bitdefender / hvmi

Hypervisor Memory Introspection Core Library
https://bitdefender.github.io/hvmi-blog/
Apache License 2.0
633 stars 67 forks source link

r2cami hangs when downloading PDBs #22

Open logankonopatzke opened 4 years ago

logankonopatzke commented 4 years ago

Using the command python3 r2cami.py -k ntoskrnl.exe -n ntdll.dll -o windows_support.yaml I'm attempting to automatically generate the support files for CAMI. The process hangs when downloading the necessary PDB files.

The following is shown in console: Attempting to download compressed pdb in /home/testuser/.local/share/radare2/pdb/ntkrnlmp.pdb/512C583E636270A8A26A461F4B383A091/ntkrnlmp.pd_ Falling back to uncompressed pdb Attempting to download uncompressed pdb in /home/testuser/.local/share/radare2/pdb/ntkrnlmp.pdb/512C583E636270A8A26A461F4B383A091/ntkrnlmp.pdb

emuresan commented 4 years ago

That's a bug I've encountered myself, but unfortunately it's not on our end. This same scenario can sometimes be reproduced by downloading the pdb using the radare shell (idpd) or the radare command line utilities (rabin2 -PP ...). Sadly, I don't know of any fix in the lastest master, but usually it works after a couple of tries. If that still doesn't work, you can compute the url from where radare attempts to download the pdb using the GUID and the debug file name that's provided in those error logs and download it manualy from the same location from where radare does. You should also place it in the same location where radare attempts to since r2cami will check for an existing pdb there before attempting to download one. curl -L https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/512C583E636270A8A26A461F4B383A091/ntkrnlmp.pdb -o /home/testuser/.local/share/radare2/pdb/ntkrnlmp.pdb/512C583E636270A8A26A461F4B383A091/ntkrnlmp.pdb

logankonopatzke commented 4 years ago

Ah thank you for clarifying. Manually downloading it seems to work. Should we leave this issue open for future reference? (I'll try to submit a fix to radare if I find the root of the problem)