def __init__(self, trace): self.trace = trace self.archname = trace.getMeta('Architecture') self.arch = envi.getArchModule(self.archname) self.emu = self.arch.getEmulator() self.memcache = e_mem.MemoryCache(self.trace) plat = trace.getMeta('Platform') # gotta setup fs at least... if plat == 'windows' and self.archname in ('i386', 'amd64'): # so 32 and 64 bit are flipped. In x86-land FS:[0] points to the TIB. On x64, it's GS:[0] that points to the # TEB tid = trace.getCurrentThread() tinfo = trace.getThreads().get(tid) if self.archname == 'i386': self.emu.setSegmentInfo(e_i386.SEG_FS, tinfo, 0xffffffff) elif self.archname == 'amd64': self.emu.setSegmentInfo(e_i386.SEG_GS, tinfo, 0xffffffff) # Monkey patch the emulator's read methods self.emu.readMemory = self.memcache.readMemory self.emu.writeMemory = self.memcache.writeMemory self.emu.getMemoryMap = self.memcache.getMemoryMap self.emu.getMemoryMaps = self.memcache.getMemoryMaps self.emu.parseOpcode = parseOpcode.__get__(self.emu) regctx = trace.getRegisterContext() self.emu.setRegisterSnap(regctx.getRegisterSnap())
def __init__(self, trace): self.trace = trace self.archname = trace.getMeta('Architecture') self.arch = envi.getArchModule(self.archname) self.emu = self.arch.getEmulator() self.memcache = e_mem.MemoryCache(self.trace) plat = trace.getMeta('Platform') # gotta setup fs at least... if plat == 'windows' and self.archname in ('i386', 'amd64'): tid = trace.getCurrentThread() tinfo = trace.getThreads().get(tid) self.emu.setSegmentInfo(e_i386.SEG_FS, tinfo, 0xffffffff) # Monkey patch the emulator's read methods self.emu.readMemory = self.memcache.readMemory self.emu.writeMemory = self.memcache.writeMemory self.emu.getMemoryMap = self.memcache.getMemoryMap self.emu.getMemoryMaps = self.memcache.getMemoryMaps regctx = trace.getRegisterContext() self.emu.setRegisterSnap(regctx.getRegisterSnap())
def test_envi_memory_cache(self): mem = e_mem.MemoryObject() mem.addMemoryMap(0x41410000, e_mem.MM_RWX, 'stack', 'B'*16384) cache = e_mem.MemoryCache(mem) self.assertEqual(cache.readMemory(0x41410041, 30), 'B' * 30) cache.writeMemory(0x41410041, 'V') self.assertEqual(cache.readMemory(0x41410040, 3), 'BVB') self.assertTrue(cache.isDirtyPage(0x41410040)) self.assertEqual(mem.readMemory(0x41410040, 3), 'BBB') # Test a cross page read self.assertEqual(mem.readMemory(0x41410000 + (cache.pagesize - 2), 4), 'BBBB')