读取物理地址值

【问题标题】：Reading Physical address value读取物理地址值
【发布时间】：2018-01-09 12:38:00
【问题描述】：

玩 Meltdown/Spectre。

有这个小程序：

pass.c

#include <stdio.h>

int main(void) {

   char buf[7];

   printf("Password : ");
   fgets(buf, 7, stdin);
   sscanf(buf, "%s", buf);
   printf("addr %p\n",buf);
   while(1)
   {
   }
   printf("Password : %s\n",buf);
   return 0;
}

想从内存中读取物理映射的地址值。

./pass 
Password : secret
addr 0x7ffc9098b780

发现这个程序可以从用户空间获取虚拟地址的物理地址：

https://github.com/dwks/pagemap

输出：

./pagemap2 18135
=== Maps for pid 18135
0x400000           : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x600000           : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x601000           : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /home/user/spectre-meltdown-poc/pass
0x206a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [heap]
0x206b000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206c000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206d000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206e000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x206f000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2070000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2071000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2072000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2073000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2074000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2075000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2076000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2077000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2078000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2079000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207b000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207c000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207d000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207e000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x207f000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2080000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2081000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2082000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2083000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2084000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2085000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2086000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2087000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2088000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x2089000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x208a000          : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [heap]
0x7f27b2365000     : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b253d000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b253e000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b253f000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2563000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2564000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7f27b2565000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b2566000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library /lib/x86_64-linux-gnu/ld-2.23.so
0x7f27b2567000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library 
0x7ffe2498c000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498d000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498e000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2498f000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24990000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24991000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24992000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24993000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24994000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24995000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24996000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24997000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24998000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe24999000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499a000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499b000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499c000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499d000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499e000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe2499f000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a0000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a1000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a2000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a3000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a4000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a5000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a6000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a7000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a8000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249a9000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249aa000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249ab000     : pfn 0                soft-dirty 0 file/shared 0 swapped 0 present 0 library [stack]
0x7ffe249ac000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 1 library [stack]
0x7ffe249ca000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vvar]
0x7ffe249cb000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vvar]
0x7ffe249cc000     : pfn 0                soft-dirty 1 file/shared 1 swapped 0 present 1 library [vdso]
0x7ffe249cd000     : pfn 0                soft-dirty 1 file/shared 0 swapped 0 present 0 library [vdso]

我的“秘密”字符串在哪里？在堆栈上？我应该尝试哪个物理地址？

谢谢，

【问题讨论】：

  • 我认为您误解了有关 Meltdown / Spectre 的一些内容。没关系，因为这是您的应用程序的秘密。 Meltdown / Spectre 是关于寻找其他程序或内核的秘密。
  • 好吧，我想既然秘密在内存中（进程的虚拟内存），崩溃将允许我从中读取它，但我需要知道该虚拟地址的物理地址。我假设秘密是作为一个用户运行的，我以其他用户的身份利用崩溃
  • 我有 Meltdown Proof of Cocept，据我了解，我需要提供物理地址才能读取。因此我的问题是，如何从虚拟地址中找出物理地址

标签： linux memory memory-management


【解决方案1】：

使用 Linux 调试器，例如 Windows 的 WinDbg。 Linux 也应该有一个类似的调试器，可能是gdb。

用户模式部分：

0:002> !heap -s
SEGMENT HEAP ERROR: failed to initialize the extention
LFH Key                   : 0x0000002452efc0db
Termination on corruption : ENABLED
          Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast 
                            (k)     (k)    (k)     (k) length      blocks cont. heap 
-------------------------------------------------------------------------------------
0000000000400000 00000002    2048   1104   2048    690     6     2    0      0   LFH

0:002> dd 400000
00000000`00400000  00000000 00000000 8d12536f 01001481
00000000`00400010  ffeeffee 00000000 040c0018 00000000
00000000`00400020  00400128 00000000 00400000 00000000
00000000`00400030  00400000 00000000 00000100 00000000
00000000`00400040  00400a80 00000000 00500000 00000000
00000000`00400050  00000042 00000001 00000000 00000000
00000000`00400060  004bdfe0 00000000 004bdfe0 00000000
00000000`00400070  00000002 00000000 00000000 00100000

内核模式部分：

0: kd> !process 0 0 notepad.exe    
PROCESS fffffa801d440640
    SessionId: 1  Cid: 0fec    Peb: 7fffffdb000  ParentCid: 0dec
    DirBase: 4e7480000  ObjectTable: fffff8a008f3ddd0  HandleCount:  66.
    Image: notepad.exe

0: kd> .process  fffffa801d440640
Implicit process is now fffffa80`1d440640

0: kd> !vtop 0 400000
Amd64VtoP: Virt 00000000`00400000, pagedir 00000004`e7480000
Amd64VtoP: PML4E 00000004`e7480000
Amd64VtoP: PDPE 00000006`4519b000
Amd64VtoP: PDE 00000006`4521e010
Amd64VtoP: PTE 00000006`51db9000
Amd64VtoP: Mapped phys 00000006`45c3a000
Virtual address 400000 translates to physical address 645c3a000.

0: kd> !dd 645c3a000
#645c3a000 00000000 00000000 8d12536f 01001481
#645c3a010 ffeeffee 00000000 040c0018 00000000
#645c3a020 00400128 00000000 00400000 00000000
#645c3a030 00400000 00000000 00000100 00000000
#645c3a040 00400a80 00000000 00500000 00000000
#645c3a050 00000042 00000001 00000000 00000000
#645c3a060 004bdfe0 00000000 004bdfe0 00000000
#645c3a070 00000002 00000000 00000000 00100000

如您所见，虚拟用户模式地址00000000'00400000 中的值与物理地址645c3a000 中的值相同。您找到了正确的物理地址，您可以随意使用它。

【讨论】：

  • 很好的答案。在 WinDbg 中似乎很容易！我认为在 GDB 中你只能使用虚拟地址。将尝试在 Linux 下找到它（使用 /proc/PID/pagemap）。将添加评论它将如何进行。
  • @android_dev: 如果你知道的话，你也可以发布自己的答案，甚至接受那个答案作为正确的答案。
  • 找到了一个名为 pagemap 的工具来执行此操作。 github.com/dwks/pagemap
猜你喜欢
  • 2016-03-12
  • 2020-10-06
  • 1970-01-01
  • 1970-01-01
  • 2012-12-25
  • 2011-05-11
  • 2015-05-04
  • 2013-05-05
  • 2013-10-29
相关资源
最近更新 更多
热门标签
Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode