gdb-pt-dump
is a gdb script to examine the address space of a QEMU-based virtual machine.
Although this is also possible via the monitor
and pwndbg
interfaces, working with them is cumbersome, slow and sometimes they produce erroneous results.
- Dumping a page table from a specific guest physical address.
- Merging semantically-similar contiguous memory.
- Provide detailed architectural information: writeable, executable, U/S, cacheable, write-back, XN, PXN, etc
- Cache collected information for future filtering and printing.
- Filter page table information via page attributes (x, w, u, s, ...) and virtual addresses (before, after, between)
- Search memory very fast using
/proc/QEMU_PID/mem
. Search for string, u8, u4 Search is applied after filter. - Filter-out search results by address alignment. Useful for filtering-out SLAB allocations.
- Try to determine KASLR information by examining the address space. Currently, only the virtual and physical image offsets.
The script is standalone.
For now, do source PATH_TO_PT_DUMP/pt.py
.
For details, just do help pt
in gdb.
Old QEMU versions seem to not provide access to privileged registers like cr3. Thus, the page table address would need to be retrieved in some other way.
Only x86-64
and aarch64
supported.
There are still some todos left for aarch64
.