Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a built in debugger. I'm not sure if it's possible for radare2 to integrate with it.

  • I'm not sure what your goal is, do you want to debug the process running inside the VM on your host system? – pudi Nov 5 at 19:31
  • @pudi yes, clarified. – Evan Carroll Nov 5 at 19:38

Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside the whole memory. At first you need to understand how your guest operating system handles processes inside it's kernel and then you need to find the kernel inside this memory region.

There are two interesting projects about this topic: zdbg and r2vmi

Also make sure that to accurately reverse any sort of WindowsVM you make sure you point gdb to the proper .pdb so it can read the symbols for better debugging.

  • In this case the VM is a Linux live cd.. – Evan Carroll Nov 7 at 2:03

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.