Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix procdump (bis) #1562

Merged
merged 12 commits into from
Apr 22, 2024
Merged

Fix procdump (bis) #1562

merged 12 commits into from
Apr 22, 2024

Conversation

rkervella
Copy link
Member

Fix the Windows procdump command implementation by removing the dynamic heap re-allocation of the dump buffer. This caused issues when dumping large processes. This PR addresses that by pre-allocating memory of the size of the current process's memory footprint plus an additional 20 MB safety net in case the target process's memory grows between the start and stop of the memory dump.
It's a bit less elegant, but a lot safer.

@rkervella rkervella requested a review from a team as a code owner January 17, 2024 22:59
moloch--
moloch-- previously approved these changes Jan 18, 2024
@rkervella
Copy link
Member Author

Do not merge yet. Fixed the issue in debug mode, but somehow it crashes in non-debug implants.

@rkervella rkervella marked this pull request as draft January 19, 2024 22:26
@rkervella rkervella marked this pull request as ready for review April 22, 2024 20:02
@rkervella
Copy link
Member Author

rkervella commented Apr 22, 2024

Finally found a way to make this work. Ready for review. Final solution doesn't rely on preallocating memory with HeapAlloc, we just use Go native types and a sync.Map to store the dump in chunks that are then reassembled once MiniDumpWriteDump completes. I had some concurrency issues that only occured in non-debug mode (because --debug builds with gcflags that disable optimisation and inlining), this is now fixed with this approach.

@rkervella rkervella merged commit 97497c9 into master Apr 22, 2024
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants