-
Notifications
You must be signed in to change notification settings - Fork 475
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
my replay just end without error #141
Comments
Hm, strange. What happens if you do echo $? after? i.e. the exitcode.
…On Wed, Feb 22, 2017 at 11:37 PM, zshu1 ***@***.***> wrote:
I run a worm in windows-7-32bit and use qemu-system-i386.
***@***.***:~/tools/panda/build-panda/i386-softmmu$ sudo
./qemu-system-i386 -m 1024 ~/images/win7_test2/snapshot1.img -monitor
stdio
QEMU 2.7.90 monitor - type 'help' for more information
(qemu) begin_record worm3
(qemu) writing snapshot: ./worm3-rr-snp
opening nondet log for write : ./worm3-rr-nondet.log
end_record
(qemu) Time taken was: 127 seconds.
`
and now I get a record. Then I tried to replay it
loading snapshot
... done.
opening nondet log for read : ./worm3-rr-nondet.log
total_instr in replay: 10283332009
worm3: 102956137 ( 1.00%) instrs. 2.12 sec. 1.00 GB ram.
worm3: 205990156 ( 2.00%) instrs. 5.32 sec. 1.06 GB ram.
worm3: 309241486 ( 3.01%) instrs. 8.33 sec. 1.10 GB ram.
worm3: 413319106 ( 4.02%) instrs. 10.96 sec. 1.14 GB ram.
worm3: 515996469 ( 5.02%) instrs. 12.62 sec. 1.16 GB ram.
worm3: 617719878 ( 6.01%) instrs. 15.11 sec. 1.19 GB ram.
worm3: 720020510 ( 7.00%) instrs. 17.33 sec. 1.21 GB ram.
worm3: 823464399 ( 8.01%) instrs. 19.47 sec. 1.21 GB ram.
worm3: 926965247 ( 9.01%) instrs. 21.24 sec. 1.22 GB ram.
worm3: 1029143515 ( 10.01%) instrs. 23.48 sec. 1.23 GB ram.
worm3: 1131566991 ( 11.00%) instrs. 25.72 sec. 1.25 GB ram.
worm3: 1235750808 ( 12.02%) instrs. 27.67 sec. 1.26 GB ram.
worm3: 1337278536 ( 13.00%) instrs. 29.52 sec. 1.26 GB ram.
worm3: 1440135058 ( 14.00%) instrs. 31.86 sec. 1.28 GB ram.
worm3: 1542594997 ( 15.00%) instrs. 34.13 sec. 1.29 GB ram.
worm3: 1645383436 ( 16.00%) instrs. 36.55 sec. 1.30 GB ram.
worm3: 1748346459 ( 17.00%) instrs. 39.93 sec. 1.30 GB ram.
worm3: 1854578935 ( 18.03%) instrs. 41.74 sec. 1.30 GB ram.
worm3: 1953890351 ( 19.00%) instrs. 43.74 sec. 1.30 GB ram.
worm3: 2057476564 <(205)%20747-6564> ( 20.01%) instrs. 46.31 sec. 1.30 GB
ram.
worm3: 2160670806 ( 21.01%) instrs. 48.65 sec. 1.30 GB ram.
worm3: 2263983991 <(226)%20398-3991> ( 22.02%) instrs. 51.17 sec. 1.30 GB
ram.
worm3: 2365620588 <(236)%20562-0588> ( 23.00%) instrs. 52.69 sec. 1.30 GB
ram.
worm3: 2468589477 <(246)%20858-9477> ( 24.01%) instrs. 55.08 sec. 1.31 GB
ram.
worm3: 2571340806 ( 25.00%) instrs. 56.90 sec. 1.31 GB ram.
worm3: 2673877359 <(267)%20387-7359> ( 26.00%) instrs. 59.45 sec. 1.32 GB
ram.
worm3: 2776806819 ( 27.00%) instrs. 61.56 sec. 1.32 GB ram.
worm3: 2879404659 ( 28.00%) instrs. 64.55 sec. 1.32 GB ram.
worm3: 2988035451 ( 29.06%) instrs. 66.06 sec. 1.32 GB ram.
worm3: 3088603572 <(308)%20860-3572> ( 30.04%) instrs. 67.36 sec. 1.32 GB
ram.
worm3: 3188632935 <(318)%20863-2935> ( 31.01%) instrs. 68.60 sec. 1.32 GB
ram.
worm3: 3291608687 ( 32.01%) instrs. 69.66 sec. 1.32 GB ram.
worm3: 3393729640 <(339)%20372-9640> ( 33.00%) instrs. 70.87 sec. 1.32 GB
ram.
worm3: 3496342117 ( 34.00%) instrs. 71.95 sec. 1.32 GB ram.
worm3: 3599554273 ( 35.00%) instrs. 73.27 sec. 1.32 GB ram.
worm3: 3703856201 ( 36.02%) instrs. 74.53 sec. 1.32 GB ram.
worm3: 3804918764 <(380)%20491-8764> ( 37.00%) instrs. 76.25 sec. 1.32 GB
ram.
worm3: 3907799223 ( 38.00%) instrs. 77.13 sec. 1.32 GB ram.
worm3: 4011084817 ( 39.01%) instrs. 77.91 sec. 1.32 GB ram.
worm3: 4114099553 ( 40.01%) instrs. 78.79 sec. 1.32 GB ram.
worm3: 4216347969 ( 41.00%) instrs. 80.40 sec. 1.32 GB ram.
worm3: 4319149187 <(431)%20914-9187> ( 42.00%) instrs. 83.32 sec. 1.32 GB
ram.
worm3: 4422859328 <(442)%20285-9328> ( 43.01%) instrs. 86.46 sec. 1.32 GB
ram.
worm3: 4524981729 ( 44.00%) instrs. 88.99 sec. 1.32 GB ram.
worm3: 4628065399 ( 45.01%) instrs. 91.80 sec. 1.32 GB ram.
***@***.***:~/tools/panda/build-panda/i386-softmmu$
then it finished. at 45%.
I use snapshot of QEMU to run the record , does it matters ?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#141>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAhgh1P84sswyLye4OD3e26SaF9aaXSJks5rfLiRgaJpZM4MJSRO>
.
|
You may also want to try running PANDA under gdb and setting a breakpoint on the |
thank you all for replying. I tried gdb to catch the crash point and get information bellow:
and the backtrace stack here:
I want to add -g flag to PANDA then I can try to debug by myself but after reading makefile I can't find CFLAGS where it is defined so can't add symbol to gdb when compile. Could someone also help me on that? |
OK – it looks like this is a known bug (related to handling I/O memory map changes). It usually only manifests during system boot, though. Does this happen consistently? And are you able to share the malware sample that triggers the crash? |
Hi ,sorry for replying so late, I test this malware few times again, and got
another different error.
I run it as:
panda/i386-softmmu/qemu-system-i386 -m 1024 -replay worm3
its windows 7 32bit OS. run on i386.
begin record , then run malware 1 or 2 minutes and end record.
gmail does not allowed me to sent malware even with encrypt. I will sent it
from another mailbox.
Or do I need to send the record files?
Thanks,
…On Fri, Feb 24, 2017 at 11:12 AM, Brendan Dolan-Gavitt < ***@***.***> wrote:
OK – it looks like this is a known bug (related to handling I/O memory map
changes). It usually only manifests during system boot, though. Does this
happen consistently? And are you able to share the malware sample that
triggers the crash?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#141 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/ALKFJkikO4_I8kifkETO34WPw_z3_Ig9ks5rfwGKgaJpZM4MJSRO>
.
|
Sending the malware is best – to debug we will need to reproduce the recording and replay process. |
Brendan Dolan-Gavitt <notifications@github.com>于2017年2月27日 周一上午11:40写道:
Sending the malware is best – to debug we will need to reproduce the
recording and replay process.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#141 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/ALKFJpfbVUFoFzfwLbbHGoBHG7uwMc0-ks5rgvx1gaJpZM4MJSRO>
.
Sure, could you leave me a mail address to sent to? I have sent the malware
example from another mailbox to panda mailbox on github.
|
Could you send it to brendandg@nyu.edu ? If that doesn't work I can try to set up a place for you to upload it directly. |
Sure. I have sent the malware. Thanks.
…On Mon, Feb 27, 2017 at 11:56 AM, Brendan Dolan-Gavitt < ***@***.***> wrote:
Could you send it to ***@***.*** ? If that doesn't work I can try
to set up a place for you to upload it directly.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#141 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/ALKFJofNvCjJMaUj5XL66bmHoEZi5VFoks5rgwBbgaJpZM4MJSRO>
.
|
FYI, I never received this so I think some mail filter along the way deleted it. Maybe you can host it somewhere for download? |
I can't reproduce this bug. I running 5 times and 2 of them works well. |
I run a worm in windows-7-32bit and use qemu-system-i386.
and now I get a record. Then I tried to replay it
then it finished. at 45%.
I use snapshot of QEMU to run the record , does it matters ?
The text was updated successfully, but these errors were encountered: