{"action":"created","issue":{"url":"https://api.github.com/repos/google/rekall/issues/392","repository_url":"https://api.github.com/repos/google/rekall","labels_url":"https://api.github.com/repos/google/rekall/issues/392/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/392/comments","events_url":"https://api.github.com/repos/google/rekall/issues/392/events","html_url":"https://github.com/google/rekall/issues/392","id":312713057,"number":392,"title":"VMI: Invalid address in read()","user":{"login":"Wenzel","id":964610,"avatar_url":"https://avatars2.githubusercontent.com/u/964610?v=4","gravatar_id":"","url":"https://api.github.com/users/Wenzel","html_url":"https://github.com/Wenzel","followers_url":"https://api.github.com/users/Wenzel/followers","following_url":"https://api.github.com/users/Wenzel/following{/other_user}","gists_url":"https://api.github.com/users/Wenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/Wenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wenzel/subscriptions","organizations_url":"https://api.github.com/users/Wenzel/orgs","repos_url":"https://api.github.com/users/Wenzel/repos","events_url":"https://api.github.com/users/Wenzel/events{/privacy}","received_events_url":"https://api.github.com/users/Wenzel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-09T22:40:11Z","updated_at":"2018-05-07T14:39:54Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Here is the backtrace you asked when the addr is out of the mappings:\r\n\r\n~~~\r\nInvalid addr 0x9000000330f780 |                  \r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/vmi.py(71)read()\r\n-> buffer, _ = self.vmi.read_pa(addr, size, padding=True)\r\n(Pdb) bt\r\n  /home/tarrma/tmp/venv/bin/rekall(11)<module>()\r\n-> load_entry_point('rekall-core', 'console_scripts', 'rekall')()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/rekal.py(98)main()\r\n-> user_session=user_session)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/args.py(432)parse_args()\r\n-> command_metadata = user_session.plugins.Metadata(plugin_name)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(142)Metadata()\r\n-> return self.plugin_db.GetActivePlugin(name)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugin.py(982)GetActivePlugin()\r\n-> if plugin_cls.is_active(self.session):\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugin.py(434)is_active()\r\n-> profile = (session.profile != None and\r\n  /home/tarrma/fsecure/rekall/rekall-lib/rekall_lib/utils.py(1093)__get__()\r\n-> return super(safe_property, self).__get__(*args, **kwargs)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(1066)profile()\r\n-> res = self.GetParameter(\"profile_obj\")\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(768)GetParameter()\r\n-> result = self._RunParameterHook(item)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(807)_RunParameterHook()\r\n-> result = hook.calculate()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(762)calculate()\r\n-> profile_obj = self.ScanProfiles()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(630)ScanProfiles()\r\n-> return self._ScanProfiles()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(688)_ScanProfiles()\r\n-> profile = method.DetectFromHit(hit, offset, address_space)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(383)DetectFromHit()\r\n-> return self._test_rsds(rsds)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(388)_test_rsds()\r\n-> profile = self.VerifyProfile(\"nt/GUID/%s\" % rsds.GUID_AGE)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(362)VerifyProfile()\r\n-> return self._ApplyFindDTB(self.find_dtb_impl, profile)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/guess_profile.py(99)_ApplyFindDTB()\r\n-> for address_space in find_dtb_plugin.address_space_hits():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/common.py(129)address_space_hits()\r\n-> address_space = self.VerifyHit(dtb)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/common.py(190)VerifyHit()\r\n-> if (address_space.vtop(kuser_shared.obj_offset) and\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/intel.py(316)vtop()\r\n-> aligned_vaddr, PhysicalAddressDescriptorCollector(self.session))\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/amd64.py(79)describe_vtop()\r\n-> pml4e_value = self.read_pte(pml4e_addr, collection=collection)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/intel.py(583)read_pte()\r\n-> string = self.base.read(addr, 8)\r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/vmi.py(71)read()\r\n-> buffer, _ = self.vmi.read_pa(addr, size, padding=True)\r\n(Pdb) \r\n~~~\r\n\r\nthe call is `string = self.base.read(addr, 8)` in [read_pte](https://github.com/google/rekall/blob/master/rekall-core/rekall/plugins/addrspaces/intel.py#L583)\r\n\r\nAny ideas ?\r\n\r\nThanks !"},"comment":{"url":"https://api.github.com/repos/google/rekall/issues/comments/387086286","html_url":"https://github.com/google/rekall/issues/392#issuecomment-387086286","issue_url":"https://api.github.com/repos/google/rekall/issues/392","id":387086286,"user":{"login":"Wenzel","id":964610,"avatar_url":"https://avatars2.githubusercontent.com/u/964610?v=4","gravatar_id":"","url":"https://api.github.com/users/Wenzel","html_url":"https://github.com/Wenzel","followers_url":"https://api.github.com/users/Wenzel/followers","following_url":"https://api.github.com/users/Wenzel/following{/other_user}","gists_url":"https://api.github.com/users/Wenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/Wenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wenzel/subscriptions","organizations_url":"https://api.github.com/users/Wenzel/orgs","repos_url":"https://api.github.com/users/Wenzel/repos","events_url":"https://api.github.com/users/Wenzel/events{/privacy}","received_events_url":"https://api.github.com/users/Wenzel/received_events","type":"User","site_admin":false},"created_at":"2018-05-07T14:39:54Z","updated_at":"2018-05-07T14:39:54Z","author_association":"CONTRIBUTOR","body":"Thanks for your reply.\r\nIf i try again today (I'm on Xen), i can reproduce the bug by setting a RAM size >= 4G:\r\n~~~\r\nLibVMI Version 0.11.0\r\nLibVMI Driver Mode 0\r\n--completed driver init.\r\n--got id from name (xenwin7 --> 12)\r\n**set image_type = xenwin7\r\n**set allocated_ram_size = 10004b000, max_physical_address = 0x11004f000\r\n  _EPROCESS            name          pid   ppid  thread_count handle_count session_id wow64    process_create_time       process_exit_time    \r\n-------------- -------------------- ----- ------ ------------ ------------ ---------- ------ ------------------------ ------------------------\r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/vmi.py(70)read()\r\n-> print('Invalid addr {}'.format(hex(addr)))\r\n(Pdb) bt\r\n  /home/tarrma/tmp/venv/bin/rekall(11)<module>()\r\n-> load_entry_point('rekall-core', 'console_scripts', 'rekall')()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/rekal.py(104)main()\r\n-> user_session.RunPlugin(plugin_cls, **config.RemoveGlobalOptions(flags))\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(870)RunPlugin()\r\n-> result = plugin_obj.render(ui_renderer) or plugin_obj\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugin.py(761)render()\r\n-> for row in self.collect():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/taskmods.py(71)collect()\r\n-> for task in self.filter_processes():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/common.py(452)filter_processes()\r\n-> for proc in self.list_eprocess():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/common.py(503)list_eprocess()\r\n-> for proc in self.session.GetParameter(\"pslist_%s\" % method):\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(768)GetParameter()\r\n-> result = self._RunParameterHook(item)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/session.py(807)_RunParameterHook()\r\n-> result = hook.calculate()\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/windows/common.py(632)calculate()\r\n-> \"_EPROCESS\", \"ActiveProcessLinks\"):\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/overlays/basic.py(543)list_of_type()\r\n-> for lst in self.find_all_lists():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/overlays/basic.py(529)find_all_lists()\r\n-> if Blink.is_valid():\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/obj.py(782)is_valid()\r\n-> return self.v() != 0\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/obj.py(760)v()\r\n-> return Pointer.integer_to_address(self._proxy.v())\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/obj.py(656)v()\r\n-> data = self.obj_vm.read(self.obj_offset, self.obj_size)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/addrspace.py(589)read()\r\n-> buf = self._read_chunk(addr, length)\r\n  /home/tarrma/fsecure/rekall/rekall-core/rekall/addrspace.py(554)_read_chunk()\r\n-> return self.base.read(paddr, to_read)\r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/plugins/addrspaces/vmi.py(70)read()\r\n-> print('Invalid addr {}'.format(hex(addr)))\r\n(Pdb) \r\n~~~\r\n\r\nAnd i don't have `intel.py` or `amd64.py` in my callstack.\r\n\r\nI think i should try with KVM to see if this changes anything.\r\nBut for the meantime, does this stracktrace help you ?\r\n\r\nIf i go up and try to print the `addr` parameter to `read_chunk`\r\n~~~\r\n(Pdb) u\r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/addrspace.py(554)_read_chunk()\r\n-> return self.base.read(paddr, to_read)\r\n(Pdb) u\r\n> /home/tarrma/fsecure/rekall/rekall-core/rekall/addrspace.py(589)read()\r\n-> buf = self._read_chunk(addr, length)\r\n(Pdb) p addr\r\n275427725605824\r\n(Pdb) p hex(addr)\r\n'0xfa8003befbc0'\r\n(Pdb) \r\n~~~"}}
{"actor":{"display_login":"Wenzel"}}