private Brush GetColorForOffset(ImageSegment seg, long cbOffset) { ImageMapItem item; var lin = seg.Address.ToLinear() + (uint)cbOffset; if (!seg.IsInRange(lin)) { return(brBack); } var address = segmentMap.MapLinearAddressToAddress(lin); if (!imageMap.TryFindItem(address, out item)) { return(brBack); } if (item is ImageMapVectorTable) { return(brData); } if (item.DataType is UnknownType) { return(brBack); } if (item is ImageMapBlock) { return(brCode); } else { return(brData); } }
public IEnumerable <WorkItem>?VisitPointer(Pointer ptr) { Debug.Print("Iterating pointer at {0:X}", gOffset); if (!segmentMap.TryFindSegment(segmentMap.MapLinearAddressToAddress((ulong)gOffset), out ImageSegment segment)) { return(null); } var rdr = arch.CreateImageReader(segment.MemoryArea, gOffset - (long)segment.MemoryArea.BaseAddress.ToLinear()); if (!rdr.TryRead(PrimitiveType.Create(Domain.Pointer, ptr.BitSize), out var c)) { return(null); } long offset = c.ToInt64(); Debug.Print(" pointer value: {0:X}", offset); if (visited.Contains(offset) || !segment.MemoryArea.IsValidLinearAddress((ulong)offset)) { return(Enumerable.Empty <WorkItem>()); } // We've successfully traversed a pointer to a valid destination! // The address must therefore be of type ptr.Pointee. visited.Add(offset); if (globalStr.Fields.AtOffset((int)offset) == null) { Debug.Print(" Discovery: {0:X} {1}", offset, ptr.Pointee); Discoveries.Add(new StructureField((int)offset, ptr.Pointee)); } return(Single(new WorkItem { DataType = ptr.Pointee, GlobalOffset = c.ToInt32() })); }
public void Sm_MapLinearAddress() { var mem = new MemoryArea(Address.Ptr32(0x20), new byte[0x2000]); var segmentMap = new SegmentMap(mem.BaseAddress, new ImageSegment("base", mem, AccessMode.ReadWriteExecute)); var addr = segmentMap.MapLinearAddressToAddress(0x30); Assert.AreEqual("00000030", addr.ToString()); }
public void Sm_MapZeroLinearAddress() { var mem = new MemoryArea(Address.Ptr32(0x20), new byte[0x2000]); var segmentMap = new SegmentMap(mem.BaseAddress, new ImageSegment("base", mem, AccessMode.ReadWriteExecute)); try { var addr = segmentMap.MapLinearAddressToAddress(0); Assert.Fail("Should have thrown an ArgumentOutOfRangeException"); } catch (ArgumentOutOfRangeException) { } }
public override IEnumerable <Address> CreateInstructionScanner(SegmentMap map, EndianImageReader rdr, IEnumerable <Address> knownAddresses, PointerScannerFlags flags) { var knownLinAddresses = knownAddresses.Select(a => (ulong)a.ToLinear()).ToHashSet(); return(new X86PointerScanner64(rdr, knownLinAddresses, flags).Select(li => map.MapLinearAddressToAddress(li))); }
public override IEnumerable <Address> CreatePointerScanner(SegmentMap map, EndianImageReader rdr, IEnumerable <Address> knownAddresses, PointerScannerFlags flags) { var knownLinAddresses = knownAddresses.Select(a => a.ToUInt32()).ToHashSet(); return(ProcessorModel.CreatePointerScanner(rdr, knownLinAddresses, flags).Select(li => map.MapLinearAddressToAddress(li))); }