0

I am trying to ensure that after the use of sensitive parameters, a program zero-es them from all active memory (stack and heap). The simple test I was hoping to perform was to dump the active memory to a flat file while it was running (after it should have zero'd the sensitive parameters). Then i would just binary grep the flat file for the parameter. If it is not there success else failure.

If there are existing tool that can generate just a dump of the stack and heap? No other data like profiling info or symbols.

1 Answer 1

1

What you're describing is usually called a core dump. Your kernel has the ability to trigger these built-in, and it's a common thing to be done automatically (through systemd-coredump) when your program segfaults.

You can also make a core dump manually, using a debugger. gdb is pretty much the standard debugger under linux:

shell> gdb --args /path/to/your/executable --sensible-arg1 -s 2 --sensible-arg3 foobar
[…]
(gdb) start
Temporary breakpoint 1, main(argc=6, argv=…)
(gdb) break the_function_at_which_you_want_to_break
(gdb) continue
[…]
(gdb) generate-core-file
Saved corefile core.123456
(gdb) quit

Now you have a corefile in which you can operate to your liking.

Honestly, I find radare2 to be the tool of choice to inspect process memory (you can do the same as above directly in radare2)

shell> radare2 -d /path/to/your/executable --sensible-arg1 -s 2 --sensible-arg3 foobar
[0x7f44444]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Finding and parsing C++ vtables (avrr)
[x] Skipping type matching analysis in debugger mode (aaft)
[x] Propagate noreturn information (aanr)
[x] Use -AA or aaaa to perform additional experimental analysis.
[0x7f44444]> db sym.the_function_at_which_you_want_to_break
[0x7f44444]> dc
[0x7f44444]> e search.in=dbg.maps
[0x7f44444]> / the_needle_you're_looking_for
0x7f524662c3ed hit1_0 some_more_dirty_stuff the_needle_you're_looking_for
…
[0x7f44444]> s hit1_0
[0x7f524662c3ed]> pr
some_more_dirty_stuff the_needle_you're_looking_for Things go really downhill from here…

Radare2 is nice because it's really meant for memory analysis, and looking for things like cryptographic secrets in memory. For example, it has an excellent entropy display, with which you can often spot things like secret keys in binaries, or compressed data in memory.

On the flip side, I had to look up all the commands myself... it's a highly specialized tool with it's own mechanics.

1
  • definitely going to use these as a fall back, but after looking into this more it seem that i should be able to read from /proc/self/map then /proc/self/mem and get what i need (cause i just need a dump). If i get this working i'll submit an answer; else accept yours.
    – Liam Kelly
    Commented Oct 19, 2022 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .