We use the following convention here: DOM0> Prompt which indicates you should run the command on Dom0 ULINUX> Prompt which indicates you should run the command on DomU/Linux UWIN> Prompt which indicates you should run the command on DomU/Windows

For both Linux and Windows:

Install Rekall and its dependencies (this assumes a DNF-based
system; similar steps apply on distributions which use other
package managers):

    DOM0> sudo dnf install json-c json-c-devel virtualenv
    DOM0> virtualenv /tmp/MyEnv
    DOM0> source /tmp/MyEnv/bin/activate
    DOM0> pip install --upgrade setuptools pip wheel
    DOM0> pip install IPython
    DOM0> pip install rekall

For Linux DomU (monitoring target running Linux):

1. Download the Rekall source code to DomU using:

    ULINUX> git clone https://github.com/google/rekall.git

2. From the rekall/tools/linux directory of the Rekall source
tree run (this assumes a Red Hat-like placement of the kernel
source code):

    ULINUX> KHEADER=/usr/src/kernels/<version> make profile

3. Copy <version>.zip to Dom0.

4. Run:

    DOM0> rekall convert_profile <version>.zip <guest-name>.json

5. On Dom0, update /etc/libvmi.conf to include:

    <guest-name> {
        ostype         = "Linux";
        rekall_profile = "<path-to>/<guest-name>-rekall-profile.json";
    }

For Windows DomU (monitoring target running Windows):

1. First, you must find the GUID and PDB filename corresponding
to the image you plan to run. To find this:

    a. Run libvmi's dump-memory example, and save its output
    to a file named "memory-dump":

        DOM0> ./examples/vmi-dump-memory <guest-name> memory-dump

    b. Obtain the GUID and PDB filename corresponding to
    your memory dump:

        DOM0> ./tools/windows-offset-finder/getGUID memory-dump

    (See the libvmi README for this tools dependencies.)

2. Run Rekall to create the Rekall file needed by guestrace:

    DOM0> rekall fetch_pdb <PDB filename> <GUID>
    DOM0> rekall parse_pdb <PDB filename> > <guest-name>-rekall-profile.json

3. On Dom0, update /etc/libvmi.conf to include:

    <guest-name> {
        ostype         = "Windows";
        rekall_profile = "<path-to>/<guest-name>-rekall-profile.json";
    }

For both Linux and Windows, perform the following steps on Dom0:

1. Add

    GRUB_CMDLINE_XEN_DEFAULT="altp2m=1"

to /etc/default/grub, and add

    altp2mhvm = 1

to the configuration file which defines each guest.

2. Restart each Xen DomU guest.

3. Build guestrace and run "guestrace <guest name>" on the Xen
Dom0 guest.