o j,@sddlZddlmZddlmZddlZddlZddlZddlZddl Z ddl Z GdddZ GdddZ Gdd d Z Gd d d Zed kr\ejd deZeZeddSdS)N)PROCESSOR_ARCHITECTURE)loggerc@s0eZdZddZddZeddZddZd S) ModulecCs4d|_d|_d|_d|_g|_d|_d|_d|_dSN)name baseaddresssize endaddresspages versioninfochecksum timestampselfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/zipdump/reader.py__init__s zModule.__init__cC|j|ko |jkSSr)rr raddrrrrinrangezModule.inrangecCs0t}||_||_||_|j|j|_||_|Sr)rrrrr r )rbaseAddrbaseSizer mrrrparse!sz Module.parsecCs(d|jt|jt|jt|j|jfS)Nz%s %s %s %s %s)rhexrrr r rrrr__str__-s(zModule.__str__N)__name__ __module__ __qualname__rr staticmethodrrrrrrrs    rc@sBeZdZddZedddZddZd d Zd d Zd dZ dS)PagecCs.d|_d|_d|_d|_d|_d|_d|_dSr)fileobj BaseAddressAllocationBaseAllocationProtect RegionSize EndAddressdatarrrrr1s z Page.__init__NrcCs8t}||_||_||_||_t|d|_|||_|S)Ni@)r"r#r$r%r&minr'r()r#r$r%r'r&prrrr;s  z Page.parsecCs0|jdurdS|jd|j|_d|_dSNr)r)r#seekreadrrrr read_dataFs    zPage.read_datacCrr)r$r(rrrrrMrz Page.inrangecCst||jkr gS|t|j}g}d}t|t|krJ||}|dkr*|S||||j||dd}||d7}t|t|ks|S)Nr) lenr'r/copydeepcopyr)findappendr$)rpatternr)floffsetmarkerrrrsearchPs   z Page.searchcCsd|j|j|j|jfS)Nz0x%08x 0x%08x %s 0x%08x)r$r%r&r'rrrrrasz Page.__str__r,) rrr rr!rr/rr;rrrrrr"0s   r"c@seZdZddZddZddZd*dd Zd d Zd+d dZddZ ddZ d,ddZ ddZ ddZ ddZddZddZd-d!d"Zd#d$Zd%d&Zd.d(d)Zd S)/BufferedZipDumpReadercCs||_g|_d|_d|_dSr)readerr current_segmentcurrent_position)rr=rrrrhs zBufferedZipDumpReader.__init__cCs||jD]}||r||_||_dSq|jjD]}||r7|t|}|j|||_||_dSqt d|)z Nz4Memory address 0x%08x is not in process memory space) r rr>r?r=r/r3r4r6 Exception)rrequested_positionpage newsegmentrrr_select_segmentos       z%BufferedZipDumpReader._select_segmentcC|jSr)r=rrrr get_readerz BufferedZipDumpReader.get_readerrcCsf|dkr |jj|}n|dkr|j|}n|dkr |jj|}ntd|j|s.td||_dS)aD Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function rr1z.Seek function whence value must be between 0-2z5Seek would cross memory segment boundaries (use move)N)r>r$r?r(r@r)rr9whencetrrrr-s  zBufferedZipDumpReader.seekcCs||dS)z@ Moves the buffer to a virtual address specified by address N)rD)raddressrrrmoves zBufferedZipDumpReader.moveNcCsR|dur|jjtjkrd}nd}|j|}|dkrdS|||}||ddS)zD Repositions the current reader to match architecture alignment Nrr1)r=processor_architecturerAMD64r?r-)r alignmentr9offset_to_alignedrrraligns   zBufferedZipDumpReader.aligncCrE)z) Returns the current virtual address )r?rrrrtellszBufferedZipDumpReader.tellcCs@|j|}|j|std|jj|j|jj||jjS)z@ Returns up to length bytes from the current memory segment #Would read over segment boundaries!)r?r>rr@r)r$)rlengthrJrrrpeeks  "zBufferedZipDumpReader.peekr0cCs|dkrtd|dkr+|j|j}|sdS|j}|jj|_|jj||jjdS|j|}|j|s:td|j}||_|jj||jj||jjS)z Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment r0zYou shouldnt be doing thisNrU)r@r> remaining_lenr?r(r)r$r)rrrJ old_new_posrrrr.s    zBufferedZipDumpReader.readcC:|jjtjkrtj|ddddStj|ddddS)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch rMlittleT byteordersignedrNr=rOrrPint from_bytesr.rrrrread_intzBufferedZipDumpReader.read_intcCrZ)z Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch rMr[Fr\rNr_rrrr read_uintrczBufferedZipDumpReader.read_uintcCs$|jj|}|dkr dS||jS)z: Searches for a pattern in the current memory segment r0)r>r)r5r?)rr7posrrrr5s zBufferedZipDumpReader.findcCs@g}d} |jj||d}|dkr |S|||jjq)zp Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list r0Tr1)r>r)r5r6 start_address)rr7re last_foundrrrfind_allszBufferedZipDumpReader.find_allcCs$|j|}t|dkrdS|dS)zx Searches for the pattern in the whole process memory space and returns the first occurrence. This is exhaustive! rr0)r=r;r2)rr7pos_srrr find_global s  z!BufferedZipDumpReader.find_globalrNcCs|jj||dS)z Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins. This is exhaustive! )allocationprotect)r=r;)rr7rkrrrfind_all_globalsz%BufferedZipDumpReader.find_all_globalcCs|||Sr)rLrd)rrerrrget_ptrs zBufferedZipDumpReader.get_ptrcCsL|jjtjkr||tj|dddd}|d|S|||S)NrNr[Tr\) r=rOrrPrLr`rar.rd)rreptrrrrget_ptr_with_offset"s    z)BufferedZipDumpReader.get_ptr_with_offsetFcCs|jj||||d}|S)N) find_first reverse_order)r= search_module)r module_namer7rprqrJrrrfind_in_module+sz$BufferedZipDumpReader.find_in_module)rr)r0rNFF)rrr rrDrFr-rLrSrTrWr.rbrdr5rhrjrlrmrortrrrrr<gs&        r<c@s^eZdZddZeddZddZddZdd d Zd d Z ddZ dddZ dddZ dS) ZipDumpReadercCs4d|_d|_d|_d|_d|_g|_g|_d|_dSr,)zipobjsysinforOr? BuildNumbermodulesr msv_dll_timestamprrrrr1s zZipDumpReader.__init__cCs t}t|d|_||S)Nr)rwzipfileZipFilerxsetup)filenamer=rrr from_file<szZipDumpReader.from_filec Cs\|jd}t||_Wdn1swYt|jt|jdd|_t ddt |jdd|_ d}|jdD]}|j t|d |d |d |qBt dd t|j |jD]*}|d durqqgt |ddd}|j|j}|j t|j||||qg|jD]}|j D]}||jdkr|j |qqdS)Nz sysinfo.jsonsysInfo Architecturer1zGetting build numberrzrr{exePathrrzFound %d modulesz.binFT)rxopenjsonloadryprintrrOrlogr`rzr{r6rrr2namelistendswithgetinfo file_sizer r"rr$) rfr modulerr$r'rBmodrrrrCs>   "   zZipDumpReader.setupcCrEr)process_handlerrrr get_handlerirGzZipDumpReader.get_handlerrNcCs(g}|jD] }|j|@r||q|Sr)r r&r6)rrkrJrBrrr get_memoryls    zZipDumpReader.get_memorycCst|Sr)r<rrrrget_buffered_readerssz!ZipDumpReader.get_buffered_readercCs0|jD]}|j|dkr|SqdS)Nr0)r{rlowerr5)rrsrrrrget_module_by_namevs z ZipDumpReader.get_module_by_nameFcCs\||}|durtd|g}|jD]}|||7}t|dkr+|dur+|Sq|S)NzCould not find module! %srT)rr@r r;r2)rrsr7rprqrneedlesrBrrrrr|s   zZipDumpReader.search_modulecCs,g}|jD]}|j|@r|||7}q|Sr)r r&r;)rr7rkrJrBrrrr;s   zZipDumpReader.searchNrurv) rrr rr!rrrrrrrrr;rrrrrw0s &   rw__main__r1)leveli)r~!minidump.streams.SystemInfoStreamrpypykatzrsysr3platformosntpathrrr"r<rwr basicConfiglrrblrrLrrrrs(  7J_