Fix searching when connected to qemu-system instance

[clubby789]

Description/Motivation/Screenshots

Fixes #905
Detects when we're connected to a QEMU kernel instance, and uses monitor info mem to retrieve the real kernel memory mappings for searching within.

Against which architecture was this tested ?

"Tested" indicates that the PR works and the unit test (see docs/testing.md) run passes without issue.

• x86-32
• x86-64
• ARM
• AARCH64
• MIPS
• POWERPC
• SPARC
• RISC-V

Checklist

• My PR was done against the dev branch, not main.
• My code follows the code style of this project.
• My change includes a change to the documentation, if required.
• If my change adds new code, adequate tests have been added.
• I have read and agree to the CONTRIBUTING document.

I will add tests shortly, just leaving this initial draft.

[clubby789]

I noticed that the code for detecting if we're in a qemu/qemu-system context already exists, so I've removed my duplicated code. The code added is mainly just invoking and parsing monitor info mem, and using those memory mappings when needed. As there is currently no testing harness for qemu-system, I haven't added tests.

[clubby789]

Because of a typo (QOffsets -> qOffsets), qemu sessions would always be identified as kernel-mode. All tests look good locally now

[clubby789]

As a side note, it looks like the search command buffers the output til completion. Having it print as items are discovered (or at least having that as an option) would help when the search takes a long time (i.e. traversing the large memory space of the kernel)

[Grazfather]

Looks good, a few comments, and I'll have to figure out how to test it.

As a side note, it looks like the search command buffers the output til completion. Having it print as items are discovered (or at least having that as an option) would help when the search takes a long time (i.e. traversing the large memory space of the kernel)

Yes, good call. Go ahead and file a ticket if you don't mind.

[Grazfather]

Forgot to submit my review.

[Grazfather]

Looks good, just more nitpicking.

[hugsy]

Another great PR @clubby789 , again some small stuff to fix.

[hugsy]

BTW you should be able to merge the latest changes from dev, the CI tests should run again successfully on your next push.

Cheers!

[clubby789]

Tests look okay locally and on Ubuntu 20, probably random failure?

[hugsy]

Tests look okay locally and on Ubuntu 20, probably random failure?

It can happen, I just relaunched the tests.
If still fails, I'll have a look tonight but it should be minor.

[hugsy]

@clubby789
Your changes look good, go ahead and merge the latest changes from dev. I believe all tests should pass now, then I'll go ahead and merge your PR.