def get_referrers(self, address, maxlen=None): addr = self.profile.address() addr.write(address) pointer_scanner = scan.BaseScanner( address_space=self.session.GetParameter("default_address_space"), session=self.session, checks=[('StringCheck', dict(needle=addr.obj_vm.getvalue()))]) # Just scan the entire userspace address space. This means we might find # hits outside the heap but this is usually useful as it would locate # static pointers in dlls. if maxlen is None: maxlen = self.session.GetParameter("highest_usermode_address") for hit in pointer_scanner.scan(maxlen=maxlen): yield hit
def get_referrers(self, address): addr = self.profile.address() addr.write(address) pointer_scanner = scan.BaseScanner( address_space=self.session.GetParameter("default_address_space"), session=self.session, checks=[('StringCheck', dict(needle=addr.obj_vm.getvalue()))]) inspect_heap = self.session.plugins.inspect_heap() for heap in inspect_heap.GenerateHeaps(): for seg in heap.Segments: seg_start = seg.FirstEntry.obj_offset seg_end = seg.LastValidEntry.v() length = min(seg_end - seg_start, 1024 * 1024 * 10) for hit in pointer_scanner.scan(seg_start, maxlen=length): yield hit