Skip to content

Don't read payload data into memory #21

@cg-cri-gl

Description

@cg-cri-gl

Hi,

can you please take a look into following crash (it's _sigkill_ed according to strace ) of command:
python3 -m pyimg4 im4p create -i work/ramdisk.dmg -o work/ramdisk.im4p -f rdsk
?

The details:

  1. strace message
    ........
    write(1, "Reading work/ramdisk.dmg...\n", 28Reading work/ramdisk.dmg... ) = 28 lseek(3, 0, SEEK_CUR) = 0 newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=300000000, ...}, AT_EMPTY_PATH) = 0 mmap(NULL, 300003328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f60b7de5000 read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 300000001) = 300000000 read(3, "", 1) = 0 openat(AT_FDCWD, "work/ramdisk.im4p", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4 newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0 ioctl(4, TCGETS, 0x7fffb69102a0) = -1 ENOTTY (Inappropraiate ioctl for device) lseek(4, 0, SEEK_CUR) = 0 mmap(NULL, 300003328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f60a5fca000 mmap(NULL, 300003328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f60941af000 +++ killed by SIGKILL +++ Killed

  2. The ramdisk image is crafted from few items (not familiar with this whole process), but obtaining this one seems relevant to me:
    pzb -g 078-34285-078.dmg https://updates.cdn-apple.com/2022SummerFCS/fullrestores/012-41753/03DF14B7-8351-497E-B02E-188251541117/iPhone_4.0_64bit_15.6_19G71_Restore.ipsw; however to get to this point following script was used : (which is itself called by palera1n.sh )

  3. pip list | grep pyimg pyimg4 0.7
    Shout out if more info needed, Thanks !

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

Status

Todo

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions