topic Re: Dynamic probes no longer working? in VProbes Discussions

Dynamic probes no longer working?

ddebug — Sat, 22 Mar 2014 06:21:58 GMT

Hi,

I'm using vprobes in VMware Workstation (10.0.1 build-1379776).

I am using a dynamic probe to monitor for a guest write on a specific memory address.

My script is taken from the example:

(vprobe GUEST_WRITE:0xb8000

(printf "Write to VGA text RAM.\n"))

However, the problem is that I have an error when I try to vprobeLoadFile the script.

vprobeLoadFile: error: Unrecognized characters ':0xb8000' in probe 'GUEST_WRITE:0xb8000'

vprobeLoadFile: 0 warnings, 1 errors

Error: Unknown error

I have tried many different addresses after GUEST_WRITE, but I always get the same error: "Unrecognized characters".

Also why is there only a Guest_CR3Write and not Guest_OtherRegister here? Like rax, ldtr, etc.

Re: Dynamic probes no longer working?

mcarbone — Tue, 25 Mar 2014 20:25:32 GMT

Hi,

Thank you for using VProbes! The "VProbes Programming Reference" is a bit outdated, and we are currently working on a new, updated version.

Basically, the syntax for guest probes has changed. If you replace GUEST_WRITE with GUEST:WRITE, your script should load.

Regarding your second question, the CPU provides facilities to intercept CR3 writes made by the guest, but the same is not true for general-purpose registers, making it hard to implement what you suggest.

Just out of curiosity, what are you using VProbes for?

Re: Dynamic probes no longer working?

msheep — Fri, 09 May 2014 03:30:26 GMT

Hi mcarbone,

When will the "vProbes Programming Reference" be updated?

Does vProbes works on ESXi 5.5 as well?

Re: Dynamic probes no longer working?

mcarbone — Mon, 12 May 2014 03:30:10 GMT

Hi,

Our expectation is to have the new User Guide uploaded to the community forum webpage in approximately 2 months.

VProbes is not supported on ESXi.

Re: Dynamic probes no longer working?

msheep — Mon, 12 May 2014 06:40:01 GMT

Thanks for the reply.

Are there any plans to extend VProbes to ESXi? Or are there any alternatives to monitor the behavior of processes in VMs running in ESXi servers?

It seems like VMware only allow vshield partners to have access to APIs for vm introspection in ESXi...

Is this true?

Re: Dynamic probes no longer working?

virtualirfan — Thu, 29 May 2014 00:43:12 GMT

Look forward to the new guide!

Re: Dynamic probes no longer working?

avshein — Sat, 13 Sep 2014 16:29:34 GMT

Is there a new User Guide for Vprobes available?