From 32d2fe9962b036c279abdceee80eab10eb9cefcf Mon Sep 17 00:00:00 2001 From: "SND\\kernelnet_cp" Date: Fri, 14 Feb 2014 07:19:26 +0000 Subject: [PATCH] [0.3.x] added : findMemoryRegion ( Return address of begining valid memory region nearest to offset ) [0.3.x] added : getVaProtect ( Return memory attributes ) git-svn-id: https://pykd.svn.codeplex.com/svn@87282 9b283d60-5439-405e-af05-b73fd8c4d996 --- pykd/pymemaccess.h | 121 +++++++++++---------------------------------- pykd/pymod.cpp | 29 +++++++---- 2 files changed, 48 insertions(+), 102 deletions(-) diff --git a/pykd/pymemaccess.h b/pykd/pymemaccess.h index 494c8f3..ad245ca 100644 --- a/pykd/pymemaccess.h +++ b/pykd/pymemaccess.h @@ -10,6 +10,19 @@ namespace python = boost::python; namespace pykd { + +inline kdlib::MEMOFFSET_64 addr64( kdlib::MEMOFFSET_64 offset ) +{ + AutoRestorePyState pystate; + return kdlib::addr64(offset); +} + +inline bool isVaValid( kdlib::MEMOFFSET_64 offset ) +{ + AutoRestorePyState pystate; + return kdlib::isVaValid(offset); +} + inline unsigned char ptrByte( kdlib::MEMOFFSET_64 offset ) { AutoRestorePyState pystate; @@ -139,102 +152,24 @@ inline bool compareMemory( kdlib::MEMOFFSET_64 addr1, kdlib::MEMOFFSET_64 addr2, return kdlib::compareMemory(addr1, addr2, length, phyAddr); } +inline python::tuple findMemoryRegion( kdlib::MEMOFFSET_64 offset ) +{ + kdlib::MEMOFFSET_64 regionOffset; + size_t regionLength; + AutoRestorePyState pystate; + + kdlib::findMemoryRegion( offset, regionOffset, regionLength ); -//inline int ptrSignByte( kdlib::MEMOFFSET_64 offset ) -//{ -// AutoRestorePyState pystate; -// return kdlib::ptrSignByte(offset); -//} -// -//inline python::list loadBytes( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// -// do -// AutoRestorePyState pystate; -// kdlib::loadBytes( offset, count, phyAddr ) -// return vectorToList( ); -//} -// -//inline python::list loadWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadDWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadDWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadQWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// AutoRestorePyState pystate; -// return vectorToList( kdlib::loadQWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadSignBytes( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// AutoRestorePyState pystate; -// return vectorToList( kdlib::loadSignBytes( offset, count, phyAddr ) ); -//} -// -//inline python::list loadSignWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadSignWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadSignDWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadSignDWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadSignQWords( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadSignQWords( offset, count, phyAddr ) ); -//} -// -//inline python::list loadFloats( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadFloats( offset, count, phyAddr ) ); -//} -// -//inline python::list loadDoubles( kdlib::MEMOFFSET_64 offset, unsigned long count, bool phyAddr = false ) -//{ -// return vectorToList( kdlib::loadDoubles( offset, count, phyAddr ) ); -//} -// -// -// -//inline kdlib::MEMOFFSET_64 ptrPtr( kdlib::MEMOFFSET_64 offset ) -//{ -// return kdlib::ptrPtr( offset ); -//} -// -//inline python::list loadPtrList( kdlib::MEMOFFSET_64 offset ) -//{ -// return vectorToList( kdlib::loadPtrList(offset) ); -//} -// -//inline python::list loadPtrArray( kdlib::MEMOFFSET_64 offset, unsigned long count ) -//{ -// return vectorToList( kdlib::loadPtrs(offset, count) ); -//} -// -//std::wstring loadUnicodeStr(kdlib::MEMOFFSET_64 offset); -// -//std::string loadAnsiStr(kdlib::MEMOFFSET_64 offset); -// -//inline kdlib::MEMOFFSET_64 searchMemoryLst( kdlib::MEMOFFSET_64 beginOffset, unsigned long length, const python::list &pattern ) -//{ -// return kdlib::searchMemory( beginOffset, length, listToVector(pattern) ); -//} -// -//inline kdlib::MEMOFFSET_64 searchMemoryStr( kdlib::MEMOFFSET_64 beginOffset, unsigned long length, const std::string &pattern ) -//{ -// const char* p = pattern.c_str(); -// return kdlib::searchMemory( beginOffset, length, std::vector( p, p + pattern.length() ) ); -//} + return python::make_tuple( regionOffset, regionLength ); +} + +inline kdlib::MemoryProtect getVaProtect( kdlib::MEMOFFSET_64 offset ) +{ + AutoRestorePyState pystate; + return kdlib::getVaProtect(offset); +} } // end namespace pykd diff --git a/pykd/pymod.cpp b/pykd/pymod.cpp index b8ba770..16caae7 100644 --- a/pykd/pymod.cpp +++ b/pykd/pymod.cpp @@ -187,20 +187,20 @@ BOOST_PYTHON_MODULE( pykd ) "Return systemVersion"); // Manage target memory access - python::def( "addr64", &kdlib::addr64, + python::def( "addr64", pykd::addr64, "Extend address to 64 bits formats" ); - python::def( "isValid", &kdlib::isVaValid, + python::def( "isValid", pykd::isVaValid, "Check if the virtual address is valid" ); - python::def( "compareMemory", &kdlib::compareMemory, compareMemory_( python::args( "offset1", "offset2", "length", "phyAddr" ), + python::def( "compareMemory", pykd::compareMemory, compareMemory_( python::args( "offset1", "offset2", "length", "phyAddr" ), "Compare two memory buffers by virtual or physical addresses" ) ); - python::def( "searchMemory", &pykd::searchMemoryLst, + python::def( "searchMemory", pykd::searchMemoryLst, "Search in virtual memory" ); - python::def( "searchMemory", &pykd::searchMemoryStr, + python::def( "searchMemory", pykd::searchMemoryStr, "Search in virtual memory" ); - //python::def( "findMemoryRegion", &kdlib::findMemoryRegion, - // "Return address of begining valid memory region nearest to offset" ); - //python::def( "getVaProtect", &kdlib::getVaProtect, - // "Return memory attributes" ); + python::def( "findMemoryRegion", pykd::findMemoryRegion, + "Return address of begining valid memory region nearest to offset" ); + python::def( "getVaProtect", pykd::getVaProtect, + "Return memory attributes" ); python::def( "ptrByte", pykd::ptrByte, "Read an unsigned 1-byte integer from the target memory" ); @@ -820,6 +820,17 @@ BOOST_PYTHON_MODULE( pykd ) .value("AMD64", kdlib::CPU_AMD64 ) .export_values(); + python::enum_("memoryProtect", "Memory protection attribiuties") + .value("PageNoAccess", kdlib::PageNoAccess) + .value("PageReadOnly", kdlib::PageReadOnly) + .value("PageReadWrite", kdlib::PageReadWrite) + .value("PageWriteCopy", kdlib::PageReadOnly) + .value("PageExecute", kdlib::PageExecute) + .value("PageExecuteRead", kdlib::PageExecuteRead) + .value("PageExecuteReadWrite", kdlib::PageExecuteReadWrite) + .value("PageExecuteWriteCopy", kdlib::PageExecuteWriteCopy) + .export_values(); + python::class_( "eventHandler", "Base class for overriding and handling debug notifications" ) .def( "onBreakpoint", &EventHandler::onBreakpoint,