o j,@s`ddlZddlZddlTddlmZGdddZGdddZGd d d ZGd d d ZdS) N)*)PROCESSOR_ARCHITECTUREc@seZdZddZddZdS)VirtualSegmentcCs||_||_||_d|_dSN)startendstart_file_addressdata)selfrrr r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minidump/aminidumpreader.py__init__ s zVirtualSegment.__init__cCs|j|ko ||jkSr)rr)r rrr r r inrangeszVirtualSegment.inrangeN)__name__ __module__ __qualname__rrr r r r r s rc@s6eZdZd ddZddZddZdd Zd d Zd S)AMinidumpBufferedMemorySegment(cCs6|j|_|j|_|j|j|_|j|_||_g|_dSr)start_virtual_address start_addressend_virtual_address end_address total_sizer chunksizechunks)r memory_segmentrr r r rs  z'AMinidumpBufferedMemorySegment.__init__cCs|j|ko |jkSSr)rrr positionr r r r sz&AMinidumpBufferedMemorySegment.inrangecCs||sdS|j|Sr)rrrr r r remaining_len#s  z,AMinidumpBufferedMemorySegment.remaining_lencs"||ddIdH}|||S)Nr)readfind)r file_handlepatternstartposr r r r r"(s z#AMinidumpBufferedMemorySegment.findcsh|dur||j|IdH||j|j|IdHS|jD]}|||r8|j||j||jSq!|jd|j krp|j}t d||j}||jIdH||IdH|_|j ||j||j||jSt |||j }|||jkr|j|}t ||||j|}||jIdH||IdH|_|j ||j||j||jS)Nr) seekr r!rrrr rrrrappendmax)r r#rrchunkrvsr r r r!,s.     z#AMinidumpBufferedMemorySegment.readNr)rrrrrrr"r!r r r r rs   rc@seZdZd(ddZddZd)ddZd d Zd*d d ZddZddZ d+ddZ ddZ ddZ ddZ ddZddZdd Zd!d"Zd#d$Zd,d&d'Zd S)-AMinidumpBufferedReaderrcCs"||_g|_||_d|_d|_dSr)readermemory_segmentssegment_chunk_sizecurrent_segmentcurrent_position)r r.r0r r r rIs  z AMinidumpBufferedReader.__init__csz|jD]}||r||_||_dSq|jjD]}||r6t||jd}|j|||_||_dSqtd|)z N)rz4Memory address 0x%08x is not in process memory space) r/rr1r2r.rr0r( Exception)r requested_positionr newsegmentr r r _select_segmentQs       z'AMinidumpBufferedReader._select_segmentrcsh|dkr |jj|}n|dkr|j|}n|dkr!|jj|}ntd|j|s/td||_dS)aD Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function rrr&z.Seek function whence value must be between 0-2z5Seek would cross memory segment boundaries (use move)N)r1rr2rr3r)r offsetwhencetr r r r'gs  zAMinidumpBufferedReader.seekcs||IdHdS)z@ Moves the buffer to a virtual address specified by address N)r6)r addressr r r move~szAMinidumpBufferedReader.moveNcs\|dur|jjjtjkrd}nd}|j|}|dkrdS|||}||dIdHdS)zD Repositions the current reader to match architecture alignment Nrr)r.sysinfoProcessorArchitecturerAMD64r2r')r alignmentr7offset_to_alignedr r r aligns  zAMinidumpBufferedReader.aligncCs|jS)z) Returns the current virtual address )r2)r r r r tellszAMinidumpBufferedReader.tellcsP|j|}|j|dstd|j|jj|j|jj||jjIdHS)z@ Returns up to length bytes from the current memory segment r#Would read over segment boundaries!N)r2r1rr3r!r.r#r)r lengthr9r r r peeks  ,zAMinidumpBufferedReader.peekr cs|dkr td|dkr1|j|j}|sdS|j}|jj|_|j|jj||jjdIdHS|j|}|j |dsBtd|j}||_|j|jj||jj||jjIdHS)z Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment r zYou shouldnt be doing thisNrrE) r3r1rr2rr!r.r#rr)r sizer9 old_new_posr r r r!s  " *zAMinidumpBufferedReader.readcsV|jjjtjkr|dIdH}tj|dddS|dIdH}}tj|dddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch r<NlittleT byteordersignedr=r.r>r?rr@r!int from_bytesr r9r r r read_ints z AMinidumpBufferedReader.read_intcsR|jjjtjkr|dIdH}tj|dddS|dIdH}tj|dddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch r<NrJFrKr=rNrQr r r read_uints z!AMinidumpBufferedReader.read_uintcs0|j|jj|IdH}|dkrdS||jS)z: Searches for a pattern in the current memory segment Nr )r1r"r.r#r2)r r$posr r r r"s  zAMinidumpBufferedReader.findcsLg}d} |j|jj||dIdH}|dkr |S|||jjq)zp Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list r TrN)r1r"r.r#r(r)r r$rT last_foundr r r find_allsz AMinidumpBufferedReader.find_allcs,|j|IdH}t|dkrdS|dS)zx Searches for the pattern in the whole process memory space and returns the first occurrence. This is exhaustive! Nrr )r.searchlen)r r$pos_sr r r find_globals  z#AMinidumpBufferedReader.find_globalcs|j|IdHS)z Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins. This is exhaustive! N)r.rW)r r$r r r find_all_globalsz'AMinidumpBufferedReader.find_all_globalcs ||IdH|IdHSr)r;rS)r rTr r r get_ptrszAMinidumpBufferedReader.get_ptrcsl|jjjtjkr'||IdH|dIdH}tj|ddd}|d|S||IdH| IdHS)Nr=rJTrK) r.r>r?rr@r;r!rOrPrS)r rTr9ptrr r r get_ptr_with_offsets z+AMinidumpBufferedReader.get_ptr_with_offsetFcs$|jj|||||jdIdH}|S)N) find_first reverse_orderr)r. search_moduler0)r module_namer$r_r`r9r r r find_in_modulesz&AMinidumpBufferedReader.find_in_moduler,)rr)r )FF)rrrrr6r'r;rCrDrGr!rRrSr"rVrZr[r\r^rcr r r r r-Hs$         r-c@sBeZdZddZdddZddZdd d Zdd d Zd dZdS)AMinidumpFileReadercCs|jj|_|j|_|jr|jj|_d|_n|jj|_d|_|j|_|j|_d|_d|_|jj t j t j fvr=d|_ d|_dS|jj t jt jfvrOd|_ d|_dStd|jj )NTFr=zmemory_segments_64r/ is_fulldumpfilenamer# sizeof_long unpack_longr?rr@AARCH64 sizeof_ptr unpack_ptrINTELARMr3)r minidumpfiler r r rs(      zAMinidumpFileReader.__init__rcCs t||dS)N)r0)r-)r r0r r r get_buffered_reader2s z'AMinidumpFileReader.get_buffered_readercCs6|jD]}t|j|dkr|SqdS)Nr )rentpathbasenamenamelowerr")r rbmodr r r get_module_by_name5s z&AMinidumpFileReader.get_module_by_nameFc s||}|durtd|g}|jD].}|j|jkr$|jkrCnq||j||j||dIdH7}t|dkrC|durC|Sq|S)NzCould not find module! %sr_rrT) rwr3r/ baseaddressr endaddressasearchr#rX) r rbr$r_r`rrvneedlesmsr r r ra;s   z!AMinidumpFileReader.search_modulecs4g}|jD]}||j||j||dIdH7}q|S)Nrx)r/r{r#)r r$r_rr9r}r r r rWHs   zAMinidumpFileReader.searchcsB|jD]}||r||||jIdHSqtdt|)NzAddress not in memory range! %s)r/rareadr#r3hex)r virt_addrrHsegmentr r r r!Os   zAMinidumpFileReader.readNr,)FFr)Fr) rrrrrqrwrarWr!r r r r rds   rd) structrrcommon_structsstreams.SystemInfoStreamrrrr-rdr r r r s  1N