rVMI is a debugger on steroids. It leverages Virtual Machine Introspection (VMI) and memory forensics to provide full system analysis. This means that an analyst can inspect userspace processes, kernel drivers, and preboot environments in a single tool.
It was specifially designed for interactive dynamic malware analysis. rVMI isolates itself from the malware by placing its interactive debugging environment out of the virtual machine (VM) onto the hypervisor-level. Through the use of VMI the analyst still has full control of the VM, which allows her to pause the VM at any point in time and to use typical debugging features such as breakpoints and watchpoints. In addtion, rVMI provides access to the entire Rekall feature set, which enables an analyst to inspect the kernel and its data structures with ease.
NOTE: rVMI will only run on Intel CPUs with virtualization extentions. Additionally, do not try to run rVMI within a virtualized environment. As rVMI depends on hardware virtualization, it will not run in an already virtualized environment.
Installation
rVMI consists of three components, KVM kernel modules, QEMU, and Rekall. This repository will pull in all required components and install them with one simple install script.
For those that are interested, the repositories for these components can be found here:
https://github.com/fireeye/rvmi-kvm
https://github.com/fireeye/rvmi-qemu
https://github.com/fireeye/rvmi-rekall
https://github.com/fireeye/rvmi-kvm
https://github.com/fireeye/rvmi-qemu
https://github.com/fireeye/rvmi-rekall
Getting Started
Begin by cloning the rVMI repository:
$ git clone --recursive https://github.com/fireeye/rvmi.git
$ cd rvmi
Build
Building all components is handled by the install script. Simply perform the following steps:
$ ./install.sh build
Install
The install script can also handle the installation of all components. This will install the following components:
- qmp python module
- rVMI QEMU
- rVMI Rekall
- rVMI KVM modules
Installing these components can be achieved with the following command:
$ ./install.sh install
Kernel Module Persistence
This will not install the kernel modules in a persistent manner (it will not survive a reboot). In order to make these changes persistent, you must replace your KVM modules on the disk. Once built, the kernel modules can be found here:
kvm-rvmi-kmod/x86/*.ko
kvm-rvmi-kmod/x86/*.ko
These modules must be copied to the proper location on your machine. This can be found by running:
$ modinfo kvm
Copy the kernel modules to the location specified by the "filename" output of the above command.
Using rVMI
Start the VM
The first step in starting rVMI is to start a VM. We will not cover creating a VM as the steps are the same as creating a VM for QEMU and these instructions are readily available online. We do recommend that you use a qcow2 image as this will support snapshots within the image format.
You may start qemu in the standard way, paying attention that you enable KVM and QMP:
$ qemu-system-x86_64 -enable-kvm -qmp unix:[QMP SOCK PATH],server,nowait [...]
We have also included a python wrapper script that automatically incorporates these options. You can access the help for this script using the -h flag.
$ qemu.py -h
Important is that you have the qmp socket path to pass to rekall in the next step.
Start Rekall
Use the qmp socket path to start rekall.