[panda-users] Find pid by name

[Brendan Dolan-Gavitt]

Yes. You need to tell it what OS the guest is running using the "-os" flag
to PANDA. For the malware replays it's "windows-32-7".

On Fri, Mar 2, 2018 at 5:23 PM, Giuseppe Laurenza <laurenza at diag.uniroma1.it
> wrote:

> I am trying to use the osi plugin, but even using different records I
> always obtain the same error:
> *os_intro.c:151: init_plugin: Assertion `!(panda_os_type == OST_UNKNOWN)'
> failed.*
> Do you know how to solve this issue?
> Regards
>
> On Mar 2, 2018, at 13:06, Brendan Dolan-Gavitt <brendandg at nyu.edu> wrote:
>
> Correct, but all the malware recordings except a handful are 32 bit (even
> though they run on the x86_64 version of QEMU).
>
> On Fri, Mar 2, 2018 at 1:04 PM Giuseppe Laurenza <
> laurenza at diag.uniroma1.it> wrote:
> Thanks
> I see the osi plugin, but if I understood correctly it do es not work with
> 64bit architecture. Is it correct?
> Regards
>
> On Fri, Mar 2, 2018 at 1:03 PM Brendan Dolan-Gavitt <brendandg at nyu.edu>
> wrote:
> Yes. You can use the osi plugin for this. Just get the list of processes
> and the loop over it looking for the name, then look at the pid member.
> Have a look at the asidstory plugin for some examples.
>
> On Fri, Mar 2, 2018 at 12:45 PM Giuseppe Laurenza <
> laurenza at diag.uniroma1.it> wrote:
> Hello panda-user
> Is there any way already implemented in panda to find a process pid by its
> name in windows guest os?
> Thanks in advance
> Regards
> _______________________________________________
> panda-users mailing list
> panda-users at mit.edu
> http://mailman.mit.edu/mailman/listinfo/panda-users
> --
> Brendan Dolan-Gavitt
> Assistant Professor, Department of Computer Science and Engineering
> NYU Tandon School of Engineering
> --
> Brendan Dolan-Gavitt
> Assistant Professor, Department of Computer Science and Engineering
> NYU Tandon School of Engineering
>
>
>


-- 
Brendan Dolan-Gavitt
Assistant Professor, Department of Computer Science and Engineering
NYU Tandon School of Engineering
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/panda-users/attachments/20180302/f901a2ac/attachment.html