[panda-users] Memory callbacks and x86_64

[Bridgey theGeek]

Hi Vincent,

Out of interest, did you try your code with an i386 environment? Did that
work?

I don't have an x86_64 guest to hand, but your plugin code, copied straight
from your gist worked as I'd expect it to for i386:
testplugin loading
tracking range [40000000, 80000000)
loading snapshot
... done.
opening nondet log for read :   /slw/notepad01-rr-nondet.log
got a write at 2968c8c
got a write at 2968c88
got a write at 2968c84
got a write at 2968c80
got a write at 2968c7c
got a write at 2968c6c
got a write at 2968c68
got a write at 2968c64
got a read at 2968c98
got a read at 2968c94
got a read at 296bc00

Adam

On Fri, 23 Feb 2018 at 22:43 Vincent Lee <vincent_lee at utexas.edu> wrote:

> Hello,
>
> I am trying to setup PANDA for monitoring the physical memory accesses of
> a x86_64 guest.
> I've written a toy test plugin [0], and have also tried running the
> stringsearch plugin looking for the hostname of the machine, as well as
> generic phrases likely to show up in logs, such as "Arch Linux" or "memory".
>
> However, no results are returned from stringsearch, and my test plugin
> records no accesses on any part of memory. PANDA is built from 8730ffb on
> Ubuntu 16.04 with the install_ubuntu script.
>
> Have I set up my environment incorrectly, or are memory callbacks not
> supported on x86_64?
> If they are not supported, is there a similar tool I can use to trace
> guest physical memory accesses on x86_64?
>
> Thanks in advance,
> Vincent
>
>
> [0] https://gist.github.com/williewillus/f0c96d8652e0f8b538da0c162c82069c
>
> _______________________________________________
> panda-users mailing list
> panda-users at mit.edu
> http://mailman.mit.edu/mailman/listinfo/panda-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/panda-users/attachments/20180224/774553ce/attachment.html