コード例 #1
0
ファイル: core.py プロジェクト: shaobingyang/rekall
    def render(self, renderer):
        if self.offset == None:
            renderer.format("Error: {0}\n", self.offset.reason)
            return

        # Dump some data from the address space.
        data = self.address_space.read(self.offset, self.width * self.rows)

        renderer.table_header([("Offset", "offset", "[addr]"),
                               ("Hex", "hex", "^" + str(3 * self.width)),
                               ("Data", "data", "^" + str(self.width)),
                               ("Comment", "comment", "")],
                              suppress_headers=self.suppress_headers)

        offset = 0
        resolver = self.session.address_resolver
        for offset, hexdata, translated_data in utils.Hexdump(
                data, width=self.width):

            nearest_offset, name = resolver.get_nearest_constant_by_address(
                offset + self.offset)

            relative_offset = offset + self.offset - nearest_offset
            if relative_offset < 10:
                comment = "%s + %s" % (name, relative_offset)
            else:
                comment = ""

            renderer.table_row(self.offset + offset, hexdata,
                               "".join(translated_data), comment)

        # Advance the offset so we can continue from this offset next time we
        # get called.
        self.offset += offset
コード例 #2
0
ファイル: core.py プロジェクト: shaobingyang/rekall
    def render(self, renderer):
        renderer.table_header([("Offset", "offset", "[addr]"),
                               ("Hex", "hex", "^" + str(3 * self.context)),
                               ("Data", "data", "^" + str(self.context)),
                               ("Comment", "comment", "")])

        resolver = self.session.address_resolver
        offset = self.offset
        while offset < self.offset + self.limit:
            data = self.address_space.read(offset, 4096)
            for idx in self._GenerateHits(data):
                for dump_offset, hexdata, translated_data in utils.Hexdump(
                        data[idx - 20:idx + 20], width=self.context):
                    comment = ""
                    nearest_offset, symbol = (
                        resolver.get_nearest_constant_by_address(offset + idx))

                    if symbol:
                        comment = "%s+0x%X" % (symbol,
                                               offset + idx - nearest_offset)

                    renderer.table_row(offset + idx - 20 + dump_offset,
                                       hexdata, "".join(translated_data),
                                       comment)

            offset += len(data)

        self.offset = offset
コード例 #3
0
 def as_hex(self):
     """Format the clipboard contents as a hexdump"""
     data = ''.join([chr(c) for c in self.abData])
     return "".join([
         "{0:#x}  {1:<48}  {2}\n".format(self.abData.obj_offset + o, h,
                                         ''.join(c))
         for o, h, c in utils.Hexdump(data)
     ])
コード例 #4
0
ファイル: base_objects.py プロジェクト: dekior/rekall
    def render_row(self, item, hex_width=None, **options):
        if hex_width is None:
            hex_width = self.session.GetParameter("hexdump_width", 8)

        data = item.value
        highlights = item.highlights or []
        hex_highlights = []
        for x, y, f, b in highlights:
            hex_highlights.append((3 * x, 3 * y, f, b))

        hexcell = text.Cell(width=hex_width * 3,
                            highlights=hex_highlights,
                            colorizer=self.renderer.colorizer)
        datacell = text.Cell(width=hex_width,
                             highlights=highlights,
                             colorizer=self.renderer.colorizer)

        for _, hexdata, translated_data in utils.Hexdump(data,
                                                         width=hex_width):
            hexcell.append_line(hexdata)
            datacell.append_line("".join(translated_data))

        return text.JoinedCell(hexcell, datacell)