Update T1003.007 dump_heap.py: refactor FreeBSD heap memory dumping logic #3231
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Details:
Previously on FreeBSD, i suspect the branch contained a problematic variable assignment error:
mem_start = mem_stopin my tests this often resulted in a line 37 error:
OSError: [Errno 14] Bad address(*as also seen in my Testing area below)Dump_heap.py now:
dumps the corresponding region from /proc//mem.
procstat -v <pid>to more reliably locate a heap-like rw mappingand dumps that region via /proc//mem.
These changes make the T1003.007 Python atomic more portable across
Linux and FreeBSD while keeping the behavior aligned with the existing
/proc-based credential dumping scenario. I still have to note that error
handling could be done even better, this was on the rather critical side!
Testing:
Testing was performed locally/manually on a FreeBSD 14.1-RELEASE releng/14.1-n267679-10e31f0946d8 GENERIC amd64:

*
my patch:
heap_maker.py script:
Associated Issues: