Need to add support for pages with PROT_NONE permissions #134
Assignees
Labels
Comments
|
Just to keep everything in one place, I'd recommend a LinuxMixin (that follows the same procedures as the WindowsMixin, including subclasses with Intel and the LinuxMixin) and then update the LintelStacker class to use those classes instead of the stock Intel ones... |
|
Just a note that I'm hoping we'll have a resolution to the |
|
#151 has been resolved, so hopefully this can keep moving forward? |
|
I'm still having issues getting dwarf2json profiles to work with this version of Kali for some reason :-/ |
|
When running it on a different copy of memory from the same machine, I get a little bit further: |
|
Encountering the same errors as @gleeda is doing here. I've created an Ubuntu 20.04 VM (using VMware). Installed Is there any progress on this issue? |
|
So given the #151 is complete, this still needs code writing for the LinuxMixin that will accept bit 0 as unset when bit 9 is set, which I think @gleeda offered to do since this is assigned to her. Happy to provide support and help with this, but if it needs the dwarf2json guys to help then let's bring them in... |
|
@gleeda Yes, sorry! I'll get it in here in a bit. |
I think the issue was due to #151 . If so, then maybe we need to have another look at it? @ikelos @cstation |
|
@gleeda @ikelos I'm sorry if I caused any misunderstandings. I commented not because of the initial topic of the issue (The The issue of page errors is popping up more frequent, for example down in #215 or in #356. I do not know what exactly causes these errors, but since this issue is even encountered by Volatility Core Developers 😉, it is likely that it is not merely due to wrong usage of Maybe it is due to an issue with |
|
Ah, thanks for the clarification @cstation . Page errors occur when the page table (which modern systems use to make memory more manoeuvrable and easier to manage) maps to an address that doesn't exist. The error message tells you where in the table it failed, but unfortunately this kind of error can either be because volatility asks for something that doesn't exist, or asks for something that should exist but due to the memory image and how it was acquired, it does not. The memory image can cause page errors for two reasons, either the format it's written in doesn't have all the information it needs (for instance, modern vmem files require a vmsn or vmss file with the same name to be in the same directory as them) or because whilst the memory was being acquired (which takes time) it changed (and the memory that had been mapped in one place changed where it lived. In most cases, the underlying memory image isn't perfect, and there's not a great deal we can do about those, but in certain circumstances we do the wrong thing (either because we've never encountered it before, or we just made a mistake). In cases like that we'd need to dig into what was being done at the time, but a separate issue helps us keep track of everything that's going on. In short, page errors are indicative that something went wrong, but the occurrence of a page error doesn't give us any clues as to exactly what went wrong. 5:S |
|
@gleeda did you regenerate the symbols after #151 (and its related changes in dwarf2json) were made? Without more information it's difficult to tell whether #151 is still an issue or not. I'm also not sure why the JSON affects how page mapping happens? I thought it was a modification to the IntelLayer? |
|
This specific issue is not a problem for me anymore, since my problem was in the end related to how |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The
_PAGE_PRESENTbit is cleared whenmprotect(...PROT_NONE)is called on a page, therefore it is missed.See: https://volatility-labs.blogspot.com/2015/05/using-mprotect-protnone-on-linux.html
The text was updated successfully, but these errors were encountered: