avml icon indicating copy to clipboard operation
avml copied to clipboard

Make /proc/kcore acquisition better

Open paulkermann opened this issue 3 years ago • 3 comments
trafficstars

Fixes issue in PPC64 acquisition where file offset was invalid. Ram segments are added sequentially after the first one in the program header. So only after finding the first physical address append blocks. Also, this way we don't "split" some ram segments in AMD64

...
00100000-c61ce017 : System RAM
c61ce018-c61ddc57 : System RAM
c61ddc58-c61de017 : System RAM
c61de018-c61ee057 : System RAM
c61ee058-c6612fff : System RAM
...

as in the kcore file it just apears as

  LOAD           0x0000177940103000 0xffff977940100000 0x0000000000100000
                 0x00000000c60ce000 0x00000000c60ce000  RWE    0x1000
  LOAD           0x0000177a061d2000 0xffff977a061cf000 0x00000000c61cf000
                 0x000000000000e000 0x000000000000e000  RWE    0x1000
  LOAD           0x0000177a061e2000 0xffff977a061df000 0x00000000c61df000
                 0x000000000000f000 0x000000000000f000  RWE    0x1000
  LOAD           0x0000177a061f2000 0xffff977a061ef000 0x00000000c61ef000
                 0x0000000000424000 0x0000000000424000  RWE    0x1000
  LOAD           0x0000177a0661d000 0xffff977a0661a000 0x00000000c661a000
                 0x0000000000445000 0x0000000000445000  RWE    0x1000
  LOAD           0x0000177a06e17000 0xffff977a06e14000 0x00000000c6e14000
                 0x000000000fd8f000 0x000000000fd8f000  RWE    0x1000

so they are physically aligned and easier to manage and more data is returned. First time doing anything in rust, so correct me if I have done something incorrectly.

paulkermann avatar Jun 28 '22 16:06 paulkermann

CLA assistant check
All CLA requirements met.

ghost avatar Jun 28 '22 16:06 ghost

The file offset issue is clearly a bug and should be addressed. With regards to relying on the program headers in the pseudo-elf file, I would like to do much more testing of this feature before we merge it.

bmc-msft avatar Jul 28 '22 14:07 bmc-msft

You can use arm_now to do tests for powerpc and other archs as well if needed

paulkermann avatar Jul 28 '22 16:07 paulkermann