6 Replies Latest reply on Feb 25, 2009 8:47 AM by fixitchris

    Trying this out...

    cwliner Novice

       

      I tried to use the sample code and am getting an error.

       

       

      I tried to run:

       

       

      vmrun vprobeLoad Windows\ XP\ Professional.vmx "'cat vptop.vp'"

       

       

      vprobeLoad: error: illegal variable reference in top-level context

       

       

      I thought it might be a bug in the example, but I tried going back to a simple Hello! type script and I get the same error.  If I type it out on the command line, the Hello! script works, but in a file it does not.

       

       

      If I put the vptop.vp example on the command line, I get another error.

       

       

      vprobeLoad: error: unknown callee cpuprocname

       

       

       

       

       

      Any ideas?

       

       

      I am running Redhat ES 4.7 on this machine, with VMWorkstation 6.5.

       

       

      Thanks!

       

       

       

       

       

      Cameron Liner

      Cameron.Liner@arnold.af.mil

       

       

        • 1. Re: Trying this out...
          fixitchris Expert

           

          Are you running this code on Windows or Linux?

           

           

          What does vProbeList show?

           

           

          • 2. Re: Trying this out...
            cwliner Novice

            Thanks for the reply.

             

            I am running this on Redhat ES Linux.

             

            I'm not seeing a command for vProbeList, but I ran vmrun vprobeListProbes and got a list of items.... I do not have internet access from the system in question so I'll just summarize.

             

            Total probes: 42

            In

            HW_Exit

            SMM_RSMPost

            ...

            ..

            VMXUnload

            VMM10Hz

             

            I do not see curprocname in the list.

            • 3. Re: Trying this out...
              cwliner Novice

               

              UPDATE

               

               

              Well, I tried this out on another Linux box I have around running Ubuntu 8.10.  I have no problems on that machine at all.  I'm guessing there is something missing from the Red Hat system, but I have no idea what it is.  I am going to reload my main system as Ubuntu to continue testing VProbes instead of fighting with Red Hat.

               

               

              Thanks

               

               

              • 4. Re: Trying this out...
                fixitchris Expert

                The LIST command shows the events and global vars.  If anything , curprocname would be a global var (second list), but I think it is user defined and not part of the default variables...  

                 

                What is your plan for Vprobes?

                • 5. Re: Trying this out...
                  cwliner Novice

                  It is more of a learning exercise than anything, but the current idea is to monitor the VM for process launches.  We are going to try to monitor for malware introduced through external media (thumb drives, cd, etc.).  If it is found an action will be taken... possibly a destroy and revert to snapshot action.  Might work, might not.

                  • 6. Re: Trying this out...
                    fixitchris Expert

                     

                    Sounds pretty cool.  Keep us updated.