1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
#!/usr/bin/env python3
# r673: dump the full record page 0x101499000 and search RAM for the ring/push
# VA structures to identify which record is the 16-page push (VA 0x4500000).
import numpy as np, struct, os, time
RAM="/dev/shm/vgpu-guest-ram"
MASK=~0xfff & ((1<<64)-1)
img=open(RAM,"rb")
fsz=os.path.getsize(RAM)
def gpa2off(pa):
if pa < 0x80000000: return pa
if pa < 0x180000000: return 0x80000000+(pa-0x100000000)
return None
def off2gpa(off):
return off if off < 0x80000000 else 0x100000000+(off-0x80000000)
def rd(pa,n):
off=gpa2off(pa)
if off is None or off+n>fsz: return None
img.seek(off); return img.read(n)
print("== full record page 0x101499000 ==")
d=rd(0x101499000,0x1000)
nrec=0
for o in range(0,0x1000,32):
p,f,pa,sz=struct.unpack_from("<QQQQ",d,o)
if p==0 and f==0 and pa==0 and sz==0: continue
nrec+=1
print(" rec[%3d] vmap=%016x flags=%016x pa=%012x size=0x%x" % (o//32,p,f,pa,sz))
print("nonempty records:",nrec)
print()
print("== search RAM for qword 0x4520000 (ring VA) ==")
t0=time.time(); CH=64<<20
for pat_name,pat in (("0x4520000",0x4520000),("0x4500000",0x4500000)):
print("-- pattern %s --" % pat_name)
hits=[]
for pos in range(0,fsz,CH):
img.seek(pos); dd=img.read(min(CH,fsz-pos))
n=len(dd)//8
a=np.frombuffer(dd[:n*8],dtype=np.uint64)
idx=np.nonzero(a==np.uint64(pat))[0]
for i in idx:
hits.append(pos+int(i)*8)
print(" hits=%d (%.1fs)" % (len(hits),time.time()-t0))
for off in hits[:40]:
gpa=off2gpa(off); page=gpa&MASK
# show 32 bytes before/after
dd=rd(page,0x1000)
if not dd: continue
ro=gpa-page
s=max(0,ro-32); e=min(0x1000,ro+64)
print(" gpa=0x%x page=0x%x off=0x%x ctx=%s" % (gpa,page,ro,dd[s:e].hex()))
if len(hits)>40: print(" ... %d more" % (len(hits)-40))
|
