Searching the swapfile of a kvm/qemu image
Greetings:
I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?
Thanks, in advance.
Sean McLinden
Signature · 7 lines
NOTICE of CONFIDENTIALITY and DISCLAIMER This transmission, including attachments, is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail to the sender, only, and delete it from your system; you may not copy this message or disclose its contents to anyone. Unless expressly noted, above, this communication does not reflect an intention by the sender to conduct a transaction or make any agreement by electronic means. Nothing contained in this transmission shall constitute a contract or electronic signature under the ESIGN, any version of the UETA, or any other statute governing electronic transactions. If this transmission contains advice, the advice is based on instructions in relation to, and is provided to the addressee in connection with, the matter mentioned above. Responsibility is not accepted for reliance upon it by any other person or for any other purpose.
Quoted 1 line · Sean McLinden
I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?
Keep in mind that the contents of the swap partition can change at any time. I don't know the details of the swap on-disk layout, but if you need to read from multiple non-contiguous sectors you have a race condition where you might read part old and part new contents.
What are you trying to achieve?
Stefan
I am searching for (possibly) meaningful strings.
This is a shot-in-the-dark kinda of effort.
Thanks!
Sean
----- Original Message -----
From: "Stefan Hajnoczi" <[email protected]>
To: "Sean McLinden" <[email protected]>
Cc: [email protected]
Sent: Tuesday, April 5, 2016 6:08:13 AM GMT -05:00 US/Canada Eastern
Subject: Re: Searching the swapfile of a kvm/qemu image
Quoted 1 line · Sean McLinden
I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest?
Keep in mind that the contents of the swap partition can change at any time. I don't know the details of the swap on-disk layout, but if you need to read from multiple non-contiguous sectors you have a race condition where you might read part old and part new contents.
What are you trying to achieve?
Stefan
Signature · 7 lines
NOTICE of CONFIDENTIALITY and DISCLAIMER This transmission, including attachments, is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail to the sender, only, and delete it from your system; you may not copy this message or disclose its contents to anyone. Unless expressly noted, above, this communication does not reflect an intention by the sender to conduct a transaction or make any agreement by electronic means. Nothing contained in this transmission shall constitute a contract or electronic signature under the ESIGN, any version of the UETA, or any other statute governing electronic transactions. If this transmission contains advice, the advice is based on instructions in relation to, and is provided to the addressee in connection with, the matter mentioned above. Responsibility is not accepted for reliance upon it by any other person or for any other purpose.