Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(373)

Issue 200130043: Added detection and support for ParaVirtualized XEN guests. (Closed)

Can't Edit
Can't Publish+Mail
Start Review
Created:
6 years, 1 month ago by Jordi
Modified:
6 years, 1 month ago
Reviewers:
adamsh, mic, scudette, the80srobot
CC:
rekall-dev_googlegroups.com
Base URL:
https://github.com/google/rekall@master
Visibility:
Public.

Description

Added detection and support for ParaVirtualized XEN guests. Refactored find_dtb plugins to do os-specific checks in the os-specific plugins instead of the base class. BUG= R=scudette@gmail.com Committed: 366bc97

Patch Set 1 #

Total comments: 1

Patch Set 2 : Added better docstrings #

Patch Set 3 : #

Total comments: 10

Patch Set 4 : Made os-specific address space selection in find_dtb be in the os-specific find_dtb plugins. #

Patch Set 5 : First round of fixes. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+193 lines, -7 lines) Patch
M rekall/plugins/addrspaces/amd64.py View 1 2 3 4 3 chunks +127 lines, -0 lines 0 comments Download
M rekall/plugins/core.py View 1 2 3 1 chunk +0 lines, -4 lines 0 comments Download
M rekall/plugins/linux/common.py View 1 2 3 5 chunks +49 lines, -3 lines 0 comments Download
M rekall/plugins/windows/common.py View 1 2 3 2 chunks +17 lines, -0 lines 0 comments Download

Messages

Total messages: 15
Jordi
https://codereview.appspot.com/200130043/diff/1/rekall/plugins/linux/common.py File rekall/plugins/linux/common.py (right): https://codereview.appspot.com/200130043/diff/1/rekall/plugins/linux/common.py#newcode138 rekall/plugins/linux/common.py:138: phys_startup_64 = (profile.get_constant("phys_startup_64", False) or This is in preparation ...
6 years, 1 month ago (2015-01-30 15:07:47 UTC) #1
scudette
https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py File rekall/plugins/addrspaces/amd64.py (right): https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py#newcode316 rekall/plugins/addrspaces/amd64.py:316: docstring https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py#newcode364 rekall/plugins/addrspaces/amd64.py:364: p2m_top_location = self.session.profile.get_constant("p2m_top", False) p2m_top_location = ...
6 years, 1 month ago (2015-01-30 15:16:57 UTC) #2
Jordi
https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py File rekall/plugins/addrspaces/amd64.py (right): https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py#newcode316 rekall/plugins/addrspaces/amd64.py:316: On 2015/01/30 15:16:56, scudette wrote: > docstring Done. https://codereview.appspot.com/200130043/diff/40001/rekall/plugins/addrspaces/amd64.py#newcode364 ...
6 years, 1 month ago (2015-01-30 16:15:03 UTC) #3
scudette
LGTM - Awesome work!
6 years, 1 month ago (2015-01-30 16:26:16 UTC) #4
Jordi
Thanks! Half the work on the CL is yours :)
6 years, 1 month ago (2015-01-31 08:04:32 UTC) #5
Jordi
Committed patchset #5 manually as r366bc97 (presubmit successful).
6 years, 1 month ago (2015-01-31 08:05:11 UTC) #6
Jordi
Checking why this CL broke an entity test. On Sat, Jan 31, 2015 at 9:05 ...
6 years, 1 month ago (2015-01-31 08:13:32 UTC) #7
Jordi
+adam Maybe the TestFindEntity test is flaky? I reran the build and all passed. Locally ...
6 years, 1 month ago (2015-01-31 08:28:19 UTC) #8
mic_google.com
you can try to re-run the test on travis. On Sat, Jan 31, 2015 at ...
6 years, 1 month ago (2015-01-31 10:23:50 UTC) #9
Jordi
Yeah, I did earlier. It's passing. On Sat, Jan 31, 2015, 11:23 AM 'Michael Cohen' ...
6 years, 1 month ago (2015-01-31 10:24:40 UTC) #10
scudette
sometimes travis tests fail because the connection to the profile repo failed for some reason. ...
6 years, 1 month ago (2015-01-31 10:26:27 UTC) #11
adamsh
On 2015/01/31 08:28:19, Jordi wrote: > +adam > > Maybe the TestFindEntity test is flaky? ...
6 years, 1 month ago (2015-01-31 13:13:31 UTC) #12
the80srobot
On 2015/01/31 13:13:31, adamsh wrote: > On 2015/01/31 08:28:19, Jordi wrote: > > +adam > ...
6 years, 1 month ago (2015-01-31 13:16:09 UTC) #13
the80srobot
On 2015/01/31 13:16:09, the80srobot wrote: > On 2015/01/31 13:13:31, adamsh wrote: > > On 2015/01/31 ...
6 years, 1 month ago (2015-01-31 13:18:01 UTC) #14
Jordi
6 years, 1 month ago (2015-01-31 13:20:51 UTC) #15
Looks like Travis doesn't keep old builds.... and we don't have access to
the output... do we? >.<

I remember an AssertionError: 2 != 1
But don't quite recall the backtrace soo... not very useful.

On Sat, Jan 31, 2015 at 2:18 PM, <adam.sindelar@gmail.com> wrote:

> On 2015/01/31 13:16:09, the80srobot wrote:
>
>> On 2015/01/31 13:13:31, adamsh wrote:
>> > On 2015/01/31 08:28:19, Jordi wrote:
>> > > +adam
>> > >
>> > > Maybe the TestFindEntity test is flaky? I reran the build and all
>>
> passed.
>
>> > > Locally I can't reproduce it.
>> > >
>> > > On Sat, Jan 31, 2015 at 9:13 AM, Jordi Sanchez
>>
> <mailto:parki.san@gmail.com>
>
>> > wrote:
>> > >
>> > > > Checking why this CL broke an entity test.
>> > > >
>> > > > On Sat, Jan 31, 2015 at 9:05 AM, <mailto:parki.san@gmail.com>
>>
> wrote:
>
>> > > >
>> > > >> Committed patchset #5 manually as r366bc97 (presubmit
>>
> successful).
>
>> > > >>
>> > > >> https://codereview.appspot.com/200130043/
>> > > >>
>> > > >
>> > > >
>> >
>> > Do you have an example of how it broke Jordi? I don't see any TAP
>>
> result for
>
>> > this issue.
>>
>
>  I also don't see any test called FindEntity.
>>
>
> Nevermind, found it - it's called EntityFind :) I don't see how that
> could be non-deterministic, given that the output is sorted. I'd be
> curious to see how it broke.
>
>
> https://codereview.appspot.com/200130043/
>
> --
> You received this message because you are subscribed to the Google Groups
> "rekall-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to rekall-dev+unsubscribe@googlegroups.com.
> To post to this group, send email to rekall-dev@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>
Sign in to reply to this message.

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld f62528b