Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Socketmon plugin not work on win7 sp1 x64 #770

Open
Lexati opened this issue Mar 6, 2023 · 1 comment
Open

Socketmon plugin not work on win7 sp1 x64 #770

Lexati opened this issue Mar 6, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@Lexati
Copy link

Lexati commented Mar 6, 2023

Socketmon plugin not work on win7 sp1 x64

Hello!!
Help me please, i try take on Socketmon plugin on windows 7 sp1 x64, but I have some problems.

I use next command:
sudo drakvuf -a socketmon -d vm-1 -r /var/lib/drakrun/profiles/kernel.json -T /var/lib/drakrun/profile/amd64_tcpip_profile.json -t 120 -i 1288 -v

but drakvuf return error debug log:
изображение

Can you advise me how i can fix this problem?

Also from debug log:
Failed to find dnsapi.dll in list starting at 0x3225f0

[SOCKETMON] trap_visitor: CR3[0x53DF000] pid[0x444 1092] is_wow_process[0] is_wow_module[0] base_name[DNSAPI.dll] load_address[0x7FEFC550000] full_name[C:\Windows\System32\DNSAPI.dll]

[SOCKETMON] trap_visitor: CR3[0x7BCA000] pid[0x278 632] is_wow_process[0] is_wow_module[0] base_name[DNSAPI.dll] load_address[0x7FEFC550000] full_name[c:\windows\system32\DNSAPI.dll]

[SOCKETMON] trap_visitor: CR3[0x5055B000] pid[0x644 1604] is_wow_process[0] is_wow_module[0] base_name[DNSAPI.dll] load_address[0x7FEFC550000] full_name[C:\Windows\system32\DNSAPI.dll]

Thank you in advance!=)

P.S I opened issues also in tklengyel repos
tklengyel/drakvuf#1613

Some info i explained in that thread.

@Lexati
Copy link
Author

Lexati commented Mar 24, 2023

P.S This problem also observed for Windows 10 2004

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant