* [Qemu-devel] [Bug 1605611] [NEW] memsave returns invalid addr when trying to read a 64 bits address
@ 2016-07-22 12:19 Mathieu Tarral
2021-04-22 5:17 ` [Bug 1605611] " Thomas Huth
2021-06-22 4:17 ` Launchpad Bug Tracker
0 siblings, 2 replies; 3+ messages in thread
From: Mathieu Tarral @ 2016-07-22 12:19 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
I am trying to read the first 16 bytes of the System Process on a
Windows XP x64 SP2 using the memsave monitor command.
I cloned the latest release of QEMU, v2.6.0, configured it with
./configure --target-list=i386-softmmu,x86_64-softmmu --enable-sdl
and compiled it.
I first tried to use memsave against Windows XP SP3 32 bits.
This is the procedure i used :
1 - start the VM with :
./i386-softmmu/qemu-system-i386 --enable-kvm -monitor stdio -hda ~/vm/winxp.qcow2
and wait for the desktop
2 - take a physical memory dump with :
pmemsave 0 134217728 dump.raw
3 - call rekall on this memory dump to identify running processes :
rekall -f dump.raw pslist
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
---------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0x80e8fa00 System 4 0 46 148 - False - -
4 - read the first 16 bytes of the System PROCESS struct :
memsave 0x80e8fa00 16 system
5 - check the content with hexdump :
00000000 03 00 1b 00 00 00 00 00 08 fa e8 80 08 fa e8 80
you can recognize here the beginning of an EPROCESS struct.
So on a 32 bits Windows XP OS, it works.
But when i tried on Windows XP SP2 64 bits, rekall gave me the following output :
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
-------------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0xfadffd71d040 System 4 0 51 398 - False - -
And when i tried to read the memory with memsave :
memsave 0xfadffd71d040 16 system
I had the following error :
Invalid addr 0x0000fadffd71d040/size 16 specified
This address is supposed to be valid because I am reading the System EProcess struct, which should not be in the paged pool memory I think.
Also i disabled the paging file to be sure and the bug is still present.
Furthermore the bug is reproducible on the latest QEMU
(01a720125f5e2f0a23d2682b39dead2fcc820066).
Can you confirm that this is a bug ?
Should i check something ?
Thanks !
** Affects: qemu
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1605611
Title:
memsave returns invalid addr when trying to read a 64 bits address
Status in QEMU:
New
Bug description:
I am trying to read the first 16 bytes of the System Process on a
Windows XP x64 SP2 using the memsave monitor command.
I cloned the latest release of QEMU, v2.6.0, configured it with
./configure --target-list=i386-softmmu,x86_64-softmmu --enable-sdl
and compiled it.
I first tried to use memsave against Windows XP SP3 32 bits.
This is the procedure i used :
1 - start the VM with :
./i386-softmmu/qemu-system-i386 --enable-kvm -monitor stdio -hda ~/vm/winxp.qcow2
and wait for the desktop
2 - take a physical memory dump with :
pmemsave 0 134217728 dump.raw
3 - call rekall on this memory dump to identify running processes :
rekall -f dump.raw pslist
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
---------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0x80e8fa00 System 4 0 46 148 - False - -
4 - read the first 16 bytes of the System PROCESS struct :
memsave 0x80e8fa00 16 system
5 - check the content with hexdump :
00000000 03 00 1b 00 00 00 00 00 08 fa e8 80 08 fa e8 80
you can recognize here the beginning of an EPROCESS struct.
So on a 32 bits Windows XP OS, it works.
But when i tried on Windows XP SP2 64 bits, rekall gave me the following output :
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
-------------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0xfadffd71d040 System 4 0 51 398 - False - -
And when i tried to read the memory with memsave :
memsave 0xfadffd71d040 16 system
I had the following error :
Invalid addr 0x0000fadffd71d040/size 16 specified
This address is supposed to be valid because I am reading the System EProcess struct, which should not be in the paged pool memory I think.
Also i disabled the paging file to be sure and the bug is still present.
Furthermore the bug is reproducible on the latest QEMU
(01a720125f5e2f0a23d2682b39dead2fcc820066).
Can you confirm that this is a bug ?
Should i check something ?
Thanks !
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1605611/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug 1605611] Re: memsave returns invalid addr when trying to read a 64 bits address
2016-07-22 12:19 [Qemu-devel] [Bug 1605611] [NEW] memsave returns invalid addr when trying to read a 64 bits address Mathieu Tarral
@ 2021-04-22 5:17 ` Thomas Huth
2021-06-22 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Huth @ 2021-04-22 5:17 UTC (permalink / raw)
To: qemu-devel
The QEMU project is currently considering to move its bug tracking to
another system. For this we need to know which bugs are still valid
and which could be closed already. Thus we are setting older bugs to
"Incomplete" now.
If you still think this bug report here is valid, then please switch
the state back to "New" within the next 60 days, otherwise this report
will be marked as "Expired". Or please mark it as "Fix Released" if
the problem has been solved with a newer version of QEMU already.
Thank you and sorry for the inconvenience.
** Changed in: qemu
Status: New => Incomplete
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1605611
Title:
memsave returns invalid addr when trying to read a 64 bits address
Status in QEMU:
Incomplete
Bug description:
I am trying to read the first 16 bytes of the System Process on a
Windows XP x64 SP2 using the memsave monitor command.
I cloned the latest release of QEMU, v2.6.0, configured it with
./configure --target-list=i386-softmmu,x86_64-softmmu --enable-sdl
and compiled it.
I first tried to use memsave against Windows XP SP3 32 bits.
This is the procedure i used :
1 - start the VM with :
./i386-softmmu/qemu-system-i386 --enable-kvm -monitor stdio -hda ~/vm/winxp.qcow2
and wait for the desktop
2 - take a physical memory dump with :
pmemsave 0 134217728 dump.raw
3 - call rekall on this memory dump to identify running processes :
rekall -f dump.raw pslist
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
---------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0x80e8fa00 System 4 0 46 148 - False - -
4 - read the first 16 bytes of the System PROCESS struct :
memsave 0x80e8fa00 16 system
5 - check the content with hexdump :
00000000 03 00 1b 00 00 00 00 00 08 fa e8 80 08 fa e8 80
you can recognize here the beginning of an EPROCESS struct.
So on a 32 bits Windows XP OS, it works.
But when i tried on Windows XP SP2 64 bits, rekall gave me the following output :
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
-------------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0xfadffd71d040 System 4 0 51 398 - False - -
And when i tried to read the memory with memsave :
memsave 0xfadffd71d040 16 system
I had the following error :
Invalid addr 0x0000fadffd71d040/size 16 specified
This address is supposed to be valid because I am reading the System EProcess struct, which should not be in the paged pool memory I think.
Also i disabled the paging file to be sure and the bug is still present.
Furthermore the bug is reproducible on the latest QEMU
(01a720125f5e2f0a23d2682b39dead2fcc820066).
Can you confirm that this is a bug ?
Should i check something ?
Thanks !
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1605611/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug 1605611] Re: memsave returns invalid addr when trying to read a 64 bits address
2016-07-22 12:19 [Qemu-devel] [Bug 1605611] [NEW] memsave returns invalid addr when trying to read a 64 bits address Mathieu Tarral
2021-04-22 5:17 ` [Bug 1605611] " Thomas Huth
@ 2021-06-22 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Launchpad Bug Tracker @ 2021-06-22 4:17 UTC (permalink / raw)
To: qemu-devel
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1605611
Title:
memsave returns invalid addr when trying to read a 64 bits address
Status in QEMU:
Expired
Bug description:
I am trying to read the first 16 bytes of the System Process on a
Windows XP x64 SP2 using the memsave monitor command.
I cloned the latest release of QEMU, v2.6.0, configured it with
./configure --target-list=i386-softmmu,x86_64-softmmu --enable-sdl
and compiled it.
I first tried to use memsave against Windows XP SP3 32 bits.
This is the procedure i used :
1 - start the VM with :
./i386-softmmu/qemu-system-i386 --enable-kvm -monitor stdio -hda ~/vm/winxp.qcow2
and wait for the desktop
2 - take a physical memory dump with :
pmemsave 0 134217728 dump.raw
3 - call rekall on this memory dump to identify running processes :
rekall -f dump.raw pslist
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
---------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0x80e8fa00 System 4 0 46 148 - False - -
4 - read the first 16 bytes of the System PROCESS struct :
memsave 0x80e8fa00 16 system
5 - check the content with hexdump :
00000000 03 00 1b 00 00 00 00 00 08 fa e8 80 08 fa e8 80
you can recognize here the beginning of an EPROCESS struct.
So on a 32 bits Windows XP OS, it works.
But when i tried on Windows XP SP2 64 bits, rekall gave me the following output :
_EPROCESS Name PID PPID Thds Hnds Sess Wow64 Start Exit
-------------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0xfadffd71d040 System 4 0 51 398 - False - -
And when i tried to read the memory with memsave :
memsave 0xfadffd71d040 16 system
I had the following error :
Invalid addr 0x0000fadffd71d040/size 16 specified
This address is supposed to be valid because I am reading the System EProcess struct, which should not be in the paged pool memory I think.
Also i disabled the paging file to be sure and the bug is still present.
Furthermore the bug is reproducible on the latest QEMU
(01a720125f5e2f0a23d2682b39dead2fcc820066).
Can you confirm that this is a bug ?
Should i check something ?
Thanks !
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1605611/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-06-22 4:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-22 12:19 [Qemu-devel] [Bug 1605611] [NEW] memsave returns invalid addr when trying to read a 64 bits address Mathieu Tarral
2021-04-22 5:17 ` [Bug 1605611] " Thomas Huth
2021-06-22 4:17 ` Launchpad Bug Tracker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.