Class: PEdump::Loader::Minidump

Inherits:
Object
  • Object
show all
Defined in:
lib/pedump/loader/minidump.rb

Defined Under Namespace

Classes: MemoryRange

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(io) ⇒ Minidump

Returns a new instance of Minidump.



147
148
149
150
151
 
# File 'lib/pedump/loader/minidump.rb', line 147

def initialize io
  @io = io
  @hdr = MINIDUMP_HEADER.read(@io)
  raise "invalid minidump" unless @hdr.valid?
end

Instance Attribute Details

#hdr ⇒ Object

Returns the value of attribute hdr.



145
146
147
 
# File 'lib/pedump/loader/minidump.rb', line 145

def hdr
  @hdr
end

#io ⇒ Object

Returns the value of attribute io.



145
146
147
 
# File 'lib/pedump/loader/minidump.rb', line 145

def io
  @io
end

#streams ⇒ Object

Returns the value of attribute streams.



145
146
147
 
# File 'lib/pedump/loader/minidump.rb', line 145

def streams
  @streams
end

Instance Method Details

#memory64_list ⇒ Object 



187
188
189
190
191
192
193
 
# File 'lib/pedump/loader/minidump.rb', line 187

def memory64_list
  # MINIDUMP_MEMORY64_LIST
  stream = stream_by_name(:Memory64ListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY64_LIST.read io
end

#memory_info_list ⇒ Object 



171
172
173
174
175
176
177
 
# File 'lib/pedump/loader/minidump.rb', line 171

def memory_info_list
  # MINIDUMP_MEMORY_INFO_LIST
  stream = stream_by_name(:MemoryInfoListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY_INFO_LIST.read io
end

#memory_list ⇒ Object 



179
180
181
182
183
184
185
 
# File 'lib/pedump/loader/minidump.rb', line 179

def memory_list
  # MINIDUMP_MEMORY_LIST
  stream = stream_by_name(:MemoryListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY_LIST.read io
end

#memory_ranges(options = {}) ⇒ Object

set options = true to merge adjacent memory ranges



198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
 
# File 'lib/pedump/loader/minidump.rb', line 198

def memory_ranges options = {}
  if memory64_list
    ml = memory64_list
    file_offset = ml.BaseRva
    r = []
    if options[:merge]
      ml.entries.each do |x|
        if r.last && r.last.va + r.last.size == x.StartOfMemoryRange
          # if section VA == prev_section.VA + prev_section.SIZE
          # then just increase the size of previous section
          r.last.size += x.DataSize
        else
          r << MemoryRange.new( file_offset, x.StartOfMemoryRange, x.DataSize )
        end
        file_offset += x.DataSize
      end
    else
      ml.entries.each do |x|
        r << MemoryRange.new( file_offset, x.StartOfMemoryRange, x.DataSize )
        file_offset += x.DataSize
      end
    end
    return r
  elsif memory_list
    ml = memory_list
    r = []
    if options[:merge]
      ml.entries.each do |x|
        if r.last && r.last.va + r.last.size == x.StartOfMemoryRange
          # if section VA == prev_section.VA + prev_section.SIZE
          # then just increase the size of previous section
          r.last.size += x.DataSize
        else
          r << MemoryRange.new( x.Rva, x.StartOfMemoryRange, x.DataSize )
        end
      end
    else
      ml.entries.each do |x|
        r << MemoryRange.new( x.Rva, x.StartOfMemoryRange, x.DataSize )
      end
    end
    return r
  else
    raise "Could not find memory ranges"
  end
end

#stream_by_name(name) ⇒ Object 



164
165
166
167
168
169
 
# File 'lib/pedump/loader/minidump.rb', line 164

def stream_by_name(name)
  type = MINIDUMP_STREAM_TYPE.invert[name]
  raise "Unknown type symbol #{name}!" if !type

  streams.find { |s| s.StreamType == type }
end