Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Plugins for SLOB/SLUB analysis #800

Open
wants to merge 17 commits into
base: master
Choose a base branch
from

Conversation

Yp3rion
Copy link

@Yp3rion Yp3rion commented Jul 22, 2021

We introduce the linux_slobinfo plugin, which allows to analyze the status of the SLOB memory allocator by providing:

  1. Summary information about the free lists (small, medium, large)
  2. An option to dump the contents of one or all the free lists to file.

The same functionality is also included in the linux_slabinfo plugin and automatically invoked if the presence of the SLOB allocator is detected from the memory dump.

Additionally, we introduce in the linux slabinfo plugin a functionality for the analysis of the status of the SLUB memory allocator which provides summary information about the caches (corresponding to the information provided by the slabinfo command) and is automatically invoked if the presence of SLUB is detected from the memory dump.

NOTE: The SLUB analysis functionality is at the moment only partial and heavily dependent on the specific version of the Linux kernel being used, due to the fact that when attempting to extract Volatility profiles from the system while using more recent versions we obtained profiles missing the definition of some key data structures (we assumed this to be a limitation of the tool used to extract profiles). In particular, we tested on kernel version 3.5.7. For more information, we join a complete .pdf report of our work (Report.pdf).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants