技术问询:从VirtualBox Ubuntu 16.04.9内存转储提取运行中ELF
Hey there! Let me break down the details you shared and frame them properly for your memory dump analysis task:
Your assignment involves analyzing a memory dump from a VirtualBox Ubuntu 16.04.9 VM. The goal is to extract messages output by an actively running ELF program inside the virtual machine.
Below is the truncated output from running the pslist command on the memory dump:
Offset Name Pid PPid Uid Gid DTB Start Time ------------------ -------------------- --------------- --------------- --------------- ------ ------------------ ---------- 0xffff88007c998000 systemd 1 0 0 0 0x000000003552e000 - 0xffff88007c998e00 kthreadd 2 0 0 0 ----------------...
A quick note here: The output cuts off after the first two core system processes (systemd and kthreadd). To find your target ELF program, you'll want to pull up the full process list — focus on user-space processes (non-system daemons) since those are the most likely candidates generating the output you're tasked to retrieve.
内容的提问来源于stack exchange,提问作者Ale X

