
    5i-                         d dl Z d dlZddlT ddlmZ  G d d          Z G d d          Z G d	 d
          Z G d d          ZdS )    N   )*)PROCESSOR_ARCHITECTUREc                       e Zd Zd Zd ZdS )VirtualSegmentc                 >    || _         || _        || _        d | _        d S N)startendstart_file_addressdata)selfr
   r   r   s       M/home/kali/Ninja/venv/lib/python3.11/site-packages/minidump/minidumpreader.py__init__zVirtualSegment.__init__   s%    $*$(.$ $)))    c                 .    | j         |k    o
|| j        k    S r	   )r
   r   )r   r
   r   s      r   inrangezVirtualSegment.inrange   s    	u		/tx/r   N)__name__
__module____qualname__r   r    r   r   r   r      s2          0 0 0 0 0r   r   c                   .    e Zd ZddZd Zd Zd Zd ZdS )	MinidumpBufferedMemorySegment (  c                     |j         | _        |j        | _        |j        |j         z
  | _        |j        | _        || _        g | _        d S r	   )start_virtual_addressstart_addressend_virtual_addressend_address
total_sizer   	chunksizechunks)r   memory_segmentfile_handler!   s       r   r   z&MinidumpBufferedMemorySegment.__init__   sG    %;$#7$"69]]$/*=$$.$+++r   c                 6    | j         |cxk    o
| j        k     nc S r	   )r   r   r   positions     r   r   z%MinidumpBufferedMemorySegment.inrange!   s*    		x	:	:	:	:$*:	:	:	:	::r   c                 D    |                      |          sd S | j        |z
  S r	   )r   r   r&   s     r   remaining_lenz+MinidumpBufferedMemorySegment.remaining_len$   s)    	h		 
$		H	$$r   c                 \    |                      |dd          }|                    ||          S )Nr   )readfind)r   r$   patternstartposr   s        r   r-   z"MinidumpBufferedMemorySegment.find)   s+    	;2	&	&$	7H	%	%%r   c                    |B|                     | j        |z              |                    | j        | j        |z   z
            S | j        D ]9}|                    ||          r!|j        ||j        z
  ||j        z
           c S :| j        d| j	        z  k    r| j        }t          d|| j                  }|                     | j                   |                    |          |_        | j                            |           |j        ||j        z
  ||j        z
           S t          ||z
  | j	                  }||z   | j        k    r
| j        |z
  }t          |||z   | j        |z             }|                     |j                   |                    |          |_        | j                            |           |j        ||j        z
  ||j        z
           S )N   r   )seekr   r,   r   r"   r   r   r
   r    r!   r   appendmax)r   r$   r
   r   chunkr!   vss          r   r,   z"MinidumpBufferedMemorySegment.read-   s   [D+e3444


4+t/F/NO
P
PP{ > >emmE3 >:eek)3+<<====> 
_$.(((9q)T%<==2D+,,,i((27;b
'%"("C"(N2
333u9t~..)
Y)))%'9eU9_d.E.MNN"2()))Y''"'+R	!3>1	22r   Nr   )r   r   r   r   r   r)   r-   r,   r   r   r   r   r      sd           ; ; ;% % %
& & &3 3 3 3 3r   r   c                       e Zd ZddZd Zd ZddZd Zdd	Zd
 Z	d Z
ddZd Zd Zd Zd Zd Zd Zd Zd ZddZdS )MinidumpBufferedReaderr   c                 L    || _         || _        g | _        d | _        d | _        d S r	   )readersegment_chunk_sizememory_segmentscurrent_segmentcurrent_position)r   r;   r<   s      r   r   zMinidumpBufferedReader.__init__L   s/    $+.$$$$r   c                 f   | j         D ](}|                    |          r|| _        || _         dS )| j        j         D ]c}|                    |          rLt          || j        j        | j                  }| j                             |           || _        || _         dS dt          d|z            )z

		N)r!   z4Memory address 0x%08x is not in process memory space)
r=   r   r>   r?   r;   r   r$   r<   r3   	Exception)r   requested_positionr#   
newsegments       r   _select_segmentz&MinidumpBufferedReader._select_segmentT   s    
 ,  n/00 )D.D
FF 3  n/00 .~t{?VbfbyzzzJ
+++%D.D
FF 	HK]]^^^r   c                     | j         S r	   )r;   r   s    r   
get_readerz!MinidumpBufferedReader.get_readerj   s
    	r   r   c                     |dk    r| j         j        |z   }n6|dk    r| j        |z   }n%|dk    r| j         j        |z
  }nt	          d          | j                             |          st	          d          || _        dS )aD  
		Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets.
		0: beginning of the current memory segment
		1: from current position
		2: from the end of the current memory segment
		If you wish to move out from the segment, use the 'move' function
		r   r   r1   z.Seek function whence value must be between 0-2z5Seek would cross memory segment boundaries (use move)N)r>   r   r?   r   rA   r   )r   offsetwhencets       r   r2   zMinidumpBufferedReader.seekm   s     q[[)F211{{v%11{{'&011	C	D	DD			%	%a	(	( L	J	K	KK$&r   c                 0    |                      |           dS )z@
		Moves the buffer to a virtual address specified by address
		N)rD   )r   addresss     r   movezMinidumpBufferedReader.move   s     w&r   Nc                     |$| j         j        j        t          j        k    rd}nd}| j        |z  }|dk    rdS ||z
  |z  }|                     |d           dS )zD
		Repositions the current reader to match architecture alignment
		N      r   r   )r;   sysinfoProcessorArchitecturer   AMD64r?   r2   )r   	alignmentrI   offset_to_aligneds       r   alignzMinidumpBufferedReader.align   sr     
k/3I3OOOIII 9,&q[[	6 6)Y6))q!!!&r   c                     | j         S )z)
		Returns the current virtual address
		)r?   rF   s    r   tellzMinidumpBufferedReader.tell   s     
	r   c                     | j         |z   }| j                            |dz
            st          d          | j                            | j        j        | j         | j        j        z
  || j        j        z
            S )z@
		Returns up to length bytes from the current memory segment
		r   #Would read over segment boundaries!)r?   r>   r   rA   r,   r;   r$   r   )r   lengthrK   s      r   peekzMinidumpBufferedReader.peek   s     f$!			%	%a!e	,	, :	8	9	99			"	"4;#:D<QTXThTv<vyz  ~B  ~R  ~`  z`  
a  
a  ar   r+   c                    |dk     rt          d          |dk    rn| j                            | j                  }|sdS | j        }| j        j        | _        | j                            | j        j        || j        j        z
  d          S | j        |z   }| j        	                    |dz
            st          d          | j        }|| _        | j                            | j        j        || j        j        z
  || j        j        z
            S )z
		Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment
		r+   zYou shouldnt be doing thisNr   r[   )
rA   r>   r)   r?   r   r,   r;   r$   r   r   )r   sizerK   old_new_poss       r   r,   zMinidumpBufferedReader.read   s#    
BYY	/	0	00	RZZ))$*?@@1
 4&;/;4


#
#DK$;[4K_Km=mos
t
tt
d"!			%	%a!e	,	, :	8	9	99%+$			"	"4;#:K$J^Jl<lnorv  sG  sU  oU  
V  
V  Vr   c                     | j         j        j        t          j        k    r0t
                              |                     d          dd          S t
                              |                     d          dd          S )z
		Reads an integer. The size depends on the architecture.
		Reads a 4 byte small-endian singed int on 32 bit arch
		Reads an 8 byte small-endian singed int on 64 bit arch
		rP   littleT	byteordersignedrQ   r;   rR   rS   r   rT   int
from_bytesr,   rF   s    r   read_intzMinidumpBufferedReader.read_int   s_     
[.2H2NNN
..18d.
K
KK
..18d.
K
KKr   c                     | j         j        j        t          j        k    r0t
                              |                     d          dd          S t
                              |                     d          dd          S )z
		Reads an integer. The size depends on the architecture.
		Reads a 4 byte small-endian unsinged int on 32 bit arch
		Reads an 8 byte small-endian unsinged int on 64 bit arch
		rP   rb   Frc   rQ   rf   rF   s    r   	read_uintz MinidumpBufferedReader.read_uint   s_     
[.2H2NNN
..18e.
L
LL
..18e.
L
LLr   c                 p    | j                             | j        j        |          }|dk    rdS || j        z   S )z:
		Searches for a pattern in the current memory segment
		r+   )r>   r-   r;   r$   r?   )r   r.   poss      r   r-   zMinidumpBufferedReader.find   s=     	!!$+"97CC#BYY
"	t$	$$r   c                     g }d}	 | j                             | j        j        ||dz             }|dk    rn#|                    || j         j        z              S|S )zp
		Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list
		r+   Tr   )r>   r-   r;   r$   r3   r   )r   r.   rm   
last_founds       r   find_allzMinidumpBufferedReader.find_all   sn     	#*?$))$+*A7JYZN[[:B	::j4/==>>>	? 
*r   c                 p    | j                             |          }t          |          dk    rdS |d         S )zx
		Searches for the pattern in the whole process memory space and returns the first occurrence.
		This is exhaustive!
		r   r+   )r;   searchlen)r   r.   pos_ss      r   find_globalz"MinidumpBufferedReader.find_global   s6    
 +

W
%
%%ZZ1__
"	q/r   c                 6    | j                             |          S )z
		Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins.
		This is exhaustive!
		)r;   rr   )r   r.   s     r   find_all_globalz&MinidumpBufferedReader.find_all_global   s    
 
		G	$	$$r   c                 T    |                      |           |                                 S r	   )rN   rk   )r   rm   s     r   get_ptrzMinidumpBufferedReader.get_ptr   s!    ))C...			r   c                 ,   | j         j        j        t          j        k    rM|                     |           t                              |                     d          dd          }|dz   |z   S |                     |           | 	                                S )NrQ   rb   Trc   )
r;   rR   rS   r   rT   rN   rg   rh   r,   rk   )r   rm   ptrs      r   get_ptr_with_offsetz*MinidumpBufferedReader.get_ptr_with_offset  sv    	[.2H2NNN99S>>>			!(T	J	J3
'C-99S>>>
..

r   Fc                 N    | j                             ||||| j                  }|S )N)
find_firstreverse_orderr!   )r;   search_moduler<   )r   module_namer.   r~   r   rK   s         r   find_in_modulez%MinidumpBufferedReader.find_in_module  s6    
kW:_lz~  {R  S  S!	
(r   r7   )r   r	   )r+   )FF)r   r   r   r   rD   rG   r2   rN   rW   rY   r]   r,   ri   rk   r-   rp   ru   rw   ry   r|   r   r   r   r   r9   r9   K   sK          _ _ _,  	 	 	 	.	 	 		 	 	 	   a a aV V V V.	L 	L 	L	M 	M 	M% % %  	 	 	% % %         r   r9   c                   J    e Zd Zd Zd Zd ZddZd Zd Zdd	Z	dd
Z
d ZdS )MinidumpFileReaderc                 >   |j         j         | _         g | _        |j        |j        j         | _        |j        | _        |j        r|j        j        | _        d| _        n|j        j        | _        d| _        |j        | _        |j        | _        d| _        d| _	        |j        j
        t          j        t          j        fv rd| _        d| _        d S | j        j
        t          j        t          j        fv rd| _        d| _        d S t%          d| j        j
        z            )NTFrQ   z<LrP   z<Qz<Unknown processor architecture %s! Please fix and submit PR!)modulesunloaded_modulesrR   memory_segments_64r=   is_fulldumpfilenamer$   sizeof_longunpack_longrS   r   rT   AARCH64
sizeof_ptr
unpack_ptrINTELARMrA   )r   minidumpfiles     r   r   zMinidumpFileReader.__init__  s   %-$,$".'8@4%$,$ &9I44 '6F44'$-!-$ $$/4J4PRhRp3qqq4?4???|).D.J.     4?4???	QTXT`Tvv	w	wwr   c                     | j         S r	   )r$   rF   s    r   get_handlerzMinidumpFileReader.get_handler4  s    		r   c                     | j         S r	   )r=   rF   s    r   
get_memoryzMinidumpFileReader.get_memory7  s    		r   r   c                 $    t          | |          S )N)r<   )r9   )r   r<   s     r   get_buffered_readerz&MinidumpFileReader.get_buffered_reader:  s    	;M	N	N	NNr   c                     | j         D ]Z}t          j        |j                                                                      |                                          dk    r|c S [d S Nr+   )r   ntpathbasenamenamelowerr-   r   r   mods      r   get_module_by_namez%MinidumpFileReader.get_module_by_name=  sd    \  coch%%'',,[->->-@-@AARGGJJJ H	r   c                     | j         D ]6}t          j        |j                                      |          dk    r|c S 7d S r   )r   r   r   r   r-   r   s      r   get_unloaded_by_namez'MinidumpFileReader.get_unloaded_by_nameC  sL    "  coch$$[11R77JJJ 8	r   Fc                 T   |                      |          }|)|                     |          }|t          d|z            g }| j        D ]]}|j        |j        cxk    r|j        k     r?n !||                    || j        ||          z  }t          |          dk    r|du r|c S ^|S )NzCould not find module! %sr~   r!   r   T)
r   r   rA   r=   baseaddressr   
endaddressrr   r$   rs   )	r   r   r.   r~   r   r!   r   needlesmss	            r   r   z MinidumpFileReader.search_moduleI  s    ,,#[		"	";	/	/3	k
/+=
>
>>'   b	o1BBBBCNBBBBBbii!1
XaibbbG
7||aJ$..^^^ 
.r   c                 `    g }| j         D ]#}||                    || j        ||          z  }$|S )Nr   )r=   rr   r$   )r   r.   r~   r!   rK   r   s         r   rr   zMinidumpFileReader.searchZ  sD    !  \ \bryy$*QZy[[[11	
(r   c                     | j         D ]5}|                    |          r|                    ||| j                  c S 6t	          dt          |          z            )NzAddress not in memory range! %s)r=   r   r,   r$   rA   hex)r   	virt_addrr_   segments       r   r,   zMinidumpFileReader.reada  sf    % ; ;gooi   ;<<	4)9:::::;3c)nnDEEEr   Nr7   )FFr   )Fr   )r   r   r   r   r   r   r   r   r   r   rr   r,   r   r   r   r   r     s        x x x@    O O O O       "   F F F F Fr   r   )	structr   common_structsstreams.SystemInfoStreamr   r   r   r9   r   r   r   r   <module>r      s          < < < < < <0 0 0 0 0 0 0 0/3 /3 /3 /3 /3 /3 /3 /3fF F F F F F F FPRF RF RF RF RF RF RF RF RF RFr   