Beispiel #1
0
    def invoke(self, arg, from_tty):

        try:
            force = False
            hexdump = False
            res = None
            if arg == '':
                self.help()
                return
            for item in arg.split():
                if item.find("-f") != -1:
                    force = True
                if item.find("-x") != -1:
                    hexdump = True
                if item.startswith("0x") or item.startswith("$"):
                    res = self._parse_base_offset(item)
                if item.find("-h") != -1:
                    self.help()
                    return
            if res == None:
                self.logmsg('No valid address or a register (+ optional offset) supplied"')
                self.help()
                return
            p = res[0] + res[1]
            p = lmp.mp_header(addr=p, allocator="dlmalloc", inuse=True, binelement=True, mh_version=self.mh_version)
            self.logmsg(p)
            if hexdump:
                self.print_hexdump(p)
        except Exception as e:
            h.show_last_exception()
Beispiel #2
0
    def invoke(self, arg, from_tty):
        try:
            verbose = 0
            size = 0
            p = None
            mstate_addr = None
            mh_addr = None
            search_val = None
            search_offset = 0
            search_depth = 0
            count = 0
            P_found = p_found = s_found = o_found = c_found = depth_found = False
            list_all_chunks = False
            if arg == '':
                self.help()
                return
            for item in arg.split():
                if P_found:
                    P_found = False
                    if item.find("0x") != -1:
                        mh_addr = int(item, 16)
                    else:
                        mh_addr = int(item)
                elif p_found:
                    p_found = False
                    if item.find("0x") != -1:
                        mstate_addr = int(item, 16)
                    else:
                        mstate_addr = int(item)
                elif o_found:
                    o_found = False
                    if item.find("0x") != -1:
                        search_offset = int(item, 16)
                    else:
                        search_offset = int(item)
                elif s_found:
                    s_found = False
                    if item.find("0x") != -1:
                        search_val = item
                elif c_found:
                    c_found = False
                    if item.find("0x") != -1:
                        count = int(item, 16)
                    else:
                        count = int(item)
                elif depth_found:
                    depth_found = False
                    if item.find("0x") != -1:
                        search_depth = item
                    else:
                        search_depth = int(item)
                elif item.find("-v") != -1:
                    verbose += 1
                elif item.find("-p") != -1:
                    p_found = True
                elif item.find("-P") != -1:
                    P_found = True
                elif item.find("-l") != -1:
                    list_all_chunks = True
                elif item.find("-s") != -1:
                    s_found = True
                elif item.find("-c") != -1:
                    c_found = True
                elif item.find("--depth") != -1:
                    depth_found = True
                elif item.find("-o") != -1:
                    o_found = True
                elif item.find("0x") != -1:
                    size = int(item, 16)
                elif item.find("-h") != -1:
                    self.help()
                    return

            if mh_addr != None:
                head = lmp.mp_header(addr=mh_addr, binelement=True, mh_version=self.mh_version)
            else:
                if size == 0:
                    self.logmsg("ERROR: No size supplied?")
                    self.help()
                    return

                if mstate_addr == None and lmp.mp_mstate_cached == None:
                    self.logmsg("WARN: Can't show mstate entry without specified "
                           "(-p) or cached mstate address")
                    self.logmsg("WARN: set with mpmstate <addr> or find with mpbin")
                    self.help()
                    return

                if mstate_addr != None:
                    if lmp.mp_mstate_cached != None and \
                            lmp.mp_mstate_cached.address == mstate_addr:
                        mstate = lmp.mp_mstate_cached
                    else:
                        mstate = mp_mstate(mstate_addr)
                        if not mstate.initOK:
                            self.logmsg("ERROR: supplied a bad mstate address?")
                            self.help()
                            return
                    lmp.mp_mstate_cached = mstate
                else:
                    mstate = lmp.mp_mstate_cached

                head = mstate.bin_for_sz(size)

            if verbose:
                self.logmsg(head)
            else:
                if head.mh_len != 0:
                    if search_val == None:
                        self.logmsg(head.info())
                else:
                    print("[000] " + head.info() + " [BIN HEAD]")
            cur = head
            if count == 0:
                count = 0x7fffffff

            if cur.mh_fd_link == 0:
                self.logmsg("<<< EMPTY >>>")
                self.logmsg("Update mstate cache if you think this is wrong")

            show_head = False
            if cur.mh_len != 0:
                show_head = True
            i = 0
            while cur.mh_fd_link != 0 and count != 0:
                i += 1
                prefix = "[%03d] " % i
                count -= 1
                suffix = ""
                if not show_head:
                    tmp = lmp.mp_header(addr=cur.mh_fd_link, binelement=True, mh_version=self.mh_version)
                    if not tmp.initOK:
                        self.logmsg("ERROR: Invalid mp_header found at 0x%x" % cur.mh_fd_link)
                        break
                    cur = tmp
                else:
                    show_head = False
                if search_val != None:
                    # Don't print if the chunk doesn't have the pattern
                    if not cur.search_chunk(cur, search_val, depth=search_depth):
                        if not list_all_chunks:
                            continue
                        else:
                            suffix = " [NO MATCH]"
                    else:
                        if list_all_chunks:
                            suffix = " [MATCH]"
                if verbose:
                    print(cur)
                else:
                    print(prefix + cur.info() + suffix)
        except Exception as e:
            h.show_last_exception()
Beispiel #3
0
    def invoke(self, arg, from_tty):
        try:
            if arg == '':
                self.help()
                return
            res = None
            for item in arg.split():
                if item.startswith("0x") or item.startswith("$"):
                    res = self._parse_base_offset(item)
                if item.find("-h") != -1:
                    self.help()
                    return
            if res == None:
                self.logmsg('No valid address or register (+ optional offset) supplied"')
                self.help()
                return
            p = res[0] + res[1]
            orig_m = m = lmp.mp_header(addr=p, inuse=True, binelement=True, allocator="dlmalloc", mh_version=self.mh_version)
            if not m.initOK:
                self.logmsg("Invalid lmp.mp_header at 0x%x" % p)
                return
            while True:
                if m.mh_bk_link == 0:
                    bin_i_addr = m.address
                    self.logmsg("Found bin start at 0x%x" % bin_i_addr)
                    bin_i = lmp.mp_header(addr=bin_i_addr, inuse=True, binelement=True, allocator="dlmalloc", mh_version=self.mh_version)
                    # Just get an object reference. Won't be initialized
                    mstate = lmp.mp_mstate(addr=None)
                    mstate_addr = mstate.compute_base_addr(bin_i_addr, orig_m.mh_len)
                    # XXX - above fails on 64-bit asa924-smp real device
                    #if lmp.mp_mstate_cached == None or \
                    #        lmp.mp_mstate_cached.address != mstate_addr:
                    if lmp.mp_mstate_cached == None:
                        lmp.mp_mstate(addr=mstate_addr)
                        self.logmsg("Cached new mp_mstate @ 0x%x" % mstate_addr)
                    break
                p = m.mh_bk_link
                if p != None:
                    m = lmp.mp_header(addr=p, inuse=True, binelement=True, allocator="dlmalloc", mh_version=self.mh_version)
                    if not m.initOK:
                        self.logmsg("Invalid lmp.mp_header at 0x%x" % p)
                        return
                else:
                    self.logmsg("ERROR: Chunk has no valid mh_bk_link")
                    return

            if lmp.mp_mstate_cached == None:
                self.logmsg("WARN: Can't show mstate entry without cached mstate address")
                self.logmsg("WARN: set with mpmstate <addr> or find with mpbin")
                return
            count = 0
            for b in lmp.mp_mstate_cached.inuse_bins:
                if b == bin_i_addr:
                    break
                count += 1
            string = []
            # calculation for small chunks (<0x1f) is (len >> 3) << 5
            # so (len/8) * 0x20
            if count < 0x20:
                bin_size = count * 8
                string.append("%s%.02d" % ("mp_smallbin[", count))
            # Everything below is derived by compute_tree_index
            # I still can't figure out how to to determine what each index
            # actually is of hand
            else:
                string.append("%s%.02d" % ("mp_treebin[", (count-0x20)))
                # calculation is 0x3f >> (len/256)
                if count == 0x3f:
                    bin_size = 0xffffffff
                else:
                    bin_size = lmp.mp_mstate_cached.treebin_sz[count-0x20]

            string.append("%s%08lx%s%04lx%s%lx" %
                    ("] - sz: 0x",
                        bin_size,
                        " cnt: 0x",
                        lmp.mp_mstate_cached.counters[count],
                        ", mh_fd_link: 0x",
                        bin_i.mh_fd_link))
            if count == 0x3f:
                string.append(" [UNSORTED]")
            self.logmsg(''.join(string))
        except Exception as e:
            h.show_last_exception()