martinradev / gdb-pt-dump

MIT License
138 stars 26 forks source link

Python Exception <class 'PermissionError'> [Errno 13] Permission denied #4

Closed Mech0n closed 3 years ago

Mech0n commented 3 years ago

I'm trying to use this tools , but i get a error like this :

Python Exception <class 'PermissionError'> [Errno 13] Permission denied: '/proc/12171/mem':
Error occurred in Python: [Errno 13] Permission denied: '/proc/12171/mem'

How can I deal with it? Thanks.

martinradev commented 3 years ago

Run sudo gdb.... The scripts opens /proc/QEMU_PID/mem to have access to the virtual memory of the qemu process. When reading big chunks of memory, the script would translate the GVA or GPA of the buffer in the VM to a Host Virtual Address. The script can then read the memory of the VM directly through QEMU's virtual memory which is way faster than going through the gdb stubs exposed by qemu. This works because QEMU would mmap the VM's apertures into its address space and then one can simply pread proc mem node.

martinradev commented 3 years ago

This is a big speedup for parsing page tables or searching through memory.

Mech0n commented 3 years ago

Thanks.

gsingh93 commented 1 year ago

For anyone else running into this, depending on your system this may be an alternative:

echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope