Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for radare2 to integrate with it.
-
I'm not sure what your goal is, do you want to debug the process running inside the VM on your host system? – pudi Nov 5 at 19:31
-
@pudi yes, clarified. – Evan Carroll Nov 5 at 19:38
Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside the whole memory. At first you need to understand how your guest operating system handles processes inside it's kernel and then you need to find the kernel inside this memory region.
There are two interesting projects about this topic: zdbg and r2vmi
Also make sure that to accurately reverse any sort of WindowsVM you make sure you point gdb to the proper .pdb so it can read the symbols for better debugging.
