from minidump.constants import MINIDUMP_STREAM_TYPE, MINIDUMP_TYPE from minidump.header import MinidumpHeader from minidump.common_structs import MINIDUMP_LOCATION_DESCRIPTOR from minidump.utils.winapi.version import GetSystemInfo, GetVersionExW from minidump.utils.winapi.kernel32 import OpenProcess, PROCESS_ALL_ACCESS, VirtualQueryEx, ReadProcessMemory from minidump.utils.winapi.psapi import EnumProcessModules, GetModuleInformation, GetModuleFileNameExW from minidump.utils.winapi.version import GetFileVersionInfoW from minidump.streams import MINIDUMP_SYSTEM_INFO, PROCESSOR_ARCHITECTURE, MINIDUMP_MODULE_LIST, \ MINIDUMP_MODULE, VS_FIXEDFILEINFO, MINIDUMP_MEMORY_INFO_LIST, MINIDUMP_MEMORY_INFO, \ AllocationProtect, MemoryType, MemoryState, \ MINIDUMP_MEMORY64_LIST, MINIDUMP_MEMORY_DESCRIPTOR64 from minidump.streams.SystemInfoStream import PROCESSOR_ARCHITECTURE, PRODUCT_TYPE from minidump.directory import MINIDUMP_DIRECTORY import io class MinidumpSystemReader: def __init__(self): pass def setup(self): pass def get_sysinfo(self): pass def get_modules(self): pass def get_sections(self): pass def get_memory(self): pass def get_threads(self): pass def get_exceptions(self): pass class LiveSystemReader(MinidumpSystemReader): def __init__(self, pid): MinidumpSystemReader.__init__(self) self.pid = pid self.process_handle = None self.sysinfo = None self.meminfolist = None self.setup() def open_process(self): self.process_handle = OpenProcess(PROCESS_ALL_ACCESS, False, self.pid) def setup(self): self.open_process() def get_sysinfo(self): #https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsysteminfo sysinfo_raw = GetSystemInfo() version_raw = GetVersionExW() sysinfo = MINIDUMP_SYSTEM_INFO() sysinfo.ProcessorArchitecture = PROCESSOR_ARCHITECTURE(sysinfo_raw.id.w.wProcessorArchitecture) sysinfo.ProcessorLevel = sysinfo_raw.wProcessorLevel sysinfo.ProcessorRevision = sysinfo_raw.wProcessorRevision #sysinfo.Reserved0 = None sysinfo.NumberOfProcessors = sysinfo_raw.dwNumberOfProcessors sysinfo.ProductType = PRODUCT_TYPE(version_raw.wProductType) sysinfo.MajorVersion = version_raw.dwMajorVersion sysinfo.MinorVersion = version_raw.dwMinorVersion sysinfo.BuildNumber = version_raw.dwBuildNumber sysinfo.PlatformId = version_raw.dwPlatformId sysinfo.CSDVersionRva = 0 #sysinfo.Reserved1 = None sysinfo.SuiteMask = version_raw.wSuiteMask #sysinfo.Reserved2 = None sysinfo.CSDVersion = version_raw.szCSDVersion #below todo, keeping all zeroes for now.. if sysinfo.ProcessorArchitecture == PROCESSOR_ARCHITECTURE.INTEL: sysinfo.VendorId = [0,0,0] sysinfo.VersionInformation = 0 sysinfo.FeatureInformation = 0 sysinfo.AMDExtendedCpuFeatures = 0 else: sysinfo.ProcessorFeatures = [0,0] self.sysinfo_raw = sysinfo_raw return sysinfo def get_modules(self): #https://docs.microsoft.com/en-us/windows/win32/psapi/enumerating-all-modules-for-a-process #https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-enumprocessmodules # module_list = MINIDUMP_MODULE_LIST() for module in EnumProcessModules(self.process_handle): print(module) modinfo = GetModuleInformation(self.process_handle,module) modname = GetModuleFileNameExW(self.process_handle,module) fileversion_raw = GetFileVersionInfoW(modname) fileversion = VS_FIXEDFILEINFO.from_bytes(fileversion_raw) print(modname) mmod = MINIDUMP_MODULE() mmod.BaseOfImage = modinfo.lpBaseOfDll mmod.SizeOfImage = modinfo.SizeOfImage mmod.TimeDateStamp = fileversion.dwFileDateMS << 32 + fileversion.dwFileDateLS mmod.ModuleNameRva = None mmod.VersionInfo = fileversion mmod.CvRecord = 0 # TODO? mmod.MiscRecord = 0 # TODO? mmod.ModuleName = modname module_list.Modules.append(mmod) return module_list def get_sections(self): #https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualqueryex if self.sysinfo_raw is None: self.get_sysinfo() meminfolist = MINIDUMP_MEMORY_INFO_LIST() i = self.sysinfo_raw.lpMinimumApplicationAddress while i < self.sysinfo_raw.lpMaximumApplicationAddress: mi_raw = VirtualQueryEx(self.process_handle, i) mi = MINIDUMP_MEMORY_INFO() mi.BaseAddress = mi_raw.BaseAddress mi.AllocationBase = mi_raw.AllocationBase mi.AllocationProtect = mi_raw.AllocationProtect mi.RegionSize = mi_raw.RegionSize try: mi.State = MemoryState(mi_raw.State) except: mi.State = mi_raw.State try: mi.Protect = AllocationProtect(mi_raw.Protect) except: mi.Protect = mi_raw.Protect try: mi.Type = MemoryType(mi_raw.Type) except: mi.Type = mi_raw.Type meminfolist.entries.append(mi) print(str(mi)) i += mi_raw.RegionSize self.meminfolist = meminfolist return meminfolist def get_threads(self): pass def get_exceptions(self): pass def get_memory(self): read_flags = [AllocationProtect.PAGE_EXECUTE_READ, AllocationProtect.PAGE_EXECUTE_READWRITE, AllocationProtect.PAGE_READONLY, AllocationProtect.PAGE_EXECUTE, AllocationProtect.PAGE_READWRITE, AllocationProtect.PAGE_WRITECOPY ] memlist = MINIDUMP_MEMORY64_LIST() for section in self.meminfolist.entries: if section.Protect in read_flags: memdesc = MINIDUMP_MEMORY_DESCRIPTOR64() memdesc.StartOfMemoryRange = section.BaseAddress memdesc.DataSize = section.RegionSize print(section.Protect) data = ReadProcessMemory(self.process_handle, section.BaseAddress, section.RegionSize) input(data) memlist.MemoryRanges.append(memdesc) return memlist class MinidumpWriter: def __init__(self,sysreader): self.sysreader = sysreader self.output_file = None self.streams = {} #stream type -> list of stream objects self.header = None self.directory_list = [] self.directory_rva = 28 self.header_size = None self.header_buffer = io.BytesIO() self.data_buffer = io.BytesIO() def prepare_header(self): self.header = MinidumpHeader() self.header.Version = 1 self.header.ImplementationVersion = 1 self.header.NumberOfStreams = len(self.streams) +1 # +1 is fot he memory info stream self.header.StreamDirectoryRva = self.directory_rva #self.header.CheckSum = None #self.header.Reserved = None #self.header.TimeDateStamp = None self.header.Flags = MINIDUMP_TYPE.MiniDumpWithFullMemory self.header_buffer.write(self.header.to_bytes()) def prepare_directory(self): curr_pos = self.header_size for streamtype in self.streams: self.streams[streamtype].to_bytes(self.data_buffer) directory = MINIDUMP_DIRECTORY() directory.StreamType = streamtype directory.Location = curr_pos self.header_buffer.write(directory.to_bytes()) def finalize_header(self): # currently only using the 32 bit MINIDUMP_LOCATION_DESCRIPTOR, this is because we expect that the header # and any data in the header (including all streams data except memory stream) will not be bigger than 4GB # memory stream is a special case, as it cvan be longer than 4GB but the RVA to the beginning of the memory stream # is not expected to be bigger than 4G max. # if this becomes the case then this all will fail :) header_size = 28 header_size += len(self.streams) * 8 #this is for the dictionary itself, not the streams for stream in self.streams: header_size += self.streams[stream].get_size() header_size += 10 * 1024 #allocating 10k for the memory info self.prepare_header() self.prepare_directory() def create_streams(self): sysinfo = self.sysreader.get_sysinfo() self.streams[MINIDUMP_STREAM_TYPE.SystemInfoStream] = sysinfo print(str(sysinfo)) moduleinfo = self.sysreader.get_modules() self.streams[MINIDUMP_STREAM_TYPE.ModuleListStream] = moduleinfo sections = self.sysreader.get_sections() self.streams[MINIDUMP_STREAM_TYPE.MemoryInfoListStream] = sections self.finalize_header() memory = self.sysreader.get_memory() #def get_total_streams_cnt(self): # total = 0 # for t in self.streams: # total += len(t) # return total #def construct_directory(self): # # total_streams = self.get_total_streams_cnt() # # for stype in self.streams: # for stream in self.streams[stype]: # # stream # # loc = MINIDUMP_LOCATION_DESCRIPTOR() # loc.DataSize = 0 # loc.Rva = 0 # directory = MINIDUMP_DIRECTORY() # directory.StreamType = stream # self.directory.append() def write_header(self): hdr_pos = self.hdr_buff.tell() self.hdr_buff.seek(0,0) self.hdr_buff.write(self.construct_header()) self.hdr_buff.seek(hdr_pos, 0) return def construct_directory(self): self.sysreader.get_sysinfo(self.hdr_buff, self.data_buff) self.stream_cnt += 1 #modules #self.sysreader.get_modules(self.hdr_buff, self.data_buff) #self.stream_cnt += 1 #write header self.write_header() #append datastream for memory, with correct rva #dump memory def run(self): self.create_streams() if __name__ == '__main__': pid = 9600 sysreader = LiveSystemReader(pid) writer = MinidumpWriter(sysreader) writer.run()