Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix getkcore.c when KASLR is enabled #767

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix getkcore.c when KASLR is enabled #767

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 1 addition & 3 deletions tools/linux/kcore/getkcore.c
View file
Open in desktop
Expand Up @@ -19,8 +19,6 @@ This file exposes all of physical memory (including hardware devices) as ELF sec

To acquire memory, the script first parses /proc/iomem and determines ranges of "System RAM".
It then parses the sections of /proc/kcore and matches "System RAM" regions to those found in the kcore file.
This matching is possible by using the static offset (0xffff880000000000) of the virtual mapping of RAM.
See the _find_kcore_sections function for this algorithm

Each RAM region found is then written to a LiME formatted file so that it can be immediately analyzed with Volatility.

Expand Down Expand Up @@ -146,7 +144,7 @@ void _process_header(int kcore_fd, int out_fd, unsigned long long phdr_addr, uns
if (read(kcore_fd, &p, sizeof(p)) != sizeof(p))
_die("_process_header: Unable to read program header: %x | %x\n", phdr_addr, phys_start);

if (phys_start + 0xffff880000000000 == p.p_vaddr)
if (phys_start == p.p_paddr)
{
_write_lime_header(out_fd, phys_start, p.p_memsz);
_read_write_region(kcore_fd, out_fd, &p, phys_start, read_buf);
Expand Down