Example #1
0
    def execute(self):
        typ = self.opts.name
        base = self.opts.offset

        tups = []
        for m in gather_members(types, typ):
            offset, tp = get_obj_offset(types, [typ] + m)
            sz = builtin_types[tp][0]
            tups.append((offset, offset + sz, m))
        tups.sort()
        tp_size = obj_size(types, typ)

        hist = [0] * len(tups)
        ips = [set() for i in hist]

        reader = csv.reader(open(self.opts.filename))
        for row in reader:
            try:
                addr, ip, code = int(row[0], 16), int(row[1], 16), int(row[2])
            except ValueError:
                continue

            if code and addr >= base and addr < base + tp_size:
                for i, m in self.find_memb(tups, base, addr):
                    hist[i] += 1
                    if not ip in ips[i]: ips[i].add(ip)
                    #print "%#x %#x %s" % (addr,ip,m)

        #print "index,count,ips # field_name"
        for i in range(len(hist)):
            _, tp = get_obj_offset(types, [typ] + tups[i][2])
            if tp == 'pointer':
                print "%d,%d,%d,%s # %s" % (i, hist[i], len(ips[i]), ",".join(
                    "%x" % j
                    for j in ips[i]), ".".join(str(t) for t in tups[i][2]))
Example #2
0
    def execute(self):
        typ = self.opts.name
        base = self.opts.offset

        tups = []
        for m in gather_members(types, typ):
            offset, tp = get_obj_offset(types, [typ] + m)
            sz = builtin_types[tp][0]
            tups.append((offset, offset + sz, m))
        tups.sort()
        tp_size = obj_size(types, typ)

        hist = [0] * len(tups)
        ips = [set() for i in hist]

        time_interval = 1
        start_ts = None
        end_ts = None
        reader = csv.reader(open(self.opts.filename))
        for row in reader:
            if self.opts.date:
                try:
                    ts, addr, ip = datetime.strptime(row[0], FMT), int(
                        row[1], 16), int(row[2], 16)
                except ValueError:
                    continue

                if not start_ts:
                    start_ts = ts
            else:
                try:
                    addr, ip = int(row[0], 16), int(row[1], 16)
                except ValueError:
                    continue

            if addr >= base and addr < base + tp_size:
                for i, m in self.find_memb(tups, base, addr):
                    hist[i] += 1
                    if not ip in ips[i]: ips[i].add(ip)
                    #print "%#x %#x %s" % (addr,ip,m)
                if self.opts.date:
                    if ts - start_ts > timedelta(minutes=1):
                        # For each minute in the log, print out:
                        #  minute, number of accessed fields
                        print start_ts, ts
                        print time_interval, len([h for h in hist if h != 0])
                        time_interval += 1
                        start_ts += timedelta(minutes=1)

        #print "index,count,ips # field_name"
        if not self.opts.date:
            for i in range(len(hist)):
                print "%d,%d,%d # %s" % (i, hist[i], len(ips[i]), ".".join(
                    str(t) for t in tups[i][2]))
Example #3
0
    def execute(self):
        typ = self.opts.name
        base = self.opts.offset

        tups = []
        for m in gather_members(types, typ):
            offset, tp = get_obj_offset(types, [typ] + m)
            sz = builtin_types[tp][0]
            tups.append((offset,offset+sz,m))
        tups.sort()
        tp_size = obj_size(types, typ)

        hist = [0]*len(tups)
        ips = [set() for i in hist]

        time_interval = 1
        start_ts = None
        end_ts = None
        reader = csv.reader(open(self.opts.filename))
        for row in reader:
            if self.opts.date:
                try:
                    ts, addr, ip = datetime.strptime(row[0], FMT), int(row[1],16),int(row[2],16)
                except ValueError:
                    continue

                if not start_ts:
                    start_ts = ts
            else:
                try:
                    addr, ip = int(row[0],16),int(row[1],16)
                except ValueError:
                    continue

            if addr >= base and addr < base + tp_size:
                for i,m in self.find_memb(tups, base, addr):
                    hist[i] += 1
                    if not ip in ips[i]: ips[i].add(ip)
                    #print "%#x %#x %s" % (addr,ip,m)
                if self.opts.date:
                    if ts - start_ts > timedelta(minutes=1):
                        # For each minute in the log, print out:
                        #  minute, number of accessed fields
                        print start_ts, ts
                        print time_interval, len( [h for h in hist if h != 0] )
                        time_interval += 1
                        start_ts += timedelta(minutes=1)

        #print "index,count,ips # field_name"
        if not self.opts.date:
            for i in range(len(hist)):
                print "%d,%d,%d # %s" % (i,hist[i],len(ips[i]), ".".join(str(t) for t in tups[i][2]))