de4dcr0w / green-dill Goto Github PK

Hi,

Great work on the plugin. I'd like to integrate some of your work into GEF which already provide some features for kernel debugging. However, there's no license to your repository. Do you care to add one?

Thanks,

Hi !

First of all, thank you very much for this plugin, it might be very helpful for the task I'm trying to achieve.

My setup is the following: I run a Ubuntu 16.04 VM with Linux Kernel version 4.8.0-36-generic in QEMU, with GDB attached. Everything works fine, but as soon as I activate the salt plugin, it crashes.

More precisely, I first load the plugin with source green-dill/dill.py, then I activate the trace function with dill run and dill my_program, where my_program is a userland program that I didn't start yet, and finally I continue the kernel execution with continue. At this point, the kernel crashes instantly and the error(s) in lx-dmesg are all of the type BUG: unable to handle kernel paging request at ADDRESS, where ADDRESS are addresses such as 000000002080020, for example. Also, the faulting instruction is at kmem_cache_alloc+0xe4/0x1b0. Here is the complete backtrace: backtrace.txt.

I don't understand what's the root cause of this as the plugin doesn't seem to alter values in the memory, so it's weird that the kernel tries to access invalid addresses.

Do you have any ideas ?

Thank you very much,
Sacha