Exemple #1
0
    def check_file(self):
        """Checks the base file handle for sanity."""

        self.as_assert(self.base, "Must stack on another address space")

        ## Must start with the magic PAGEDUMP
        self.as_assert((self.base.read(0, 8) == 'PAGEDUMP'),
                       "Header signature invalid")

        self.profile = crashdump.CrashDump32Profile(session=self.session)

        self.header = self.profile.Object("_DMP_HEADER",
                                          offset=self.offset,
                                          vm=self.base)

        if self.header.DumpType != "Full Dump":
            raise IOError("This is not a full memory crash dump. "
                          "Kernel crash dumps are not supported.")
Exemple #2
0
    def check_file(self):
        """Checks the base file handle for sanity."""

        self.as_assert(self.base, "Must stack on another address space")

        # Must start with the magic PAGEDUMP
        self.as_assert((self.base.read(0, 8) == b'PAGEDUMP'),
                       "Header signature invalid")

        self.profile = crashdump.CrashDump32Profile(session=self.session)

        self.header = self.profile.Object("_DMP_HEADER",
                                          offset=self.offset,
                                          vm=self.base)

        if self.header.DumpType != "Full Dump":
            # Here we rely on the WindowsCrashBMP AS to run before us. Therefore
            # we fail hard if this is not a valid legacy crash format.
            raise IOError("This is not a full memory crash dump. "
                          "Kernel crash dumps are not supported.")