2,257
edits
Changes
Jump to navigation
Jump to search
Line 15:
Line 15: − +
Memory dumping and restoring (edit)
Revision as of 12:13, 24 February 2015
, 12:13, 24 February 2015→Basic C/R
* Ptrace SEIZE that is used to grab pages from task's VM into pipe (with vmsplice)
* Ptrace SEIZE that is used to grab pages from task's VM into pipe (with vmsplice)
The latter step deserves some better explanation. So in order to drain memory from task we first generate the bitmap of pages needed to be dumped (using the smaps, map_files and pagemap from proc). Then we create a set of pipe-s to put pages into. Then we infect the process with [[parasite code]] which, in turn, gets the pipes and <code>vmsplice</code>-s the required pages into it. Then we <code>splice</code> the pages from pipes into image files.
The latter step deserves some better explanation. So in order to drain memory from task we first generate the bitmap of pages needed to be dumped (using the smaps, map_files and pagemap from proc). Then we create a set of pipe-s to put pages into. Then we infect the process with [[parasite code]] which, in turn, gets the pipes and <code>vmsplice</code>-s the required pages into it. Then we <code>splice</code> the pages from pipes into [[memory dumps|image files]].
=== Restoring ===
=== Restoring ===