Inquiry regarding Nested Page Table (NPT) translation support within process boundaries

[ejdatsz]

Hi Metick,

I am analyzing the architecture of DMALibrary for memory forensics in virtualized/nested environments. The built-in FixCr3() implementation handles native host processes perfectly.

I have a technical question regarding nested virtualization contexts (such as environments running under isolated hypervisor layers or 64-bit emulators). When targeting a specific host process boundary that encapsulates a guest operating system, standard memory reads fail to automatically translate Guest Virtual Addresses (GVA) down to Host Physical Addresses (HPA) due to the nested page tables.

Does DMALibrary currently expose a clean way to integrate custom MemProcFS/vmmdll translation algorithms or plugins to handle hypervisor-nested memory layouts within a targeted process, or is the library strictly optimized for native host process architectures?

Thank you for your time and for maintaining this library.

[Metick]

Hey!

I'm not too well versed in the specifics and about nesting of EPT-style two-stage translations. but as far I'm aware DMA doesn't really care about that. you could read the host physical memory of the emulators guest ram, as it should already be sitting in your host physical memory.

If you still can't find it, try to figure out where the emulator stores the guests memory in ram (Maybe through a sig scan?) or by just reversing the emulator and finding out how it works / where it allocates it on the ram...

once you figure out where the guest address is it should be smooth sailing as far I'm aware. but once again I don't really know never messed with emulators.

One small thing to add, once you find the guest RAM base, that gets you guest physical addresses (just emulatorBase + GPA). If you need to read a guest virtual address instead, you'll still have to walk the guest OS's page tables yourself using its CR3, the same way DMALibrary does it for the host.