Extracting text from the memory image of a running process

I found a really nasty problem with the bug tracker we use at work last week. If someone else posts to it whilst you are composing your comment it refuses to accept it. It doesn’t offer a “post comment anyway” feature and advises instead that you:

  • Press Back
  • Select the comment you have just written
  • Copy it to the clipboard
  • Reload the page in your browser
  • Paste the comment back into the text field

Other than the obvious epic fail regarding usability there is one additional problem in the instructions above. When you press back the rich text editing widget no longer has your comment in it! That’s right. Forty five minutes expressing my highly insightful view point as clearly as possible… gone.

Grrr…

I could tell the text was still there because I could press Forward and refresh but I just couldn’t see it.

At this point I fired up wireshark to try and capture my work as it went out over the network. This was when I realized that the bug tracker was using SSL and trying to launch a man-in-the-middle attach on myself was likely a waste of time.

So, the last resort of the desperate(ly lazy) is to grab the data from the memory image itself. That should be dead easy, I’ve been running GNU/Linux at home for almost fifteen years. I must have learnt my way around by now. Surely I just attach to a running process and dump its memory.

Having got the PID of the firefox process I fired up gdb:

 butch$ gdb
 GNU gdb (GDB) Fedora (7.3.50.20110722-10.fc16)
 Copyright (C) 2011 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law. Type "show
 copying" and "show warranty" for details.
 This GDB was configured as "i686-redhat-linux-gnu".
 For bug reporting instructions, please see:
 .
 (gdb) attach 23639
 Attaching to process 23639
 /usr/lib/firefox/firefox (deleted): No such file or directory.

At this point I tried the gcore command. No luck there either. gdb couldn’t figure out the memory ranges it needed to dump. Still I’m not one to give up. After trying and failing to scan /proc/23639/mem I decide to scan the list of the memory mappings and dump each one. When I discovered that firefox had over 700 blocks of mapped memory I decided to generate a gdb script to dump the memory automatically:

cat /proc/23639/maps \
| cut -d' ' -f1 \
| tr '-' ' ' \
| awk '{ print "dump memory core-" $1 "-" $2 " 0x" $1 " 0x" $2 }' \
> dumpmem.gdb

It worked. I have the memory in files. From here things get much easier:

cat core-* | strings | grep -C 40 BD-ROM | less

Yay.

Share

Fixing problems with encrypted removable media

If you have plug encrypted removable media into a recent GNU/Linux distribution it will probably try to automount it for you.

So far, so hoopy.

However a recurring class of bugs in the hot plug logic is failure to tear down the encrypted device mapper when the media is removed without unmounting it first.

It results in a message something like this:

Error unlocking device: cryptsetup exited with exit code 5: Device udisks-luks-uuid-d9fb9d0d-74e6-49b1-94d3-7edc083f04c0-uid80377 already exists.

Naturally this is a bug in your distribution but it is one that sends to regress as the desktop stack is developed so knowing how to workaround will do you no harm at all.

I generally use:

sudo cryptsetup luksClose udisks-luks-uuid-d9fb9d0d-74e6-49b1-94d3-7edc083f04c0-uid80377

Note: gnome-shell-3.2 will prompt you for a password but doesn’t issue an error message if the automount fails. If you want to see the error message (and hence the name of the mapping) open the file manager and try to mount the encrypted partititon from there instead.

Although I couldn’t really be bothered you could easily write a script to automatically identify encrypted device mapping that aren’t being used and undo them by getting a script to look at the output of ls -al /dev/mapper. Probably it would be best to look for devices that have a mapping but are not mounted.

Share

The Joy Of Spam

Since first opening this blog one of the things that surprised me was the number of spam comments it attracted. Its hardly a high publicity site so I guess I was supprised how quickly the spam robots started to target my blog. Thankfully the first few spam comments were pretty obvious:

Without Perscription, Certified by FDA depression or other mental illness Cymbalta Cheap Overnight Doctor weight loss Real Online! It is Easy and Fast.Antibiotics online US chest pain confusion Cymbalta Generic On Line, No Hidden Fees! Licensed Pharmacy, muscle aches Were to Purchasing internet.buy brand buy Deutschland FDA Approved us pharmacy cabergoline, other medicines, foods, dyes, or preservatives Mevacor Colorado No prescription
pas cher order Zocor, acheter cheap Zofran, ordine cheap Zovirax, in italia order Zyban,

[From an online pharmacy]

After reading a little more on the subject of spam comments I quickly learned two things. The first is that spam comments are a fact of life if you want to allow anonymous comments (and doubly so if you don’t like CAPTCHAs). The other is that the part that always gives away the spammer is that the comment doesn’t contain any information related to the actual content of your article. This is because the spammer has to write one text and then post it to many different sites. Philosophically speaking if the spammer wrote bespoke comments for each site they would not longer be a spammer. Perhaps an artisan spammer who wrote bespoke comments would wind up being called a fillet-steaker.

Anyhow even with no obvious motivation for the comment the following messages did rather give away their true nature, especially when you remember that many bloggers only moderate the first comment from a user so if you let them through assume they will be back.

Thanks for taking this opportunity to mention this, I’m strongly about it and I benefit from garden greenhouse structures this subject. When possible, when you gain data, please update this website with new information. I have found it extremely useful.

[From a person in "trading strategies"]

After reading your blog post I browsed your website a bit and noticed you aren’t ranking nearly as well in Google as you could be. I possess a handful of blogs myself and I think you should take a look here: http://nottherightlinksothere.org You’ll find it’s a very nice tool that can bring you a lot more visitors. Keep up the quality posts

[From a SEO company]

The next two posts represent the most sophisticated spam comments I’ve received so far. Both avoid flattery and instead try to latch onto technical paranoia instead. The first one is particular clever for the question in the middle and its assumption that other humans really need to read this message. Whilst I’d prefer spammers to find some more productive line of work you have to admire someone at the top of the game like this:

I don’t know if it’s just me or if everybody else encountering problems with your blog. It seems like some of the text within your posts are running off the screen. Can somebody else please provide feedback and let me know if this is happening to them as well? This may be a issue with my browser because I’ve had this happen before. Cheers

[From a fake Burberry scarves salesman]

Howdy just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Chrome. I’m not sure if this is a format issue or something to do with browser compatibility but I figured I’d post to let you know. The layout look great though! Hope you get the problem solved soon. Kudos

[From a pornographer]

It’s getting towards time to finish this post so I’ll introduce one of my favourites here. It’s not because of the quality of the prose, although one does have to admire the excellent spelling together with correct use of capital letters, commas and full stops (even on the last line). The reason it’s my favourite is this transparent attempt to flatter me into accepting the spam was attached to a pictoral joke. The “astonishingly thought-provoking” words that inspired such gushing praise numbered only ten.

You have written an astonishingly thought-provoking article. Your written content speaks to me and I share inside your views. Countless writers do not write original material, but you have really achieved an awesome job with this information.

[From a fake ugg boot salesman]

So to close I shall leave you with this comment and sincerely hope you share the sentiment.

I would brand your blog the dreamland! though Santa knocks at our door just once every year, you blog is open the entire year ¨C wow!

[From a fake ugg boot salesman]

Share

A photo collection of twentieth century telegraph poles

image

OK. It’s not a collection and it’s nothing to do with the telegraph. However it is a photo, it almost dates from the late twentieth century and it is a pole. It’s a power pole to be exact. It was located on a campsite I recently visited and I rather liked the huge switch that can presumably be used to cut of all power to the nearby village.

I know. Pictures of poles are not that cool. I don’t care. It’s interesting to see how big a switch has to be even for a ‘baby’ pole like this.

Of course as a photographer I wish I’d remembered to take a shot without the pole. It would have been a good donor image for a sky replacement!

Share

Why the scammer wanted to pay by paypal

I recently put my very first guitar up for sale on the local free-ads site. The free-ads site in question provides an e-mail the seller box and I received a simple request to find out if the guitar was still for sale:

From: Noreply@trade-it.co.uk
Subject: Epiphone SG Special Electric Guitar
Date: Wed, 06 Jul 2011 13:49:32 +0100

Message from bernard.xxxxxxxx90s@gmail.com, sent using "Email
advertiser" form on trade-it site
Ad url: http://www.trade-it.co.uk/musical-guitars-electric/
region-w-uk-bristol-south-west-avon-bristol/
EpiphoneSGSpecialElectricGuitar-14356228.html

Hello there,pls i will like to know if the above listed item is
still available for sale ??? 

God Bless!!!!

The “God Bless” is an unusual sign off and whist I admire the sentiment I did, as a result, make up my mind to read any follow up carefully. However since I sometimes e-mail sellers to ask if things are still for sale I knocked out a quick reply:

To: bernard.xxxxxxxx90s@gmail.com
Subject: Re: Epiphone SG Special Electric Guitar
Date: Thu, 7 Jul 2011 7:40:00 +0100

Yes. He's still for sale. You could come and see him in Bradley
Stoke most evenings.

Thanks.

When the reply came back there was little doubt in my mind that someone was trying to steal my guitar:

From: Bernard XXXXXXXX <bernard.xxxxxxxx90s@gmail.com>
Subject: Re: Epiphone SG Special Electric Guitar
Date: Thu, 7 Jul 2011 09:01:30 +0100

Thanks for mailing back,i am an Oceanographer and i am buying
this for Dad, i am at sea right now, I can only pay through PayPal
at the moment as i don't have access to my bank account online,
but i have it attached to my PayPal account, and this is why i
insisted on using PayPal to pay,all i will need is your PayPal
email address to make the payments,and if you don't have a
paypal account yet,its pretty easy to set one up at
www.paypal.co.uk, iwill be expecting your email.I have a pick up
agent that will come for the pick up after payments.I will like
to have communicate and discuss this via Phone but i am 95% Deaf
and i do use hearing piece so that was why i have prefer to
communicate more through Mail ...So kindly get back to asap...i
need to see more photos also and i will like to know the last
asking price.

God Blessed.

I sincerely hope I have not been cruel to this poor deaf oceanographer in concluding this was a scam. What do you think?

However the bit that really puzzled me is how he intended to scam me. I assumed the key to the scam must that I was paid by paypal. On that basis I went off to read the Paypal Terms and Conditions.

I believe the answer is pretty clearly explained in the terms and conditions. However as a party to those terms and conditions I have to be careful “not to mischaracterise or disparage PayPal as a payment method”. On that basis I shall do my best effort to explain what I have learnt but I encourage you to read the terms and conditions above and decide for yourself!

The scam hinges on payment reversals. Payment reversals can arise from disputes between a buyer and seller and of course a dispute can be legitimate or illegitimate. Likewise if a fraudster pays from someone else’s account the dispute is legitimate but the transaction is fraudulent.

Anyhow, in disputes between a buyer and seller then the payment may be reversed leaving the seller liable for the money to paypal and no longer owning the goods.

Paypal do offer a seller protection program that would cause them to become liable for the money instead. The seller protection programme only applies to transactions carried out by a delivery service. To claim it you require proof of posting and for the delivery service to offer a tracking service that can show the parcel was delivered (transactions < £150) or actual signed proof of delivery (transactions > £150).

As you can see Bernard has tried to arrange personal collection by his “agent”. This scheme to avoid a delivery service would have left me without any seller’s protection and probably have cost me my guitar.

That’s why the scammer wanted to pay by paypal! He hoped I had never heard of payment reversals.

My advice?

  1. Paypal is a payment method suitable for remote transactions only.
  2. Always select a delivery service that provides enough information for you to qualify for the seller protection program.
  3. Never use Paypal for a face to face transaction. If you are required, by third party terms and conditions, to accept paypal (I think this might apply if you list both paypal and “collection in person” as options in an eBay auction) then insist on seeing photo ID and recent utility bill during collection.

For me there was a happy ending though. A straight swap with a very agreeable gentleman named Bob means that my Epiphone has morphed into this:

Count the strings…

Share