o j-@s`ddlZddlZddlTddlmZGdddZGdddZGd d d ZGd d d ZdS) N)*)PROCESSOR_ARCHITECTUREc@seZdZddZddZdS)VirtualSegmentcCs||_||_||_d|_dSN)startendstart_file_addressdata)selfrrr r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minidump/minidumpreader.py__init__ s zVirtualSegment.__init__cCs|j|ko ||jkSr)rr)r rrr r r inrangeszVirtualSegment.inrangeN)__name__ __module__ __qualname__rrr r r r r s rc@s6eZdZd ddZddZddZdd Zd d Zd S)MinidumpBufferedMemorySegment(cCs6|j|_|j|_|j|j|_|j|_||_g|_dSr)start_virtual_address start_addressend_virtual_address end_address total_sizer chunksizechunks)r memory_segment file_handlerr r r rs  z&MinidumpBufferedMemorySegment.__init__cCs|j|ko |jkSSr)rrr positionr r r r!sz%MinidumpBufferedMemorySegment.inrangecCs||sdS|j|Sr)rrrr r r remaining_len$s  z+MinidumpBufferedMemorySegment.remaining_lencCs||dd}|||S)Nr)readfind)r rpatternstartposr r r r r#)s z"MinidumpBufferedMemorySegment.findcCsB|dur||j|||j|j|S|jD]}|||r1|j||j||jSq|jd|j krc|j}t d||j}||j|||_|j ||j||j||jSt |||j }|||jkrw|j|}t ||||j|}||j|||_|j ||j||j||jS)Nr) seekr r"rrrr rrrrappendmax)r rrrchunkrvsr r r r"-s,         z"MinidumpBufferedMemorySegment.readNr)rrrrrr r#r"r r r r rs   rc@seZdZd*ddZddZddZd+d d Zd d Zd,ddZddZ ddZ d-ddZ ddZ ddZ ddZddZdd Zd!d"Zd#d$Zd%d&Zd.d(d)Zd S)/MinidumpBufferedReaderrcCs"||_||_g|_d|_d|_dSr)readersegment_chunk_sizememory_segmentscurrent_segmentcurrent_position)r r.r/r r r rLs  zMinidumpBufferedReader.__init__cCs~|jD]}||r||_||_dSq|jjD] }||r8t||jj|jd}|j|||_||_dSqt d|)z N)rz4Memory address 0x%08x is not in process memory space) r0rr1r2r.rrr/r( Exception)r requested_positionr newsegmentr r r _select_segmentTs      z&MinidumpBufferedReader._select_segmentcC|jSr)r.r r r r get_readerjz!MinidumpBufferedReader.get_readerrcCsf|dkr |jj|}n|dkr|j|}n|dkr |jj|}ntd|j|s.td||_dS)aD Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function rrr&z.Seek function whence value must be between 0-2z5Seek would cross memory segment boundaries (use move)N)r1rr2rr3r)r offsetwhencetr r r r'ms  zMinidumpBufferedReader.seekcCs||dS)z@ Moves the buffer to a virtual address specified by address N)r6)r addressr r r moves zMinidumpBufferedReader.moveNcCsT|dur|jjjtjkrd}nd}|j|}|dkrdS|||}||ddS)zD Repositions the current reader to match architecture alignment Nrr)r.sysinfoProcessorArchitecturerAMD64r2r')r alignmentr;offset_to_alignedr r r aligns   zMinidumpBufferedReader.aligncCr7)z) Returns the current virtual address )r2r8r r r tellszMinidumpBufferedReader.tellcCsH|j|}|j|dstd|j|jj|j|jj||jjS)z@ Returns up to length bytes from the current memory segment r#Would read over segment boundaries!)r2r1rr3r"r.rr)r lengthr=r r r peeks &zMinidumpBufferedReader.peekr!cCs|dkrtd|dkr-|j|j}|sdS|j}|jj|_|j|jj||jjdS|j|}|j |ds>td|j}||_|j|jj||jj||jjS)z Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment r!zYou shouldnt be doing thisNrrI) r3r1r r2rr"r.rrr)r sizer= old_new_posr r r r"s  $zMinidumpBufferedReader.readcC<|jjjtjkrtj|ddddStj|ddddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch r@littleT byteordersignedrAr.rBrCrrDint from_bytesr"r8r r r read_intzMinidumpBufferedReader.read_intcCrN)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch r@rOFrPrArSr8r r r read_uintrWz MinidumpBufferedReader.read_uintcCs(|j|jj|}|dkrdS||jS)z: Searches for a pattern in the current memory segment r!)r1r#r.rr2)r r$posr r r r#s zMinidumpBufferedReader.findcCsDg}d} |j|jj||d}|dkr |S|||jjq)zp Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list r!Tr)r1r#r.rr(r)r r$rY last_foundr r r find_allszMinidumpBufferedReader.find_allcCs$|j|}t|dkrdS|dS)zx Searches for the pattern in the whole process memory space and returns the first occurrence. This is exhaustive! rr!)r.searchlen)r r$pos_sr r r find_globals  z"MinidumpBufferedReader.find_globalcCs |j|S)z Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins. This is exhaustive! )r.r\)r r$r r r find_all_globals z&MinidumpBufferedReader.find_all_globalcCs|||Sr)r?rX)r rYr r r get_ptrs zMinidumpBufferedReader.get_ptrcCsN|jjjtjkr||tj|dddd}|d|S||| S)NrArOTrP) r.rBrCrrDr?rTrUr"rX)r rYptrr r r get_ptr_with_offsets    z*MinidumpBufferedReader.get_ptr_with_offsetFcCs|jj|||||jd}|S)N) find_first reverse_orderr)r. search_moduler/)r module_namer$rdrer=r r r find_in_modulesz%MinidumpBufferedReader.find_in_moduler,)rr)r!)FF)rrrrr6r9r'r?rGrHrKr"rVrXr#r[r_r`rarcrhr r r r r-Ks&         r-c@sZeZdZddZddZddZddd Zd d Zd d ZdddZ dddZ ddZ dS)MinidumpFileReadercCs|jj|_g|_|jdur|jj|_|j|_|jr"|jj|_d|_n|jj|_d|_|j|_|j|_d|_d|_ |jj t j t j fvrJd|_d|_dS|jj t jt jfvr\d|_d|_dStd|jj )NTFrAzs  3I