mdmp.h File Reference

#include <rz_types.h>
#include <rz_util.h>
#include <rz_lib.h>
#include <rz_bin.h>
#include "mdmp_specs.h"
#include "mdmp_pe.h"
#include "mdmp_pe64.h"

Go to the source code of this file.

Classes
struct	rz_bin_mdmp_obj
struct	rz_bin_mdmp_obj::minidump_streams

Functions
struct rz_bin_mdmp_obj *	rz_bin_mdmp_new_buf (RzBuffer *buf)
void	rz_bin_mdmp_free (struct rz_bin_mdmp_obj *obj)
ut64	rz_bin_mdmp_get_paddr (struct rz_bin_mdmp_obj *obj, ut64 vaddr)
ut32	rz_bin_mdmp_get_perm (struct rz_bin_mdmp_obj *obj, ut64 vaddr)
struct minidump_memory_info *	rz_bin_mdmp_get_mem_info (struct rz_bin_mdmp_obj *obj, ut64 vaddr)

Function Documentation

rz_bin_mdmp_free()

void rz_bin_mdmp_free

(

struct rz_bin_mdmp_obj *

obj

)

Definition at line 97 of file mdmp.c.

                                                   {
    if (!obj) {
        return;
    }
 
    rz_list_free(obj->streams.ex_threads);
    rz_list_free(obj->streams.memories);
    rz_list_free(obj->streams.memories64.memories);
    rz_list_free(obj->streams.memory_infos);
    rz_list_free(obj->streams.modules);
    rz_list_free(obj->streams.operations);
    rz_list_free(obj->streams.thread_infos);
    rz_list_free(obj->streams.threads);
    rz_list_free(obj->streams.token_infos);
    rz_list_free(obj->streams.unloaded_modules);
    free(obj->streams.exception);
    free(obj->streams.system_info);
    free(obj->streams.comments_a);
    free(obj->streams.comments_w);
    free(obj->streams.handle_data);
    free(obj->streams.function_table);
    free(obj->streams.misc_info.misc_info_1);
 
    rz_list_free(obj->pe32_bins);
    rz_list_free(obj->pe64_bins);
 
    rz_buf_free(obj->b);
    free(obj->hdr);
    obj->b = NULL;
    free(obj);
 
    return;
}

References rz_bin_mdmp_obj::b, rz_bin_mdmp_obj::minidump_streams::comments_a, rz_bin_mdmp_obj::minidump_streams::comments_w, rz_bin_mdmp_obj::minidump_streams::ex_threads, rz_bin_mdmp_obj::minidump_streams::exception, free(), rz_bin_mdmp_obj::minidump_streams::function_table, rz_bin_mdmp_obj::minidump_streams::handle_data, rz_bin_mdmp_obj::hdr, rz_bin_mdmp_obj::minidump_streams::memories, rz_bin_mdmp_obj::minidump_streams::memories64, rz_bin_mdmp_obj::minidump_streams::memory_infos, rz_bin_mdmp_obj::minidump_streams::misc_info, rz_bin_mdmp_obj::minidump_streams::misc_info_1, rz_bin_mdmp_obj::minidump_streams::modules, NULL, rz_bin_mdmp_obj::minidump_streams::operations, rz_bin_mdmp_obj::pe32_bins, rz_bin_mdmp_obj::pe64_bins, rz_buf_free(), rz_list_free(), rz_bin_mdmp_obj::streams, rz_bin_mdmp_obj::minidump_streams::system_info, rz_bin_mdmp_obj::minidump_streams::thread_infos, rz_bin_mdmp_obj::minidump_streams::threads, rz_bin_mdmp_obj::minidump_streams::token_infos, and rz_bin_mdmp_obj::minidump_streams::unloaded_modules.

Referenced by destroy(), and rz_bin_mdmp_new_buf().

rz_bin_mdmp_get_mem_info()

struct minidump_memory_info* rz_bin_mdmp_get_mem_info	(	struct rz_bin_mdmp_obj *	obj,
		ut64	vaddr
	)

Definition at line 30 of file mdmp.c.

                                                                                               {
    struct minidump_memory_info *mem_info;
    RzListIter *it;
 
    if (!obj) {
        return NULL;
    }
 
    rz_list_foreach (obj->streams.memory_infos, it, mem_info) {
        if (mem_info->allocation_base && vaddr == mem_info->base_address) {
            return mem_info;
        }
    }
 
    return NULL;
}

References rz_bin_mdmp_obj::minidump_streams::memory_infos, NULL, and rz_bin_mdmp_obj::streams.

Referenced by mem(), and rz_bin_mdmp_get_perm().

rz_bin_mdmp_get_paddr()

ut64 rz_bin_mdmp_get_paddr	(	struct rz_bin_mdmp_obj *	obj,
		ut64	vaddr
	)

Definition at line 11 of file mdmp.c.

                                                                    {
    /* FIXME: Will only resolve exact matches, probably no need to fix as
    ** this function will become redundant on the optimisation stage */
    struct minidump_memory_descriptor64 *memory;
    ut64 index, paddr = 0;
    RzListIter *it;
 
    /* Loop through the memories sections looking for a match */
    index = obj->streams.memories64.base_rva;
    rz_list_foreach (obj->streams.memories64.memories, it, memory) {
        if (vaddr == memory->start_of_memory_range) {
            paddr = index;
            break;
        }
        index += memory->data_size;
    }
    return paddr;
}

References rz_bin_mdmp_obj::minidump_streams::base_rva, rz_bin_mdmp_obj::minidump_streams::memories, rz_bin_mdmp_obj::minidump_streams::memories64, rz_bin_mdmp_obj::streams, and ut64().

Referenced by rz_bin_mdmp_init_pe_bins(), and sections().

rz_bin_mdmp_get_perm()

ut32 rz_bin_mdmp_get_perm	(	struct rz_bin_mdmp_obj *	obj,
		ut64	vaddr
	)

Definition at line 47 of file mdmp.c.

                                                                   {
    struct minidump_memory_info *mem_info;
 
    if (!(mem_info = rz_bin_mdmp_get_mem_info(obj, vaddr))) {
        /* if there is no mem info in the dump, assume default permission */
        return RZ_PERM_R;
    }
 
    /* FIXME: Have I got these mappings right, I am not sure I have!!! */
 
    switch (mem_info->protect) {
    case MINIDUMP_PAGE_READONLY:
        return RZ_PERM_R;
    case MINIDUMP_PAGE_READWRITE:
        return RZ_PERM_RW;
    case MINIDUMP_PAGE_EXECUTE:
        return RZ_PERM_X;
    case MINIDUMP_PAGE_EXECUTE_READ:
        return RZ_PERM_RX;
    case MINIDUMP_PAGE_EXECUTE_READWRITE:
        return RZ_PERM_RWX;
    case MINIDUMP_PAGE_NOACCESS:
    case MINIDUMP_PAGE_WRITECOPY:
    case MINIDUMP_PAGE_EXECUTE_WRITECOPY:
    case MINIDUMP_PAGE_GUARD:
    case MINIDUMP_PAGE_NOCACHE:
    case MINIDUMP_PAGE_WRITECOMBINE:
    default:
        return 0;
    }
}

References MINIDUMP_PAGE_EXECUTE, MINIDUMP_PAGE_EXECUTE_READ, MINIDUMP_PAGE_EXECUTE_READWRITE, MINIDUMP_PAGE_EXECUTE_WRITECOPY, MINIDUMP_PAGE_GUARD, MINIDUMP_PAGE_NOACCESS, MINIDUMP_PAGE_NOCACHE, MINIDUMP_PAGE_READONLY, MINIDUMP_PAGE_READWRITE, MINIDUMP_PAGE_WRITECOMBINE, MINIDUMP_PAGE_WRITECOPY, rz_bin_mdmp_get_mem_info(), RZ_PERM_R, RZ_PERM_RW, RZ_PERM_RWX, RZ_PERM_RX, and RZ_PERM_X.

Referenced by maps(), and mem().

rz_bin_mdmp_new_buf()

struct rz_bin_mdmp_obj* rz_bin_mdmp_new_buf

(

RzBuffer *

buf

)

Definition at line 1389 of file mdmp.c.

                                                           {
    bool fail = false;
    struct rz_bin_mdmp_obj *obj = RZ_NEW0(struct rz_bin_mdmp_obj);
    if (!obj) {
        return NULL;
    }
    obj->kv = sdb_new0();
    obj->size = (ut32)rz_buf_size(buf);
 
    fail |= (!(obj->streams.ex_threads = rz_list_new()));
    fail |= (!(obj->streams.memories = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.memories64.memories = rz_list_new()));
    fail |= (!(obj->streams.memory_infos = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.modules = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.operations = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.thread_infos = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.token_infos = rz_list_newf((RzListFree)free)));
    fail |= (!(obj->streams.threads = rz_list_new()));
    fail |= (!(obj->streams.unloaded_modules = rz_list_newf((RzListFree)free)));
 
    fail |= (!(obj->pe32_bins = rz_list_newf(rz_bin_mdmp_free_pe32_bin)));
    fail |= (!(obj->pe64_bins = rz_list_newf(rz_bin_mdmp_free_pe64_bin)));
 
    if (fail) {
        rz_bin_mdmp_free(obj);
        return NULL;
    }
 
    obj->b = rz_buf_ref(buf);
    if (!rz_bin_mdmp_init(obj)) {
        rz_bin_mdmp_free(obj);
        return NULL;
    }
 
    return obj;
}

References rz_bin_mdmp_obj::b, rz_bin_mdmp_obj::minidump_streams::ex_threads, fail, free(), rz_bin_mdmp_obj::kv, rz_bin_mdmp_obj::minidump_streams::memories, rz_bin_mdmp_obj::minidump_streams::memories64, rz_bin_mdmp_obj::minidump_streams::memory_infos, rz_bin_mdmp_obj::minidump_streams::modules, NULL, rz_bin_mdmp_obj::minidump_streams::operations, rz_bin_mdmp_obj::pe32_bins, rz_bin_mdmp_obj::pe64_bins, rz_bin_mdmp_free(), rz_bin_mdmp_free_pe32_bin(), rz_bin_mdmp_free_pe64_bin(), rz_bin_mdmp_init(), rz_buf_ref(), rz_buf_size(), rz_list_new(), rz_list_newf(), RZ_NEW0, sdb_new0(), rz_bin_mdmp_obj::size, rz_bin_mdmp_obj::streams, rz_bin_mdmp_obj::minidump_streams::thread_infos, rz_bin_mdmp_obj::minidump_streams::threads, rz_bin_mdmp_obj::minidump_streams::token_infos, and rz_bin_mdmp_obj::minidump_streams::unloaded_modules.

Referenced by load_buffer().