working one? (VMware Workstation 7.0) Thanks
thanks for the link rob.
Hi sharmaanant, Your question is best asked on the ThinApp forum found at http://communities.vmware.com/community/vmtn/entdesk/thinapp?view=discussions. Thanks! Rob
Hi all, I'am facing an issue with a thinapp application wherein i have successfully built my msi from package.ini and installed it as well but when i launch one of the shortcuts i get an e... See more...
Hi all, I'am facing an issue with a thinapp application wherein i have successfully built my msi from package.ini and installed it as well but when i launch one of the shortcuts i get an error message saying that the java2 runtime was initialised but there was an error loading the main class, and the application can not be started. I started fixing he problem by installing some java related registries locally but still the error pops up .. can any one suggest something.. thanks..
Hi Jiri, Thanks for pointing this out. The example is indeed broken, for a number of reasons. 1) First, support for guest symbols via the vprobe.guestSyms vmx option has been deprecated i... See more...
Hi Jiri, Thanks for pointing this out. The example is indeed broken, for a number of reasons. 1) First, support for guest symbols via the vprobe.guestSyms vmx option has been deprecated in Workstation 7.0. If you look in the vmware.log file in the VM directory you'll probably see something like this: VProbe: option vprobe.guestSyms is deprecated VProbe: guest symbol file /home/jsimsa/vmware/Ubuntu/symbols not used VP scripts must now specify numeric addresses. Support for symbolic address resolution will only provided for Emmett scripts, via the emmett compiler. The new emmett compiler will be release on sourceforge within the next couple of weeks. 2) Second, getgueststr is used incorrectly in this example. It has three arguments: destination string variable, number of bytes to read, address of the guest string. The description in the manual is correct, but the use in the example is incorrect. 3) Third, it seems that, at least in Ubuntu 7.04, saved_command_line is the actual address of the string, not the address of a pointer to the string. The correct example that fixes all the issues above looks like this: (replace 0xc042b020 with the address for "saved_command_line" from your symbol file): (defstring command_line_str) (definteger saved_command_line 0xc042b020) (vprobe VMM1Hz (getgueststr command_line_str 255 saved_command_line) (printf "Linux command line (at %#x):\n%s\n" saved_command_line command_line_str) ) Hope this helps. We will try to correct this example in the VProbes reference manual. Thanks! Radu
Hello, I tried to run the following example of the VProbes VMware Workstation 7.0 manual: ;Print the saved Linux command line for 32 bit Linux. (defstring command_line) (defint... See more...
Hello, I tried to run the following example of the VProbes VMware Workstation 7.0 manual: ;Print the saved Linux command line for 32 bit Linux. (defstring command_line) (definteger saved_command_line) (vprobe VMM1Hz (setint saved_command_line (& 0xffffffff (getguest "saved_command_line"))) (getgueststr command_line saved_command_line) (printf "Linux command line (at %#x):\n%s\n" saved_command_line command_line)) I have gather the kernel symbols file (/proc/kallsyms) and put it in $VM_DIR/symbols. I have also included the following lines in $VM_DIR/Ubuntu/Ubuntu.vmx: vprobe.enable = "TRUE" vprobe.guestSyms = "$VM_DIR/symbols" Finally, I have added the line 'vprobe.allow = "TRUE"' to /etc/vmware/config. When I run the example above I get: vprobeLoadFile: error: guest symbols not supported vprobeLoadFile: 0 warnings, 1 errors Error: Unknown error When I replace "saved_command_line" with its address from the kernel symbols file, I get: vprobeLoadFile: error: getgueststr requires 3 args vprobeLoadFile: 0 warnings, 1 errors Error: Unknown error I would like to know how to solve both problems. Please let me know if you have any advice for me. Thanks! Best, --Jiri
hello.
Has there been any advancements in vprobes? Any cool, new things to show us?