Warn on segment size mismatch#5
Merged
msuiche merged 4 commits intoMagnetForensics:mainfrom Jan 27, 2023
Merged
Conversation
…kcore sizes are different. Use max between the two to dump
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #4 is caused by the segment size inside
/proc/iomemfor the memory range starting at0x1000being different from the segment from/proc/kcore's header by0x800bytes for some reason. This is not an issue with the code as reading/proc/iomemand dumping the header of/proc/kcoreusingreadelfconfirms this discrepancy. This pull request fixes this issue by warning instead of panicking if the segment sizes differ and uses the max between the two to dump, ensuring that no data is lost because of the mismatch.DumpItForLinux Output
mem_range: MemoryRange { start_phys_addr: 0x1000, end_phys_addr: 0x9E800, memsz: 0x9D800, virt_addr: 0x0, kcore_file_off: 0x0, out_file_off: 0x0, p_flags: 0x0, is_virtual: false, } delta: 0x0, is_virtual: false, start_phys_addr: 0x1000, memsz: 0x9D000 memsz: 0x9D000, mem_range.memsz: 0x9D800readelf -a /proc/kcore
Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align NOTE 0x00000000000002e0 0x0000000000000000 0x0000000000000000 0x00000000000026f4 0x0000000000000000 0x0 LOAD 0x00007fff90e03000 0xffffffff90e00000 0x00000000a6400000 0x0000000002c30000 0x0000000002c30000 RWE 0x1000 LOAD 0x00001ad980003000 0xffff9ad980000000 0xffffffffffffffff 0x00001fffffffffff 0x00001fffffffffff RWE 0x1000 LOAD 0x00007fffc0003000 0xffffffffc0000000 0xffffffffffffffff 0x000000003f000000 0x000000003f000000 RWE 0x1000 LOAD 0x00000bd340004000 0xffff8bd340001000 0x0000000000001000 0x000000000009d000 0x000000000009d000 RWE 0x1000cat /proc/iomem