예제 #1
0
    def _init2(self):
        log.debug('[+] HeapContext on heap 0x%x', self.heap.get_marked_heap_address())
        # Check that cache folder exists
        if not os.access(config.get_cache_folder_name(self.dumpname), os.F_OK):
            os.mkdir(config.get_cache_folder_name(self.dumpname))
        # we need a heap walker to parse all allocations
        finder = self.memory_handler.get_heap_finder()
        heap_walker = finder.get_heap_walker(self.heap)

        log.debug('[+] Searching pointers in heap')
        # get all pointers found in from allocated space.
        all_offsets, all_values = self.get_heap_pointers_from_allocated(heap_walker)
        self._pointers_values = all_values
        self._pointers_offsets = all_offsets

        log.debug('[+] Gathering allocated heap chunks')
        res = utils.cache_get_user_allocations(self, heap_walker)
        self._structures_addresses, self._structures_sizes = res

        # clean a bit the open fd's
        self.memory_handler.reset_mappings()

        #if self.memory_handler.get_target_platform().get_os_name() not in ['winxp', 'win7']:
        #    log.info('[+] Reversing function pointers names')
        #    # TODO in reversers
        #    # dict(libdl.reverseLocalFonctionPointerNames(self) )
        #    self._function_names = dict()
        return
예제 #2
0
    def _init2(self):
        log.debug('[+] HeapContext on heap 0x%x', self._heap_start)
        # Check that cache folder exists
        config.create_cache_folder(self.dumpname)

        # re-open the heap walker
        heap_mapping = self.memory_handler.get_mapping_for_address(self._heap_start)
        finder = self.memory_handler.get_heap_finder()
        self.walker = finder.get_heap_walker(heap_mapping)

        # we need a heap walker to parse all allocations
        log.debug('[+] Searching pointers in heap')
        # get all pointers found in from allocated space.
        all_offsets, all_values = self.get_heap_pointers_from_allocated(self.walker)
        self._pointers_values = all_values
        self._pointers_offsets = all_offsets

        log.debug('[+] Gathering allocated heap chunks')
        res = utils.cache_get_user_allocations(self, self.walker)
        self._structures_addresses, self._structures_sizes = res

        # clean a bit the open fd's
        self.walker = None
        self.memory_handler.reset_mappings()
        # CAUTION: all heap walker, mappings are resetted.
        # Segmentation Fault will ensue if we don't restore heap walkers.
        heap_mapping = self.memory_handler.get_mapping_for_address(self._heap_start)
        finder = self.memory_handler.get_heap_finder()
        self.walker = finder.get_heap_walker(heap_mapping)


        #if self.memory_handler.get_target_platform().get_os_name() not in ['winxp', 'win7']:
        #    log.info('[+] Reversing function pointers names')
        #    # TODO in reversers
        #    # dict(libdl.reverseLocalFonctionPointerNames(self) )
        #    self._function_names = dict()
        return
예제 #3
0
    def _init2(self):
        log.debug('[+] HeapContext on heap 0x%x', self._heap_start)
        # Check that cache folder exists
        config.create_cache_folder(self.dumpname)

        # re-open the heap walker
        heap_mapping = self.memory_handler.get_mapping_for_address(self._heap_start)
        finder = self.memory_handler.get_heap_finder()
        self.walker = finder.get_heap_walker(heap_mapping)

        # we need a heap walker to parse all allocations
        log.debug('[+] Searching pointers in heap')
        # get all pointers found in from allocated space.
        all_offsets, all_values = self.get_heap_pointers_from_allocated(self.walker)
        self._pointers_values = all_values
        self._pointers_offsets = all_offsets

        log.debug('[+] Gathering allocated heap chunks')
        res = utils.cache_get_user_allocations(self, self.walker)
        self._structures_addresses, self._structures_sizes = res

        # clean a bit the open fd's
        self.walker = None
        self.memory_handler.reset_mappings()
        # CAUTION: all heap walker, mappings are resetted.
        # Segmentation Fault will ensue if we don't restore heap walkers.
        heap_mapping = self.memory_handler.get_mapping_for_address(self._heap_start)
        finder = self.memory_handler.get_heap_finder()
        self.walker = finder.get_heap_walker(heap_mapping)


        #if self.memory_handler.get_target_platform().get_os_name() not in ['winxp', 'win7']:
        #    log.info('[+] Reversing function pointers names')
        #    # TODO in reversers
        #    # dict(libdl.reverseLocalFonctionPointerNames(self) )
        #    self._function_names = dict()
        return