search

decaf-project / DECAF

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.
GNU General Public License v3.0
807 stars 168 forks source link

Where does the parameter proc_exec_connector in procinfo.ini file come from? #91

Closed newthis closed 4 years ago

newthis commented 4 years ago

I compiled the procinfo.c into the linux kernel, and the dmesg log is below, no proc_exec_connector parameter is found. So I want to ask how can I figure out this value.

[ 0.220574] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.221914] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. [ 0.222650] romfs: ROMFS MTD (C) 2007 Red Hat, Inc. [ 0.227781] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 0.228425] io scheduler noop registered [ 0.228680] io scheduler cfq registered (default) [ 0.229279] strName = 4.1.17 [ 0.229279] init_task_addr = 3227491000 [ 0.229279] init_task_size = 872 [ 0.229279] ts_tasks = 292 [ 0.229279] ts_pid = 400 [ 0.229279] ts_tgid = 404 [ 0.229279] ts_group_leader = 432 [ 0.229279] ts_thread_group = 488 [ 0.229279] ts_real_parent = 408 [ 0.229279] ts_mm = 300 [ 0.229279] ts_stack = 4 [ 0.230525] module_name = 12 [ 0.230525] module_size = 208 [ 0.230525] module_init = 200 [ 0.230525] module_list = 4 [ 0.231035] ts_real_cred = 616 [ 0.231035] ts_cred = 620 [ 0.231035] ts_comm = 624 [ 0.231035] cred_uid = 4 [ 0.231035] cred_gid = 8 [ 0.231035] cred_euid = 20 [ 0.231035] cred_egid = 24 [ 0.231725] mm_mmap = 0 [ 0.231725] mm_pgd = 32 [ 0.231725] mm_arg_start = 136 [ 0.231725] mm_start_brk = 124 [ 0.231725] mm_brk = 128 [ 0.231725] mm_start_stack = 132 [ 0.232340] vma_vm_start = 0 [ 0.232340] vma_vm_end = 4 [ 0.232340] vma_vm_next = 8 [ 0.232340] vma_vm_file = 80 [ 0.232340] vma_vm_flags = 40 [ 0.232340] vma_vm_pgoff = 76 [ 0.233120] file_dentry = 12 [ 0.233120] file_inode = 40 [ 0.233120] dentry_d_name = 24 [ 0.233120] dentry_d_iname = 44 [ 0.233120] dentry_d_parent = 16 [ 0.233120] ti_task = 12 [ 0.233120] inode_ino = 28 [ 0.304148] vma_link = 3221761964 [ 0.304378] vma_adjust = 3221762088 [ 0.304517] remove_vma = 3221760012 [ 0.304670] modules = 3227509296 [ 0.304763] trim_init_extable = 3222849576

newthis commented 4 years ago

solved

Canti17 commented 2 years ago

Hi @newthis, can you explain how you solved it? My armel kernel image does not retrieve the proc_exec_connector parameter with some others. Thanks