Ejemplo n.º 1
0
    def __init__(self, trace):

        self.trace = trace

        self.archname = trace.getMeta('Architecture')
        self.arch = envi.getArchModule(self.archname)

        self.emu = self.arch.getEmulator()
        self.memcache = e_mem.MemoryCache(self.trace)

        plat = trace.getMeta('Platform')

        # gotta setup fs at least...
        if plat == 'windows' and self.archname in ('i386', 'amd64'):
            # so 32 and 64 bit are flipped. In x86-land FS:[0] points to the TIB. On x64, it's GS:[0] that points to the
            # TEB
            tid = trace.getCurrentThread()
            tinfo = trace.getThreads().get(tid)
            if self.archname == 'i386':
                self.emu.setSegmentInfo(e_i386.SEG_FS, tinfo, 0xffffffff)
            elif self.archname == 'amd64':
                self.emu.setSegmentInfo(e_i386.SEG_GS, tinfo, 0xffffffff)

        # Monkey patch the emulator's read methods
        self.emu.readMemory = self.memcache.readMemory
        self.emu.writeMemory = self.memcache.writeMemory
        self.emu.getMemoryMap = self.memcache.getMemoryMap
        self.emu.getMemoryMaps = self.memcache.getMemoryMaps
        self.emu.parseOpcode = parseOpcode.__get__(self.emu)

        regctx = trace.getRegisterContext()
        self.emu.setRegisterSnap(regctx.getRegisterSnap())
Ejemplo n.º 2
0
    def __init__(self, trace):

        self.trace = trace

        self.archname = trace.getMeta('Architecture')
        self.arch = envi.getArchModule(self.archname)

        self.emu = self.arch.getEmulator()
        self.memcache = e_mem.MemoryCache(self.trace)

        plat = trace.getMeta('Platform')

        # gotta setup fs at least...
        if plat == 'windows' and self.archname in ('i386', 'amd64'):
            tid = trace.getCurrentThread()
            tinfo = trace.getThreads().get(tid)
            self.emu.setSegmentInfo(e_i386.SEG_FS, tinfo, 0xffffffff)

        # Monkey patch the emulator's read methods
        self.emu.readMemory = self.memcache.readMemory
        self.emu.writeMemory = self.memcache.writeMemory
        self.emu.getMemoryMap = self.memcache.getMemoryMap
        self.emu.getMemoryMaps = self.memcache.getMemoryMaps

        regctx = trace.getRegisterContext()
        self.emu.setRegisterSnap(regctx.getRegisterSnap())
Ejemplo n.º 3
0
    def test_envi_memory_cache(self):
        mem = e_mem.MemoryObject()
        mem.addMemoryMap(0x41410000, e_mem.MM_RWX, 'stack', 'B'*16384)

        cache = e_mem.MemoryCache(mem)
        self.assertEqual(cache.readMemory(0x41410041, 30), 'B' * 30)

        cache.writeMemory(0x41410041, 'V')

        self.assertEqual(cache.readMemory(0x41410040, 3), 'BVB')
        self.assertTrue(cache.isDirtyPage(0x41410040))
        self.assertEqual(mem.readMemory(0x41410040, 3), 'BBB')
        # Test a cross page read
        self.assertEqual(mem.readMemory(0x41410000 + (cache.pagesize - 2), 4), 'BBBB')