o j@sTddlZddlTddlmZddZGdddejZdd Zed kr(edSdS) N)*)hexdumpcCs|t|tr|St|tr6|dddkrt|dddS|dddkr2t|dddSt|Stdt|)N0x0bzUnknown integer format! %s) isinstanceintstrlower Exceptiontype)xr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minidump/minidumpshell.pyargs2ints  rc@seZdZdZdZdZdZdZddZddZ d d Z d d Z d dZ ddZ ddZddZddZddZddZddZddZdd Zd!d"Zd#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.ZdS)/ MinidumpShellzBWelcome to the minidump shell. Type help or ? to list commands. z [minidump] NrcCs t||_|j|_dS)zOpens minidump fileN) MinidumpFileparsemini get_readerget_buffered_readerreader)selffilenamerrrdo_opens zMinidumpShell.do_opencC$|jjdurtt|jjdSdS)z$Shows PEB information (if available)N)rpebprintr rargsrrrdo_peb  zMinidumpShell.do_pebcC\|jjdurtt|jj|jjdurtt|jj|jjdur,tt|jjdSdS)z+Lists all thread information (if available)N)rthreadsrr threads_ex thread_inforrrr do_threads%   zMinidumpShell.do_threadscCr#)zLists all memory segmentsN)rmemory_segmentsrr memory_segments_64 memory_inforrrr do_memory.r(zMinidumpShell.do_memorycC@|jjdurtt|jj|jjdurtt|jjdSdS)z?Lists all loaded and unloaded module information (if available)N)rmodulesrr unloaded_modulesrrrr do_modules7  zMinidumpShell.do_modulescCr)zShows sysinfo (if available)N)rsysinforr rrrr do_sysinfo>r"zMinidumpShell.do_sysinfocCr)z*Shows exception information (if available)N)r exceptionrr rrrr do_exceptionCr"zMinidumpShell.do_exceptioncCr-)zLists all comments (if any)N)r comment_arr comment_wrrrr do_commentsHr1zMinidumpShell.do_commentscCr)z Lists all handles (if available)N)rhandlesrr rrrr do_handlesOr"zMinidumpShell.do_handlescCr)z+Lists all miscellaneous info (if available)N)r misc_inforr rrrrdo_miscTr"zMinidumpShell.do_misccCsdS)QuitTrrrrrdo_quitZszMinidumpShell.do_quitcC |dSr=Nr>rrrrdo_exit] zMinidumpShell.do_exitcCr?r@rArrrrdo_q`rCzMinidumpShell.do_qcCst||_dS)zIChanges the hexdump print size to the given bytes/line size (default: 16)N)r hexdump_size)r printsizerrr do_printsizeeszMinidumpShell.do_printsizecCs<|j}|jjj}||}dt|t|t|f|_dS)Nz [%s %s+%s] )rtellcurrent_segment start_addresshexprompt)rr poscurrent_segment_startsegment_relative_positionrrr update_promptis   zMinidumpShell.update_promptcCs*|j}|dur tdtt|dS)zIShows/refreshes the current position in the process' virtual memory spaceNzRReader not yet positioned! Issue a "move" command with the desired memory address!)rrHrrK)rr rrrrdo_tellos zMinidumpShell.do_tellcCs"t|}|j||ddS)z>Sets the current position in the process' virtual memory spaceN)rrmoverP)rpositionrMrrrdo_movevs zMinidumpShell.do_movecCBt|}|j}|j|}tt||jd|d|ddS)zePerforms a read of 'count' bytes from the current position and updates the cursor with the bytes read.lengthsepstartN)rrrHreadrrrErPrcount pos_beforedatarrrdo_read|   zMinidumpShell.do_readcC4|j}td|tdt||ddS)zReads a signed integer starting the current position and updates the cursor with the bytes read. The integer size is determined automatically by the processor architecture information from the dump fileD: %sH: %sN)rread_intrrKrPrr r_rrrdo_readi  zMinidumpShell.do_readicCrb)zReads an unsigned integer starting the current position and updates the cursor with the bytes read. The integer size is determined automatically by the processor architecture information from the dump filercrdN)r read_uintrrKrPrfrrr do_readuirhzMinidumpShell.do_readuicCrU)zYPerforms a read of 'count' bytes from the current position but doesn't update the cursor.rVrWN)rrrHpeekrrrErPr\rrrdo_peekrazMinidumpShell.do_peek)__name__ __module__ __qualname__introrLrrrErr!r'r,r0r3r5r8r:r<r>rBrDrGrPrQrTr`rgrjrlrrrrrs6   rcCsPddl}|jdd}|jdddd|}t}|jr"||j|dS)NrzA parser for minidumnp files) descriptionz-fz--minidumpfilez&path to the minidump file of lsass.exe)help)argparseArgumentParser add_argument parse_argsr minidumpfilercmdloop)rsparserr shellrrrmains   r{__main__) cmdminidump.minidumpfileminidump.common_structsrrCmdrr{rmrrrrs