You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I started a run of pagecache.Files against all samples with the d_inode in try/except like in #1516 so that any deeper bugs would be exposed. This is the first of those.
The pagecache plugin does the instance.pointer.member pattern on i_mappings of inode and causes a backtrace on samples.
25-01-04 17:26:59 volatility3.cli DEBUG Traceback (most recent call last):
File "/home/ub/volatility3/volatility3/cli/__init__.py", line 501, in run
renderer.render(grid)
File "/home/ub/volatility3/volatility3/cli/text_renderer.py", line 232, in render
grid.populate(visitor, outfd)
File "/home/ub/volatility3/volatility3/framework/renderers/__init__.py", line 240, in populate
for level, item in self._generator:
File "/home/ub/volatility3/volatility3/framework/plugins/linux/pagecache.py", line 354, in format_fields_with_headers
for level, fields in generator:
File "/home/ub/volatility3/volatility3/framework/plugins/linux/pagecache.py", line 326, in _generator
inode_out = inode_in.to_user(vmlinux_layer)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/plugins/linux/pagecache.py", line 78, in to_user
cached_pages = int(self.inode.i_mapping.nrpages)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 453, in __getattr__
return getattr(self.dereference(), attr)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 961, in __getattr__
member = template(context=self._context, object_info=object_info)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/templates.py", line 96, in __call__
return self.vol.object_class(
^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 168, in __new__
value = cls._unmarshall(context, data_format, object_info)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/objects/__init__.py", line 202, in _unmarshall
data = context.layers.read(
^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/interfaces/layers.py", line 635, in read
return self[layer].read(offset, length, pad)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/linear.py", line 45, in read
for offset, _, mapped_offset, mapped_length, layer in self.mapping(
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 302, in mapping
for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 358, in _mapping
chunk_offset, page_size, layer_name = self._translate(offset)
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 162, in _translate
entry, position = self._translate_entry(offset)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/ub/volatility3/volatility3/framework/layers/intel.py", line 210, in _translate_entry
raise exceptions.PagedInvalidAddressException(
volatility3.framework.exceptions.PagedInvalidAddressException: Page Fault at entry 0x0 in table page directory pointer
The text was updated successfully, but these errors were encountered:
I started a run of pagecache.Files against all samples with the
d_inode
in try/except like in #1516 so that any deeper bugs would be exposed. This is the first of those.The pagecache plugin does the
instance.pointer.member
pattern oni_mappings
of inode and causes a backtrace on samples.Note that my PR for the broken cached file hanlding (https://github.com/volatilityfoundation/volatility3/pull/1516/files#diff-dc8047d2b21ebae7092368b7efe49ec11221e192735929c2be49998e31335956R2517) fixes this in
get_pages
, but it looks likei_mapping
should be sent through a newget_i_mapping()
like we discussed for dentry, superblock, etc. since it will be a problem every time its accessed.We don't need PR explosion for no reason, so if the fix for this (accessor + switching current calls to it) becomes part of #1516 then that is fine.
Sample: broken_rhel_load_as_2.zip
Sample 2: gmemday1.dmp
Sample 3: Tillary_email_server.raw
Plugin: linux.pagecache.Files
The text was updated successfully, but these errors were encountered: