ikelos
commented
4 months ago Hiya, volatility uses the System.map to locate certain landmarks within memory, if the /proc/kallsyms off the system you're trying to investigate differs from the System.map, that suggests volatility will get the wrong landmarks. Bear in mind that /proc/kallsyms will return a) nothing if you're not root and b) it'll return the addresses as loaded by KASLR, so may well not match the System.map values. The fact that they came out different suggests, ASLR may have been in use, but volatility couldn't find it (Scanners could not determine any ASLR shifts, using 0 for both). You could try using volshell to see whether you can map through to pages you expect, find the initial process and see whether the structure is where it's supposed to be? It sounds like it won't be, but the data being read wasn't far enough wrong to make volatility throw an exception. It's difficult to diagnose the issue more I'm afraid...
yassine955
eve-mem
Abyss-W4tcher
Panchajanya1999
Thank you for taking your time to read this!
I am using a android emulator to create a memory dump, in order for me to create a profile in volatility and then analyze the memory dump. Device: Pixel 7, API:31, Android: 12, ARCH=x86_64
So the first step in the android emulator, is to create a snapshot of the device. Then in the
snapshotfolder, you will see a file calledram.bin. Then I looked at the/proc/version, and this is the outputLinux version 5.10.66-android12-9-00041-gfa9c9074531e-ab7914766 (build-user@build-host) (Android (7284624, based on r416183b) clang version 12.0.5 (https://android.googlesource.com/toolchain/llvm-project c935d99d7cf2016289302412d708641d52d2f7ee), LLD 12.0.5 (/buildbot/src/android/llvm-toolchain/out/llvm-project/lld c935d99d7cf2016289302412d708641d52d2f7ee)) #1 SMP PREEMPT Fri Nov 12 11:36:25 UTC 2021.The next step is to get the kernel source code, by checking out on commit
fa9c9074531e. I then looked up for the Clang compiler, which isr416183b.Kernel source code:
https://android.googlesource.com/kernel/common/+/fa9c9074531eAndroid/Clang compiler:https://android.googlesource.com/platform//prebuilts/clang/host/linux-x86/+/b669748458572622ed716407611633c5415da25c/clang-r416183b/.From this point on, I created a bash script, with the following content:
I know that
clang,llvm-ar,ld.lld.... are present in the compilerbinfolder, and I already placed them in myPATH.It starts compiling, and it doesn't crash or anything, it will result giving me the following files I need:
vmlinux,System.mapandarch/x86/boot/bzImageWhen I check the Linux version present in the
vmlinuxfile, by usingstrings out/vmlinux | grep "Linux version"it results inLinux version 5.10.66-android12-9-00041-gfa9c9074531e-ab7914766 (build-user@build-host) (Android (7284624, based on r416183b) clang version 12.0.5 (https://android.googlesource.com/toolchain/llvm-project c935d99d7cf2016289302412d708641d52d2f7ee), LLD 12.0.5 (/buildbot/src/android/llvm-toolchain/out/llvm-project/lld c935d99d7cf2016289302412d708641d52d2f7ee)) #1 SMP PREEMPT Fri Nov 12 11:36:25 UTC 2021As you can see, the same values and information as the
/proc/version.After this, I create a ISF file with dwarf2json, by doing
./dwarf2json linux --elf [path to vmlinux] --system-map [path to System.map] > [export_name].json. I then place it inside the volatility 3Symbols/linuxfolder. I then dovol.py isfinfo, it results the profile, with the exact name of the/proc/version.Then I scan the ram.bin file, with
linux.pslist, and this is the result:I already checked the differences between
System.mapand thecat /proc/kallsyms. They are different, and I really have no clue what to do at this point.