sashs / Ropper

Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
https://scoding.de/ropper
BSD 3-Clause "New" or "Revised" License
1.87k stars 206 forks source link

Excessive Memory Usage (9GB) in Ropper When Loading from Cache with a 16MB Coredump File and '--single' Option (22MB Cache) #173

Open izeroo opened 1 year ago

izeroo commented 1 year ago

I observed that the --single option in ropper does not effectively limit the process to a single instance. Despite using this option, multiple processes are visible in tools like htop. Additionally, the memory usage appears to be abnormal, as it exhausts all available system memory, leading to an Out-of-Memory (OOM) termination. The issue is particularly pronounced when loading from cache with a 16MB coredump file and a 22MB cache. It's important to note that the problem did not occur initially when the cache was not available. The abnormal memory consumption seem to be related to the introduction of caching. Any insights or solutions to address this memory usage anomaly would be greatly appreciated.

➜  DSM5.2 DS5615xs file core.25661
core.25661: ELF 32-bit LSB core file, Intel 80386, version 1 (SYSV), SVR4-style, from '/usr/syno/bin/findhostd', real uid: 0, effective uid: 0, real gid: 0, effective gid: 0, execfn: '/usr/syno/bin/findhostd', platform: 'i686'
➜  DSM5.2 DS5615xs du -h ~/.ropper/cache/*
1.8M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_1
1.7M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_10
984K    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_11
1.4M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_12
1.4M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_13
1.6M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_14
548K    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_15
408K    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_16
2.0M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_2
1.7M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_3
1.5M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_4
924K    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_5
1.6M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_6
2.0M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_7
1.5M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_8
1.5M    /home/zero/.ropper/cache/b40c3849296e4df33bf61ed9cf2b8ba991313ca6337499ea434c3dda5ee758be_x86_6_all_3_9

core.zip

sashs commented 1 year ago

Many thanks. I will check that.