Enumerate KVM virtual machine process PID

[JIUYUE521]

Hi, may I ask when it is possible to increase the number of Linux enumerations, KVM virtual machine processes, PID, and threads
Looking forward to your addition of new function features and calling columns!

[h33p]

I don't think I fully understand what you mean.

If you have multiple KVM VMs running, you can submit a pid as argument to the connector, like so:

-c kvm:1337 -o win32

Or is there something else you wanted to ask?

[JIUYUE521]

What I mean is to enumerate the number of threads in processes with the same name and traverse to the process PID that you need

[JIUYUE521]

Take process PID parameters without thread count

void Memory::open_proc(const char* name)
{
if(!conn)
{
ConnectorInventory *inv = inventory_scan();
conn = inventory_create_connector(inv, "qemu_procfs", "");
inventory_free(inv);
}

if (conn)
{
    if(!kernel)
    {
        kernel = kernel_build(conn);
    }

    if(kernel)
    {
        Kernel *tmp_ker = kernel_clone(kernel);
	    proc.hProcess = kernel_into_process(tmp_ker, name);
    }
	
    if (proc.hProcess)
    {
		Win32ModuleInfo *module = process_module_info(proc.hProcess, name);

		if (module)
        {
			OsProcessModuleInfoObj *obj = module_info_trait(module);
			proc.baseaddr = os_process_module_base(obj);
			os_process_module_free(obj);
			mem = process_virt_mem(proc.hProcess);
            status = process_status::FOUND_READY;
        }
        else
        {
            status = process_status::FOUND_NO_ACCESS;
			close_proc();
        }
    }
    else
    {
        status = process_status::NOT_FOUND;
    }
}
else
{
    printf("Can't create connector\n");
	exit(0);
}

}

[h33p]

First point: please file general issues in https://github.com/memflow/memflow. I am transferring this issue there.

[h33p]

Now, as for your question, you can do the following:

	int i = 0;

	os.process_info_list_callback([&i, filter](ProcessInfo info) {

		if (!strstr(info.name, filter)) {
			return true;
		}

		char sys_arch[11];
		char proc_arch[11];

		fmt_arch(sys_arch, sizeof(sys_arch), info.sys_arch);
		fmt_arch(proc_arch, sizeof(proc_arch), info.proc_arch);

		printf("%-4d | %-8d | %-10s | %-10s | %s\n", i++, info.pid, sys_arch, proc_arch, info.name);

		return true;
	});

this will print processes that contain filter inside their name. Inside the lambda, you may also choose to take the ProcessInfo object and push it on a std::vector. The point is, this lambda lets you iterate through the processes.

This will give you all processes with the same name.

This will not give you all threads of 1 process.

Thread != process

If you want threads, you'll have to do something different.