Skip to content
This repository was archived by the owner on May 16, 2025. It is now read-only.

Conversation

Yp3rion
Copy link

@Yp3rion Yp3rion commented Jul 22, 2021

We introduce the linux_slobinfo plugin, which allows to analyze the status of the SLOB memory allocator by providing:

  1. Summary information about the free lists (small, medium, large)
  2. An option to dump the contents of one or all the free lists to file.

The same functionality is also included in the linux_slabinfo plugin and automatically invoked if the presence of the SLOB allocator is detected from the memory dump.

Additionally, we introduce in the linux slabinfo plugin a functionality for the analysis of the status of the SLUB memory allocator which provides summary information about the caches (corresponding to the information provided by the slabinfo command) and is automatically invoked if the presence of SLUB is detected from the memory dump.

NOTE: The SLUB analysis functionality is at the moment only partial and heavily dependent on the specific version of the Linux kernel being used, due to the fact that when attempting to extract Volatility profiles from the system while using more recent versions we obtained profiles missing the definition of some key data structures (we assumed this to be a limitation of the tool used to extract profiles). In particular, we tested on kernel version 3.5.7. For more information, we join a complete .pdf report of our work (Report.pdf).

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants