search

vykt / ptrscan

Pointer chain scanner for Linux.
GNU General Public License v3.0
34 stars 2 forks source link

Verification fails due to #4

Closed vykt closed 2 weeks ago

vykt commented 5 months ago

Affected versions: v0.1.0+

Pointer chain verification fails because memory segments without backing files ('pathname' field in 'man 5 proc') derive their name from their starting address. Because of ASLR, across execution instances these names become invalid, leading to error in interpreting and verifying saved scans.

This bug was introduced in v0.1.0, which changed the names of backing files from '' to their starting address, for regions which lack a backing file.

The solution is probably to treat such segments as belonging to the closest previous segment with a backing file. This approach will detect pointer chains where a pointer chain arrives to a segment that consistently follows some shared object.

vykt commented 5 months ago

Updating libpwu to allow for this behaviour.

vykt commented 2 weeks ago

Solved in v1.0.0.