Skip to content

Warn on segment size mismatch#5

Merged
msuiche merged 4 commits intoMagnetForensics:mainfrom
rmccrystal:mem-mismatch
Jan 27, 2023
Merged

Warn on segment size mismatch#5
msuiche merged 4 commits intoMagnetForensics:mainfrom
rmccrystal:mem-mismatch

Conversation

@rmccrystal
Copy link
Contributor

Issue #4 is caused by the segment size inside /proc/iomem for the memory range starting at 0x1000 being different from the segment from /proc/kcore's header by 0x800 bytes for some reason. This is not an issue with the code as reading /proc/iomem and dumping the header of /proc/kcore using readelf confirms this discrepancy. This pull request fixes this issue by warning instead of panicking if the segment sizes differ and uses the max between the two to dump, ensuring that no data is lost because of the mismatch.

DumpItForLinux Output

mem_range: MemoryRange {
    start_phys_addr: 0x1000,
    end_phys_addr: 0x9E800,
    memsz: 0x9D800,
    virt_addr: 0x0,
    kcore_file_off: 0x0,
    out_file_off: 0x0,
    p_flags: 0x0,
    is_virtual: false,
}
delta: 0x0, is_virtual: false, start_phys_addr: 0x1000, memsz: 0x9D000
memsz: 0x9D000, mem_range.memsz: 0x9D800

readelf -a /proc/kcore

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  NOTE           0x00000000000002e0 0x0000000000000000 0x0000000000000000
                 0x00000000000026f4 0x0000000000000000         0x0
  LOAD           0x00007fff90e03000 0xffffffff90e00000 0x00000000a6400000
                 0x0000000002c30000 0x0000000002c30000  RWE    0x1000
  LOAD           0x00001ad980003000 0xffff9ad980000000 0xffffffffffffffff
                 0x00001fffffffffff 0x00001fffffffffff  RWE    0x1000
  LOAD           0x00007fffc0003000 0xffffffffc0000000 0xffffffffffffffff
                 0x000000003f000000 0x000000003f000000  RWE    0x1000
  LOAD           0x00000bd340004000 0xffff8bd340001000 0x0000000000001000
                 0x000000000009d000 0x000000000009d000  RWE    0x1000

cat /proc/iomem

00000000-00000fff : Reserved
00001000-0009e7ff : System RAM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants