def test_delRef(self): model.keepRef(1, int, 0xcafecafe) model.keepRef(2, float, 0xcafecafe) model.keepRef(3, str, 0xcafecafe) self.assertTrue( model.hasRef(int,0xcafecafe)) self.assertTrue( model.hasRef(float,0xcafecafe)) self.assertTrue( model.hasRef(str,0xcafecafe)) model.delRef(str, 0xcafecafe) self.assertTrue( model.hasRef(int,0xcafecafe)) self.assertTrue( model.hasRef(float,0xcafecafe)) self.assertFalse( model.hasRef(str,0xcafecafe)) model.delRef(str, 0xcafecafe) self.assertTrue( model.hasRef(int,0xcafecafe)) self.assertTrue( model.hasRef(float,0xcafecafe)) self.assertFalse( model.hasRef(str,0xcafecafe)) model.delRef(int, 0xcafecafe) self.assertFalse( model.hasRef(int,0xcafecafe)) self.assertTrue( model.hasRef(float,0xcafecafe)) self.assertFalse( model.hasRef(str,0xcafecafe)) model.delRef(float, 0xcafecafe) self.assertFalse( model.hasRef(int,0xcafecafe)) self.assertFalse( model.hasRef(float,0xcafecafe)) self.assertFalse( model.hasRef(str,0xcafecafe))
def test_delRef(self): model.keepRef(1, int, 0xcafecafe) model.keepRef(2, float, 0xcafecafe) model.keepRef(3, str, 0xcafecafe) self.assertTrue(model.hasRef(int, 0xcafecafe)) self.assertTrue(model.hasRef(float, 0xcafecafe)) self.assertTrue(model.hasRef(str, 0xcafecafe)) model.delRef(str, 0xcafecafe) self.assertTrue(model.hasRef(int, 0xcafecafe)) self.assertTrue(model.hasRef(float, 0xcafecafe)) self.assertFalse(model.hasRef(str, 0xcafecafe)) model.delRef(str, 0xcafecafe) self.assertTrue(model.hasRef(int, 0xcafecafe)) self.assertTrue(model.hasRef(float, 0xcafecafe)) self.assertFalse(model.hasRef(str, 0xcafecafe)) model.delRef(int, 0xcafecafe) self.assertFalse(model.hasRef(int, 0xcafecafe)) self.assertTrue(model.hasRef(float, 0xcafecafe)) self.assertFalse(model.hasRef(str, 0xcafecafe)) model.delRef(float, 0xcafecafe) self.assertFalse(model.hasRef(int, 0xcafecafe)) self.assertFalse(model.hasRef(float, 0xcafecafe)) self.assertFalse(model.hasRef(str, 0xcafecafe))
def _HEAP_SEGMENT_loadMember(self, attr, attrname, attrtype, mappings, maxDepth): #log.debug('_loadMember attrname : %s'%(attrname)) if attrname == 'LastValidEntry': # isPointerType code. _attrType = model.get_subtype(attrtype) attr_obj_address = utils.getaddress(attr) #### memoryMap = utils.is_valid_address(attr, mappings, _attrType) if (not memoryMap): log.debug("LastValidEntry out of mapping - 0x%lx - ignore " % (attr_obj_address)) return True from haystack.model import getRef, keepRef, delRef # TODO CLEAN ref = getRef(_attrType, attr_obj_address) if ref: #log.debug("%s %s loading from references cache %s/0x%lx"%(attrname,attr,_attrType,attr_obj_address )) #DO NOT CHANGE STUFF SOUPID attr.contents = ref return True #log.debug("%s %s loading from 0x%lx (is_valid_address: %s)"%(attrname,attr,attr_obj_address, memoryMap )) ##### Read the struct in memory and make a copy to play with. ### ERRROR attr.contents=_attrType.from_buffer_copy(memoryMap.readStruct(attr_obj_address, _attrType )) contents = memoryMap.readStruct(attr_obj_address, _attrType) # save that validated and loaded ref and original addr so we dont need to recopy it later keepRef(contents, _attrType, attr_obj_address) #log.debug("%s %s loaded memcopy from 0x%lx to 0x%lx"%(attrname, attr, attr_obj_address, (utils.getaddress(attr)) )) # recursive validation checks on new struct if not bool(attr): log.warning('Member %s is null after copy: %s' % (attrname, attr)) return True # go and load the pointed struct members recursively if not contents.loadMembers(mappings, maxDepth): log.debug('member %s was not loaded' % (attrname)) #invalidate the cache ref. delRef(_attrType, attr_obj_address) return False return True else: return super(_HEAP_SEGMENT, self)._loadMember(attr, attrname, attrtype, mappings, maxDepth)
def _HEAP_SEGMENT_loadMember(self, attr, attrname, attrtype, mappings, maxDepth): # log.debug('_loadMember attrname : %s'%(attrname)) if attrname == "LastValidEntry": # isPointerType code. _attrType = model.get_subtype(attrtype) attr_obj_address = utils.getaddress(attr) #### memoryMap = utils.is_valid_address(attr, mappings, _attrType) if not memoryMap: log.debug("LastValidEntry out of mapping - 0x%lx - ignore " % (attr_obj_address)) return True from haystack.model import getRef, keepRef, delRef # TODO CLEAN ref = getRef(_attrType, attr_obj_address) if ref: # log.debug("%s %s loading from references cache %s/0x%lx"%(attrname,attr,_attrType,attr_obj_address )) # DO NOT CHANGE STUFF SOUPID attr.contents = ref return True # log.debug("%s %s loading from 0x%lx (is_valid_address: %s)"%(attrname,attr,attr_obj_address, memoryMap )) ##### Read the struct in memory and make a copy to play with. ### ERRROR attr.contents=_attrType.from_buffer_copy(memoryMap.readStruct(attr_obj_address, _attrType )) contents = memoryMap.readStruct(attr_obj_address, _attrType) # save that validated and loaded ref and original addr so we dont need to recopy it later keepRef(contents, _attrType, attr_obj_address) # log.debug("%s %s loaded memcopy from 0x%lx to 0x%lx"%(attrname, attr, attr_obj_address, (utils.getaddress(attr)) )) # recursive validation checks on new struct if not bool(attr): log.warning("Member %s is null after copy: %s" % (attrname, attr)) return True # go and load the pointed struct members recursively if not contents.loadMembers(mappings, maxDepth): log.debug("member %s was not loaded" % (attrname)) # invalidate the cache ref. delRef(_attrType, attr_obj_address) return False return True else: return super(_HEAP_SEGMENT, self)._loadMember(attr, attrname, attrtype, mappings, maxDepth)
def _loadMember(self,attr,attrname,attrtype,mappings, maxDepth): # skip static basic data members if not self._isLoadableMember(attr, attrname, attrtype): log.debug("%s %s not loadable bool(attr) = %s"%(attrname,attrtype, bool(attr)) ) return True # load it, fields are valid elif isStructType(attrtype) or isUnionType(attrtype): # DEBUG TEST offset = offsetof(type(self),attrname) log.debug('st: %s %s is STRUCT at @%x'%(attrname,attrtype, self._orig_address_ + offset) ) # TODO pydoc for impl. attr._orig_address_ = self._orig_address_ + offset if not attr.loadMembers(mappings, maxDepth+1): log.debug("st: %s %s not valid, erreur while loading inner struct "%(attrname,attrtype) ) return False log.debug("st: %s %s inner struct LOADED "%(attrname,attrtype) ) return True elif isBasicTypeArray(attr): return True if isArrayType(attrtype): log.debug('a: %s is arraytype %s recurse load'%(attrname,repr(attr)) )# attrLen=len(attr) if attrLen == 0: return True elType=type(attr[0]) for i in range(0,attrLen): # FIXME BUG DOES NOT WORK - offsetof("%s[%d]") is called, and %s exists, not %s[%d] #if not self._loadMember(attr[i], "%s[%d]"%(attrname,i), elType, mappings, maxDepth): if not self._loadMember(attr[i], attrname, elType, mappings, maxDepth): return False return True # we have PointerType here . Basic or complex # exception cases if isCStringPointer(attrtype) : # can't use basic c_char_p because we can't load in foreign memory attr_obj_address = getaddress(attr.ptr) if not bool(attr_obj_address): log.debug('%s %s is a CString, the pointer is null (validation must have occurred earlier) '%(attrname, attr)) return True memoryMap = is_valid_address_value(attr_obj_address, mappings) if not memoryMap : log.warning('Error on addr while fetching a CString. should not happen') return False MAX_SIZE=255 ref = getRef(CString,attr_obj_address) if ref: log.debug("%s %s loading from references cache %s/0x%lx"%(attrname,attr,CString,attr_obj_address )) return True log.debug("%s %s is defined as a CString, loading from 0x%lx is_valid_address %s"%( attrname,attr,attr_obj_address, is_valid_address(attr,mappings) )) txt,full = memoryMap.readCString(attr_obj_address, MAX_SIZE ) if not full: log.warning('buffer size was too small for this CString') # that will SEGFAULT attr.string = txt - instead keepRef to String keepRef( txt, CString, attr_obj_address) log.debug('kept CString ref for "%s" at @%x'%(txt, attr_obj_address)) return True elif isPointerType(attrtype): # not functionType, it's not loadable _attrType = get_subtype(attrtype) attr_obj_address=getaddress(attr) #### # memcpy and save objet ref + pointer in attr # we know the field is considered valid, so if it's not in memory_space, we can ignore it memoryMap = is_valid_address( attr, mappings, _attrType) if(not memoryMap): # big BUG Badaboum, why did pointer changed validity/value ? log.warning("%s %s not loadable 0x%lx but VALID "%(attrname, attr,attr_obj_address )) return True ref = getRef(_attrType,attr_obj_address) if ref: log.debug("%s %s loading from references cache %s/0x%lx"%(attrname,attr,_attrType,attr_obj_address )) #DO NOT CHANGE STUFF SOUPID attr.contents = ref. attr.contents will SEGFAULT return True log.debug("%s %s loading from 0x%lx (is_valid_address: %s)"%(attrname,attr,attr_obj_address, memoryMap )) ##### Read the struct in memory and make a copy to play with. #### DO NOT COPY THE STRUCT, we have a working readStruct for that... ### ERRROR attr.contents=_attrType.from_buffer_copy(memoryMap.readStruct(attr_obj_address, _attrType )) contents=memoryMap.readStruct(attr_obj_address, _attrType ) # save that validated and loaded ref and original addr so we dont need to recopy it later keepRef( contents, _attrType, attr_obj_address) log.debug("keepRef %s.%s @%x"%(_attrType, attrname, attr_obj_address )) log.debug("%s %s loaded memcopy from 0x%lx to 0x%lx"%(attrname, attr, attr_obj_address, (getaddress(attr)) )) # recursive validation checks on new struct if not bool(attr): log.warning('Member %s is null after copy: %s'%(attrname,attr)) return True # go and load the pointed struct members recursively if not contents.loadMembers(mappings, maxDepth): log.debug('member %s was not loaded'%(attrname)) #invalidate the cache ref. delRef( _attrType, attr_obj_address) return False return True #TATAFN return True