could you tell me how to install it with source compile and install rather than use vagrant

[qth1991]

Because of network reasons, I always stuck in the steps of “clone submodules”. So I want to install the source code. Because the KVM kernel used by kvm-vmi is modified, it needs to be recompiled and reinstalled. So,what is the host operating system you are using? What is the version of QEMU and linux-kernel? I will download the kvm-vmi/kvm and put it into the host computer for compilation and installation. Is that ok?

When it is stuck here, I input “ctrl+c”, then "vagrant destroy" and "vagrant up --provider=libvirt", it will be also stuck here.It make me crazy, so I want to deploy my own environment instead of using vagrant.

[Wenzel]

Cloning the submodules takes a while, simply because it clones the KVM repository, which is huge.

You can always try by yourself:

vagrant ssh
$ cd /data/kvm-vmi
$ git submodule update --init

And you will have the progress output.

[qth1991]

yes, I ues vagrant ssh to enter vagrant@jessie:/data/kvm-vmi, download all submoudle,then how to compile it?,because in my hostOS when I reinput "vagrant up --provider=libvirt" it just start-up "vagrant_default" domain Instead of execute yaml script.

[Wenzel]

you need to run the playbook from scratch
use vagrant destroy and vagrant up again

[qth1991]

but if I use vagrant destroy in host os the /var/lib/libvirt/images/vagrant_default.img will also destroy, then vagrant up again it will be also stuck here

[qth1991]

vagrant destroy will delete /var/lib/libvirt/images/vagrant_default.img

[Wenzel]

Please check if clone submodules is actually stuck, and investigate to find the reason.
Otherwise, install everything on the host manually.

[qth1991]

yes it is stuck ,so I want to install everything on the host manually but don't kown how to do this ,could you give me some advice? A little bit can help me a lot,I've been working for several days, but I haven't made any progress.

[Wenzel]

Simply follow what the Ansible playbook is doing, it would be a good start.

[qth1991]

so,in provision_full/playbook.yml ?

[Wenzel]

yes

[qth1991]

ok, i try it! thank you

[qth1991]

Hi,it's me. Sorry to bother you again. When I followed the nitro.yml script execu "python3 nitro/build_libvmi.py".

I execute the script in order of playbook.yml ,kvm.yml, qemu.yml nitro.yml test_vm.yml. Is that execute kvm.yml then reboot entering the “Linux debian 4.9.0-nitro+ #1 SMP Sat Aug 18 21:03:09 EDT 2018 x86_64 GNU/Linux”kernel, execute the script later？

[Wenzel]

hi,
you shouldn't have to build the libvmi python bindings from Nitro, i removed them a couple of months ago, and put them in another project.

you are still seeing this code because the submodules were not up to date, and pointing to older commits.
Please checkout the master branch on Nitro before running the playbook

[qth1991]

Is this due to network reasons? I can download Win7x64 Enterprise.iso myself, but I don't know where to put it?

Only win8 can download , but it has always been 0%

[qth1991]

I installed win7x64.img myself, but there is an error when I was using nitro/main.py. oh, I didn't configure the network for VM win7x64. Is this affected?
This is the VM configure file.

This is error fig

[Wenzel]

Did you rebooted the VM ? you have to boot on the nitro kernel that you installed earlier.

[qth1991]

No I just reboot the VMM, because the win7_64.img is copy from other computer and boot using direct command “virsh create win7_64.xml ”.Do you mean you need to use the ISO file to reinstall it? and I can't find how to do "boot on the nitro kernel" in script yml or README.

[Wenzel]

I mean the Vagrant VM:

From the README
Once vagrant is done provisioning the vm, run vagrant reload to reboot the box (to use the modified kernel)

You can verify that with uname -a and check the kernel name

[qth1991]

thank you ， and have a nice day !

[qth1991]

Remind me to install rekall ,but I have installed rekall.

[Wenzel]

How did you installed rekall ?
I install it system wide, via pip

[qth1991]

eee.... which is correctly.
first

second

[Wenzel]

You just found an issue in my README, congrats.

I have instructed to use pip3, however, i'm calling my script with Python2, so it has to been installed with pip2, or pip.

I will update the README and fix this issue.
Thanks for reporting.

[qth1991]

Oh，Is that all the version is python2.7 or just for rekall? and which python version to run nitro/main.py

[Wenzel]

Python 2.7 is only needed for Rekall.
Nitro is Python3

[qth1991]

why direct execute "python3 main.py win7x64" It's make "ERROR:root:No profiles match this image. Try specifying manually."

[qth1991]

but I first execute “python3 main.py --nobackend win7x64”, then push "ctrl+c" and execute “python3 main.py win7x64” immediately， It's can be run in the right way.

[Wenzel]

The previous error refers to Rekall not being able to identify the operating system.
You should investigate that with Rekall guys.

Nice !
it seems that it works now !