Skip to content

Conversation

@vl43den
Copy link
Contributor

@vl43den vl43den commented Nov 17, 2025

Details:

Previously on FreeBSD, i suspect the branch contained a problematic variable assignment error:

mem_start = mem_stop

in my tests this often resulted in a line 37 error:

OSError: [Errno 14] Bad address (*as also seen in my Testing area below)

Dump_heap.py now:

  • Accepts a PID and output filepath as arguments.
  • On Linux branch it still parses /proc//maps to locate the [heap] mapping and
    dumps the corresponding region from /proc//mem.
  • On FreeBSD, uses procstat -v <pid> to more reliably locate a heap-like rw mapping
    and dumps that region via /proc//mem.

These changes make the T1003.007 Python atomic more portable across
Linux and FreeBSD while keeping the behavior aligned with the existing
/proc-based credential dumping scenario. I still have to note that error
handling could be done even better, this was on the rather critical side!

Testing:

Testing was performed locally/manually on a FreeBSD 14.1-RELEASE releng/14.1-n267679-10e31f0946d8 GENERIC amd64:
*
image

my patch:

image

heap_maker.py script:

import time
import os
#large list allocation to ensure a heap segment exists
data = [i for i in range(1000000)]
print(f"Heap Maker running with PID: {os.getpid()}")
# Keep the script running
time.sleep(3600)

Associated Issues:

refactored dump_heap logic for freebsd to reliably find process and dump w success
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant