-
Notifications
You must be signed in to change notification settings - Fork 442
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
linux_find_file plugin from vol2 to vol3,please #1203
Comments
You haven't provided enough of the error message to know exactly where in your code the problem is, but one of the pointers you're using comes out as 0, which can't be read and is therefore throwing that issue. |
@tanghengliang this is being converted as part of the effort from our core team. It should be ready within the next few weeks. |
@atcuno Thank you for your reply. When importing Linux files, I have debugged to obtain the physical address of the file in memory. The code is as follows: `def to_paddr(self, page_offset):
After obtaining the physical address, read the file content by accessing the address through the memory layer: |
We need to export the file through inode address and convert it from the vol2 method
def to_paddr(self):
mem_map_addr = self.obj_vm.profile.get_symbol("mem_map")
mem_section_addr = self.obj_vm.profile.get_symbol("mem_section")
Convert to vol3 format as follows:
def to_paddr(self, page_offset):
"""Converts the virtual address of a page to a physical address."""
# try:
kernel_module = self.context.modules[self.config['kernel']]
symbol_table_name = kernel_module.symbol_table_name
object_name_prefix = symbol_table_name + constants.BANG
symbol_space = self.context.symbol_space
mem_map_addr = None
if symbol_space.has_symbol(object_name_prefix + 'mem_map'):
mem_map_addr = symbol_space.get_symbol(object_name_prefix + 'mem_map')
mem_section_addr = None
if symbol_space.has_symbol(object_name_prefix + 'mem_section'):
mem_section_addr = symbol_space.get_symbol(object_name_prefix + 'mem_section')
if mem_map_addr and mem_map_addr.address:
mem_map_ptr = objects.Pointer(kernel_module,offset=mem_map_addr.address)
# # FLATMEM kernels, usually 32 bit
# mem_map_ptr = self.context.object(object_type="pointer", layer_name=kernel_module.layer_name,
# offset=mem_map_addr.address)
elif mem_section_addr:
vmemmap_base_addr = None
if symbol_space.has_symbol(object_name_prefix + 'vmemmap_base'):
vmemmap_base_addr = symbol_space.get_symbol(object_name_prefix + 'vmemmap_base')
if vmemmap_base_addr:
# mem_map_ptr = self.context.object(object_name_prefix + "pointer",
# layer_name=kernel_module.layer_name,
# offset=vmemmap_base_addr.address)
mem_map_ptr = self.context.object(object_name_prefix + "unsigned long", layer_name=kernel_module.layer_name,
offset=vmemmap_base_addr.address)
else:
mem_map_ptr = 0xffffea0000000000
else:
vollog.error(
"to_paddr: Unable to determine physical address of page)
Unable to obtain the real physical address,error message as follows
How to solve the problem of exporting Linux files without obtaining physical addresses!Thanks
The text was updated successfully, but these errors were encountered: