search

Velocidex / c-aff4

An AFF4 C++ implementation.
http://docs.aff4.org
Apache License 2.0
187 stars 34 forks source link

osxpmem "Cannot open file /dev/pmem: No such file or directory" message error is confusing #87

Open jipegit opened 5 years ago

jipegit commented 5 years ago

The error message "E Cannot open file /dev/pmem: No such file or directory" can be confusing, especially because it is the only feedback given to the user in non-verbose or non-debug mode.

In fact it looks like something bad happened during the dump process whereas it is just telling the user /dev/pmem does not exist yet and osxpmem needs to load its driver to use it.

I think the message should be more explicit.

scudette commented 5 years ago

Yes you are right - it is confusing. We typically try to unload the driver and reload it because it might e.g. be an old version of the driver (although the driver is almost never updated anyway). I am not sure if this is a good strategy - perhaps if we find the driver already there we might try to use it anyway? Of course it could always be something completely different which is also called /dev/pmem by accident.

jipegit commented 5 years ago

I thing it is a good strategy. From a general standpoint it looks like a more robust solution to always use the version included in the osxpmem binary ran by the user. I would not return an error to the user if /dev/pmem does not exist though, or maybe only include it in debug mode.