def test_outputs(self): with self.assertRaises(TypeError): api.output_to_json(None, None) with self.assertRaises(TypeError): api.output_to_python(None, None) with self.assertRaises(TypeError): api.output_to_string(None, None)
def watch(args): """ structname watch vaddr [refreshrate] [varname] :param opt: :return: """ memory_address = args.addr refresh = args.refresh_rate varname = args.varname # we need an int # get the memory handler adequate for the type requested memory_handler = _get_memory_handler(args) # check the validity of the address heap = memory_handler.is_valid_address_value(memory_address) if not heap: log.error("the address is not accessible in the memoryMap") raise ValueError("the address is not accessible in the memoryMap") # get the structure name modulename, sep, classname = args.struct_name.rpartition('.') module = memory_handler.get_model().import_module(modulename) struct_type = getattr(module, classname) # verify target fieldcompliance if varname is not None: varname = varname.split('.') if not check_varname_for_type(memory_handler, varname, struct_type): return False # load the record result = api.load_record(memory_handler, struct_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) py_obj = output[0][0] # print pyObj # print as asked every n secs. while True: # clear terminal print chr(27) + "[2J" # if varname is None: print py_obj else: print get_varname_value(varname, py_obj) if refresh == 0: break time.sleep(refresh) result = api.load_record(memory_handler, struct_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) py_obj = output[0][0]
def watch(args): """Cast the bytes at this address into a record_type and refresh regularly. """ memory_address = args.addr refresh = args.refresh_rate varname = args.varname # get the memory handler adequate for the type requested memory_handler = get_memory_handler(args) # check the validity of the address heap = memory_handler.is_valid_address_value(memory_address) if not heap: log.error("the address is not accessible in the memoryMap") raise ValueError("the address is not accessible in the memoryMap") # get the structure name modulename, sep, classname = args.record_type_name.rpartition('.') module = None try: module = memory_handler.get_model().import_module(modulename) except ImportError as e: log.error('sys.path is %s', sys.path) raise e record_type = getattr(module, classname) # verify target fieldcompliance if varname is not None: varname = varname.split('.') if not check_varname_for_type(memory_handler, varname, record_type): return False # load the record result = api.load_record(memory_handler, record_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) # _get_output(memory_handler, results, rtype): # Conflicts with varname py_obj = output[0][0] # print pyObj # print as asked every n secs. while True: # clear terminal print(chr(27) + "[2J") # if varname is None: print(py_obj) else: print(get_varname_value(varname, py_obj)) if refresh == 0: break time.sleep(refresh) result = api.load_record(memory_handler, record_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) py_obj = output[0][0]
def watch(args): """Cast the bytes at this address into a record_type and refresh regularly. """ memory_address = args.addr refresh = args.refresh_rate varname = args.varname # get the memory handler adequate for the type requested memory_handler = get_memory_handler(args) # check the validity of the address heap = memory_handler.is_valid_address_value(memory_address) if not heap: log.error("the address is not accessible in the memoryMap") raise ValueError("the address is not accessible in the memoryMap") # get the structure name modulename, sep, classname = args.record_type_name.rpartition('.') module = None try: module = memory_handler.get_model().import_module(modulename) except ImportError as e: log.error('sys.path is %s', sys.path) raise e record_type = getattr(module, classname) # verify target fieldcompliance if varname is not None: varname = varname.split('.') if not check_varname_for_type(memory_handler, varname, record_type): return False # load the record result = api.load_record(memory_handler, record_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) # _get_output(memory_handler, results, rtype): # Conflicts with varname py_obj = output[0][0] # print pyObj # print as asked every n secs. while True: # clear terminal print chr(27) + "[2J" # if varname is None: print py_obj else: print get_varname_value(varname, py_obj) if refresh == 0: break time.sleep(refresh) result = api.load_record(memory_handler, record_type, memory_address) results = [result] # output handling output = api.output_to_python(memory_handler, results) py_obj = output[0][0]
def test_load(self): # this is kinda stupid, given we are using a heapwalker to # find the heap, and testing the heap. finder = self.memory_handler.get_heap_finder() walkers = finder.list_heap_walkers() heaps = [walker.get_heap_mapping() for walker in walkers] my_heap = [x for x in heaps if x.start == self.known_heaps[0][0]][0] heap_mapping = self.memory_handler.get_mapping_for_address( self.known_heaps[0][0]) # we want the 32 bits heap record type on 32 bits heap mappings heapwalker = finder.get_heap_walker(heap_mapping) ## Thats a 64 bits heap heapwalker = finder.get_heap_walker(heaps[0]) my_loader = searcher.RecordLoader(self.memory_handler) res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0]) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] # no constraints loaded, subsegmentcode pointer went to is_valid self.assertFalse(validated) # now lets just use the win7heap constraints my_loader = searcher.RecordLoader(self.memory_handler, heapwalker._heap_module_constraints) res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0]) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] # no constraints loaded, subsegmentcode pointer went to is_valid self.assertTrue(validated) self.assertIsInstance(instance, object) self.assertEqual(instance.Signature, 0xeeffeeff) self.assertEqual(instance.VirtualMemoryThreshold, 0xfe00) self.assertEqual(instance.FrontEndHeapType, 0) # try a misalign read res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0] + 1) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] self.assertFalse(validated) self.assertIsInstance(instance, object) self.assertNotEquals(instance.Signature, 0xeeffeeff) self.assertEqual(instance.Signature, 0xeeffee) # 1 byte off self.assertNotEquals(instance.VirtualMemoryThreshold, 0xfe00) self.assertEqual(instance.VirtualMemoryThreshold, 0xff0000fe) return
def test_load(self): # this is kinda stupid, given we are using a heapwalker to # find the heap, and testing the heap. finder = self.memory_handler.get_heap_finder() walkers = finder.list_heap_walkers() heaps = [walker.get_heap_mapping() for walker in walkers] my_heap = [x for x in heaps if x.start == self.known_heaps[0][0]][0] heap_mapping = self.memory_handler.get_mapping_for_address(self.known_heaps[0][0]) # we want the 32 bits heap record type on 32 bits heap mappings heapwalker = finder.get_heap_walker(heap_mapping) ## Thats a 64 bits heap heapwalker = finder.get_heap_walker(heaps[0]) my_loader = searcher.RecordLoader(self.memory_handler) res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0]) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] # no constraints loaded, subsegmentcode pointer went to is_valid self.assertFalse(validated) # now lets just use the win7heap constraints my_loader = searcher.RecordLoader(self.memory_handler, heapwalker._heap_module_constraints) res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0]) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] # no constraints loaded, subsegmentcode pointer went to is_valid self.assertTrue(validated) self.assertIsInstance(instance, object) self.assertEqual(instance.Signature, 0xeeffeeff) self.assertEqual(instance.VirtualMemoryThreshold, 0xfe00) self.assertEqual(instance.FrontEndHeapType, 0) # try a misalign read res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0] + 1) res_p = api.output_to_python(self.memory_handler, [res]) instance, validated = res_p[0] self.assertFalse(validated) self.assertIsInstance(instance, object) self.assertNotEquals(instance.Signature, 0xeeffeeff) self.assertEqual(instance.Signature, 0xeeffee) # 1 byte off self.assertNotEquals(instance.VirtualMemoryThreshold, 0xfe00) self.assertEqual(instance.VirtualMemoryThreshold, 0xff0000fe) return
def refresh(args): """ Default function for the refresh command line option. Try to map a Structure from a specific offset in memory. Returns it in pickled or text format. See the command line --help . """ # we need an int memory_address = args.addr # get the memory handler adequate for the type requested memory_handler = _get_memory_handler(args) # print output on stdout rtype = _get_output_style(args) # check the validity of the address heap = memory_handler.is_valid_address_value(memory_address) if not heap: log.error("the address is not accessible in the memoryMap") raise ValueError("the address is not accessible in the memoryMap") # get the structure name modulename, sep, classname = args.struct_name.rpartition('.') module = memory_handler.get_model().import_module(modulename) struct_type = getattr(module, classname) # load the record result = api.load_record(memory_handler, struct_type, memory_address) results = [result] if args.validate: my_constraints = None if args.constraints_file: handler = constraints.ConstraintsConfigHandler() my_constraints = handler.read(args.constraints_file.name) validation = api.validate_record(memory_handler, result[0], my_constraints) if args.interactive: import code code.interact(local=locals()) # output handling ret = None if rtype == 'string': ret = api.output_to_string(memory_handler, results) elif rtype == 'python': ret = api.output_to_python(memory_handler, results) elif rtype == 'json': ret = api.output_to_json(memory_handler, results) elif rtype == 'pickled': ret = api.output_to_pickle(memory_handler, results) else: raise ValueError('unknown output format') print ret if args.validate: print 'Validated', validation return
def get_output(memory_handler, results, rtype): if rtype == 'string': ret = api.output_to_string(memory_handler, results) elif rtype == 'python': # useful in interactive mode ret = api.output_to_python(memory_handler, results) elif rtype == 'json': ret = api.output_to_json(memory_handler, results) elif rtype == 'pickled': ret = api.output_to_pickle(memory_handler, results) else: raise ValueError('unknown output format') return ret
def test_weird_py3_bug(self): # RESULT: PY3 pickling works if model includes all pythoned module hierachy results, validated = api.load_record(self.memory_handler, self.usual, self.address1) # check the string output retstr = api.output_to_string(self.memory_handler, [(results, validated)]) self.assertTrue(isinstance(retstr, str)) ret = api.output_to_python(self.memory_handler, [(results, validated)]) # check subclass in model module x = pickle.dumps(ret) # Python 2 # self.assertIn(b'test.src.ctypes6_gen32.struct_usual_py', x) # Python 3 self.assertIn(b'struct_usual_py', x) # TODO TEST really, you should be able to load the pickled code as long as haystack.outputters.python is there # and still be able to load the object graph. obj = pickle.loads(x) self.assertEqual(obj[0][0].root.blink, obj[0][0].root.flink) self.assertEqual(obj[0][0].root.blink.flink, obj[0][0].root.flink.flink) return
def search_cmdline(args): """ Internal cmdline mojo. """ # get the memory handler adequate for the type requested memory_handler = _get_memory_handler(args) # print output on stdout rtype = _get_output_style(args) # try to load constraints # mapper if args.constraints_file: handler = constraints.ConstraintsConfigHandler() my_constraints = handler.read(args.constraints_file.name) else: my_constraints = None # get the structure name modulename, sep, classname = args.struct_name.rpartition('.') module = memory_handler.get_model().import_module(modulename) struct_type = getattr(module, classname) # do the search results = api.search_record(memory_handler, struct_type, my_constraints, extended_search=args.extended_search) if args.interactive: import code code.interact(local=locals()) # output handling ret = None if rtype == 'string': ret = api.output_to_string(memory_handler, results) elif rtype == 'python': ret = api.output_to_python(memory_handler, results) elif rtype == 'json': ret = api.output_to_json(memory_handler, results) elif rtype == 'pickled': ret = api.output_to_pickle(memory_handler, results) else: raise ValueError('unknown output format') print ret return
def test_refresh(self): #handler = constraints.ConstraintsConfigHandler() #my_constraints = handler.read('test/src/ctypes6.constraints') #results = api.search_record(self.memory_handler, self.usual_structname, my_constraints) # search struct_usual with constraints results, validated = api.load_record(self.memory_handler, self.usual, self.address1) # check the string output retstr = api.output_to_string(self.memory_handler, [(results, validated)]) self.assertTrue(isinstance(retstr, str)) # string #retstr = api.show_dumpname(self.usual_structname, self.memdumpname, # self.address1, rtype='string') self.assertIn(str(0x0aaaaaaa), retstr) # 0xaaaaaaa/178956970L self.assertIn(str(0x0ffffff0), retstr) self.assertIn('"val2b": 0', retstr) self.assertIn('"val1b": 0', retstr) # usual->root.{f,b}link = &node1->list; # offset list is (wordsize) bytes ## TU results based on __book node1_list_addr = hex(self.address2 + self.my_target.get_word_size()) self.assertIn('"flink": { # <struct_entry at %s' % node1_list_addr, retstr) self.assertIn('"blink": { # <struct_entry at %s' % node1_list_addr, retstr) ## TU results based on direct access #node1_list_addr = self.address2 + self.my_target.get_word_size() #self.assertIn('"flink": 0x%0.8x' % node1_list_addr, retstr) #self.assertIn('"blink": 0x%0.8x' % node1_list_addr, retstr) # python usuals = api.output_to_python(self.memory_handler, [(results, validated)]) usual, validated = usuals[0] self.assertEqual(validated, True) self.assertEqual(usual.val1, 0x0aaaaaaa) self.assertEqual(usual.val2, 0x0ffffff0) self.assertEqual(usual.txt, b'This a string with a test this is a test string') # so now we got python objects # that is node 1 self.assertIsNotNone(usual.root.flink) self.assertEqual(usual.root.flink, usual.root.blink) #print usual.root.flink # that is node2 self.assertEqual(usual.root.blink.flink, usual.root.flink.flink) # that is None (root.flink = root.blink) self.assertIsNone(usual.root.blink.blink) self.assertIsNone(usual.root.flink.blink) # that is None per design UT self.assertIsNone(usual.root.blink.flink.flink) # python 2 struct Node results, validated = api.load_record(self.memory_handler, self.node, self.address2) node1s = api.output_to_python(self.memory_handler, [(results, validated)]) node1, validated = node1s[0] self.assertEqual(validated, True) self.assertEqual(node1.val1, 0xdeadbeef) self.assertEqual(node1.val2, 0xffffffff) results, validated = api.load_record(self.memory_handler, self.node, self.address3) node2s = api.output_to_python(self.memory_handler, [(results, validated)]) node2, validated = node2s[0] self.assertEqual(validated, True) self.assertEqual(node2.val1, 0xdeadbabe) self.assertEqual(node2.val2, 0xffffffff) self.assertIsNotNone(usual.root.flink) # FIXME this was assertNotEquals. Why would the python obj be equals now ? # but we have different instances/references between calls to # show_dumpname self.assertEqual(usual.root.flink, node1.list) self.assertEqual(usual.root.blink.flink, node2.list)