Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

broken on 32-bit kernels #33

Open
chrf01 opened this issue May 3, 2024 · 4 comments
Open

broken on 32-bit kernels #33

chrf01 opened this issue May 3, 2024 · 4 comments

Comments

@chrf01
Copy link

chrf01 commented May 3, 2024

broken on 32-bit x86 kernel

pwndbg> pt
Cannot get qemu-system pid Unknown arch. Message: The target architecture is set to "auto" (currently "i386").
@martinradev
Copy link
Owner

Thanks for the report

Can you please share this info:

qemu version
launch command
kernel version

@chrf01
Copy link
Author

chrf01 commented May 3, 2024

Oh yeah sorry:

kernel version: 4.4.195
qemu version: 9.0.0
Launch command: qemu-system-i386 -kernel images/vmlinuz-4.4.195-i386 -initrd build/initramfs-x86.cpio.gz -nographic -append "console=ttyS0" -enable-kvm -s -S

but i guess it should fail on all kernels running with qemu-system-i386 because we dont check for "i386" in show architecture command

martinradev added a commit that referenced this issue May 4, 2024
This patch fixes the failure to discover the arch type
when the VM is started via qemu-system-i386.

Two issues are fixed:
- The patch adds a check for the string "i386" in the qemu arch
  string to determine if this is an x86 machine. The x86 backend
  further determines what x86 mode is enabled by reading MSRs.
- The patch updates the code for determining if long mode is
  enabled to expect that reading the EFER MSR may fail. This failure
  can happen when the VM machine type is 32-bit - e.g. qemu-system-i386
  is used.

Issue #33
martinradev added a commit that referenced this issue May 4, 2024
This patch adds an "i386" backend that allows launching
an x86-32 VM via the qemu-system-i386 program. This is
test necessary to ensure that gdb-pt-dump correctly
determines that the VM is an x86 VM if the target arch
is i386.

For the kernel, the kolibri image is used.

Issue #33
@martinradev
Copy link
Owner

@chrf01

Could you please check if #34 works for you?

I tried it locally with an x86 kolibri image.

@chrf01
Copy link
Author

chrf01 commented May 5, 2024

@chrf01

Could you please check if #34 works for you?

I tried it locally with an x86 kolibri image.

fails at PML4_Entry.__init__() now.
TypeError: PML4_Entry.__init__() missing 1 required positional argument: 'index'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants