Linux: Address limitations in determining KASLR shifts by introducing VMCoreInfo support #1332
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This is extremely interesting! Great work! It seems like with a little more digging we can use it to get to kallsyms using this method and then get all the symbols for the image. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request addresses a limitation in the current method for determining KASLR and ASLR shifts by extracting these values from the VMCoreInfo ELF note.
In addition, with the ability to locate the VMCoreInfo ELF note, it became straightforward to also add a plugin to this PR which exports all this information.
The KASLR and ASLR shifts issue
The existing scanning method can inaccurately calculate these shifts in certain situations. For instance, a QEMU memory dump demonstrates this issue.
$ ./vol.py \ -f ./dump_ubuntu180464bit_4.15.0-213-generic_reptile.core \ linux.pslist Volatility 3 Framework 2.11.0 OFFSET (V) PID TID PPID COMM File output Volatility was unable to read a requested page: Page error 0x8c1cbc89b82c in layer layer_name (Page Fault at entry 0x0 in table page directory pointer) * Memory smear during acquisition (try re-acquiring if possible) * An intentionally invalid page lookup (operating system protection) * A bug in the plugin/volatility3 (re-run with -vvv and file a bug) No further results will be producedThis is because the sample being analyzed has not just one
swapperstring match, but four, with the last one being the correct match.This causes the current find_aslr() scanning implementation to incorrectly calculate the KASLR/ASLR shifts, resulting in the entire analysis failing.
VMCoreInfo
The VMCoreInfo was introduced in Linux kernel 2.6.24 to assist user-space tools such as Crash and makedumpfile in analyzing the kernel's memory layout.
It provides all the essential information and kernel parameters needed to analyze a crash memory dump.
Volatility3 using VMCoreInfo
This PR enhances the Volatility 3 framework by adding support for searching the VMCoreInfo ELF note during initialization. It retrieves the ASLR shift and calculates the physical shift. If the VMCoreInfo ELF note is not found, it gracefully falls back to the traditional method.
Pros
Cons
Demo
$ time python3 ./vol.py \ -f ./dump_ubuntu180464bit_4.15.0-213-generic_reptile.core \ linux.pslist Volatility 3 Framework 2.11.0 OFFSET (V) PID TID PPID COMM File output 0x8c1cbc8997c0 1 1 0 systemd Disabled 0x8c1cbc89af80 2 2 0 kthreadd Disabled 0x8c1cbc898000 3 3 2 kworker/0:0 Disabled ... 0x8c1cb7f897c0 1126 1126 1125 bash Disabled real 0m8.990s user 0m7.880s sys 0m0.982sThe VMCoreInfo plugin
Additionally, this PR introduces the VMCoreInfo plugin. It's a particular plugin that works without relying on an external ISF symbol file, needing only the elf.json already included with the framework. It supports any architecture, with the only requirement being that it must be
little-endian. This can be addressed in future updates.Demos
x86-64
aarch64