"""

ret = findPattern(sequence, elSize, minNbGroup)

s = ''

for nb, txt in ret:

if nb == 1:

s += txt

else:

s += ' (%s){%d} ' % (txt, nb)

"""

if (len(sequence) % elSize) != 0:

pass # DEBUG TODO DELETE bypass needed for textprintout

#raise ValueError('your sequence length:%d has to be a multiple of element size:%d'%(len(sequence),elSize))

elif sequence == '':

return []

patterns = []

for seqlen in range(elSize, 1 + (len(sequence) // 2)):

seqs = [

sequence[

i:i +

seqlen] for i in range(

0,

len(sequence) -

seqlen +

1,

elSize)] # i %elSize, aligned on the elSize

for value, nb in collections.Counter(seqs).most_common():

# try repetition as long as it is > to minNbGroup

while nb >= minNbGroup:

ind = sequence.rfind(value * nb) # find the fulltext pattern

while ind != -1: # not found

patterns.append(

(nb *

len(value),

ind,

nb,

value)) # biggest is best, ind++ is better, large nb best

ind = sequence.rfind(

value *

nb,

0,

ind) # find it at another offset

nb -= 1 # try with a smaller number of repetition

#

if len(patterns) == 0:

return [(1, sequence)]

patterns = sorted(set(patterns))

best = patterns[-1] # higher wins

# print 'BEST:', best, best[0], best[3][:elSize], best[3][elSize:]

# print 'found new patterns :'

# for p in patterns:

# sequence2 = sequence.replace( p[3]*p[2], ' (%s){%d} '%(p[3],p[2]) )

# print p, sequence2

i = sequence.find(best[3] * best[2])

left = sequence[:i]

right = sequence[i + best[0]:]

log.debug('left %d:%s' % (len(left), left))

log.debug('right %d:%s' % (len(right), right))

ret = findPattern(left, elSize, minNbGroup)

ret2 = findPattern(right, elSize, minNbGroup)

def __init__(self, sequence, minGroupSize):

self.basicElements = set(sequence)

self.sequence = sequence

self.nb = len(self.basicElements)

self.minGroupSize = minGroupSize

if self.nb == 0:

raise ValueError('empty sequence')

elif self.nb < 0xff:

self.elSize = 1

elif self.nb < 0xffff:

self.elSize = 2

elif self.nb < 0xffffff:

self.elSize = 3

elif self.nb < 0xffffffff:

self.elSize = 4

else:

raise ValueError(

'I deny you the right to find patterns for more than 2^32 differents basic elements.')

self._makeDictionnary()

return

def _makeDictionnary(self):

log.debug('making pattern dictionnary')

self.dict = {}

self.dict_reverse = {}

for i, el in enumerate(self.basicElements):

cod = struct.pack('>L', i)[-self.elSize:] # code 0 to 0xff

self.dict[el] = cod

self.dict_reverse[cod] = el

# dict done

self.sequence_norm = [self.dict[el] for el in self.sequence]

self.sequence_text = b''.join(self.sequence_norm)

log.debug('done making pattern dictionnary %d' % self.elSize)

return

def makePattern(self):

'''[(5, 'a'), (4, '1'), (3, 'b'), (2, 'c'), (1, 'd'), (5, 'a2'), (4, 'b1c'), .. '''

# as of today, i do not have any other sequence class support rfind than string, so i have to decapsulate

# a string of findPattern to basic elements

ret = []

patterns = findPattern(

self.sequence_text,

self.elSize,

self.minGroupSize)

for nb, p in patterns:

plen = len(p)

if plen % self.elSize != 0:

raise ValueError('serious bug in findpattern')

elif nb == 1:

for i in range(0, plen, self.elSize):

ret.append((nb, self.dict_reverse[p[i:i + self.elSize]]))

else:

seq = [self.dict_reverse[p[i:i + self.elSize]]

for i in range(0, plen, self.elSize)]

ret.append((nb, seq))

log.info('Make the signature.')

# head + first word size

memory_handler = folder.load(opts.dumpfiles[0])

word_size = memory_handler.get_target_platform().get_word_size()

ppMapper = PinnedPointersMapper(word_size)

heap_sig = PointerIntervalSignature(memory_handler, '[heap]')

log.info('pinning offset list created for heap %s.' % heap_sig)

ppMapper.addSignature(heap_sig)

# now do the others

for dumpfile in opts.dumpfiles[1:]:

memory_handler = folder.load(dumpfile)

if memory_handler.get_target_platform().get_word_size() != word_size:

log.error("Differing wordsize between samples")

heap_sig = PointerIntervalSignature(memory_handler, '[heap]')

log.info('pinning offset list created for heap %s.' % heap_sig)

ppMapper.addSignature(heap_sig)

log.info('Find similar vectors between pointers on all signatures.')

ppMapper.run()

# we have :

# resolved PinnedPointers on all sigs in ppMapper.resolved

# unresolved PP in ppMapper.unresolved

# next step

'''

def __init__(self, memory_handler, pathname='[heap]'):

self.mmap = None

self.mmap_pathname = pathname

self.memory_handler = memory_handler

self.name = memory_handler.get_name()

self.cacheFilenamePrefix = config.get_cache_folder_name(self.name)

self.addressCache = {}

self.sig = None

self._word_size = memory_handler.get_target_platform().get_word_size()

self._feedback = searchers.NoFeedback()

self._get_mapping()

self._load()

def _get_mapping(self):

# XXX todo this is getHeap...

self.mmap = self.memory_handler._get_mapping(self.mmap_pathname)[0]

return

def _get_cache_filename(self):

return config.get_cache_filename('pinned', self.name)

def _load(self):

# DO NOT SORT LIST. c'est des sequences. pas des sets.

#self.cacheFilenamePrefix + '.pinned'

myname = self._get_cache_filename()

log.debug('Reading signature from %s',myname)

sig = utils.int_array_cache(myname)

if sig is None:

log.info(

"Signature has to be calculated for %s. It's gonna take a while." %

self.name)

matcher = matchers.PointerSearcher(self.memory_handler)

pointerSearcher = searchers.WordAlignedSearcher(self.mmap, matcher, self._feedback, self._word_size)

#pointerSearcher = matchers.PointerSearcher(self.mmap)

sig = []

# save first offset

last = self.mmap.start

for i in pointerSearcher: # returns the vaddr

sig.append(i - last) # save intervals between pointers

# print hex(i), 'value:', hex(self.mmap.readWord(i) )

last = i

# save it

sig = utils.int_array_save(myname, sig)

else:

log.debug("%d Signature intervals loaded from cache." % (len(sig)))

self.sig = sig

#

# previous pointer of interval 0 is start of mmap

self.addressCache[0] = self.mmap.start

self._loadAddressCache()

return

def _loadAddressCache(self):

# DO NOT SORT LIST. c'est des sequences. pas des sets.

# myname = self.cacheFilenamePrefix + '.pinned.vaddr'

myname = self._get_cache_filename() + '.vaddr'

if os.access(myname, os.F_OK):

with open(myname, 'rb') as fin:

addressCache = pickle.load(fin)

log.debug("%d Signature addresses loaded from cache." % (len(addressCache)))

self.addressCache.update(addressCache)

else: # get at least 10 values

for i in range(0, len(self), len(self) // 10):

self.getAddressForPreviousPointer(i)

self._saveAddressCache()

return

def _saveAddressCache(self):

# myname = self.cacheFilenamePrefix + '.pinned.vaddr'

myname = self._get_cache_filename() + '.vaddr'

pickle.dump(self.addressCache, open(myname, 'wb'))

def getAddressForPreviousPointer(self, offset):

'''

# use cache my friends

if offset in self.addressCache:

return self.addressCache[offset]

# get closest one

keys = sorted(self.addressCache)

keys = list(itertools.takewhile(lambda x: x < offset, keys))

last = keys[-1] # take the closest

startValue = self.addressCache[last] # == addr(last-1)

# we are not interested in adding offset interval. that would give us

# the second pointer address

subseq = self.sig[last:offset]

#newsum = startValue + reduce(lambda x,y: x+y, subseq)

#self.addressCache[offset] = newsum

# be proactive +/- 40 Mo

newsum = startValue

for i in range(last, offset):

newsum += self.sig[i]

self.addressCache[i + 1] = newsum

# be proactive

return newsum

def __len__(self):

return len(self.sig)

def __str__(self):

'''

def __init__(self, sequence, size, cacheAll=True):

self.size = size

self.seq = sequence

self.sets = {} # key is sequence len

self.cacheAll = cacheAll

self.findUniqueSequences(self.seq)

def findUniqueSequences(self, seq):

log.debug('number of intervals: %d' % (len(seq)))

sig_set = set(seq)

log.debug('number of unique intervals value: %d' % (len(sig_set)))

# create the tuple

self.sets[self.size] = set(self.getSeqs())

log.debug(

'number of unique sequence len %d : %d' %

(self.size, len(

self.sets[

self.size])))

return

def getSeqs(self):

if not hasattr(self, 'seqs'):

seqlen = self.size

self.seqs = [tuple(self.seq[i:i + seqlen])

for i in range(0, len(self.seq) - seqlen + 1)]

seqs = self.seqs

return seqs

def __len__(self):

return len(self.seq) - self.size

def __iter__(self):

seqlen = self.size

for i in range(0, len(self.seq) - seqlen + 1):

yield tuple(self.seq[i:i + seqlen])

'''

def __init__(self, sequence, sig, offset, word_size):

self.sequence = sequence

self.nb_bytes = sum(sequence) + word_size

self.offset = offset

self.sig = sig

self.relations = {}

self.vaddr = None

def pinned(self, nb=None):

if nb is None:

nb = len(self.sequence)

return self.sequence[:nb]

def __len__(self):

return len(self.sequence)

def structLen(self):

return self.nb_bytes

def __eq__(self, o):

return len(self) == len(o) and \

self.structLen() == o.structLen() and \

self.sequence == o.sequence

# def __cmp__(self, o):

# if len(self) != len(o):

# return cmp(len(self), len(o))

# # that means the sequence is different too

# if self.structLen() != o.structLen():

# return cmp(self.structLen(), o.structLen())

# if self.sequence != o.sequence: # the structLen can be the same..

# return cmp(self.sequence, o.sequence)

# # else offset is totally useless, we have a match

# return 0

def __contains__(self, other):

raise NotImplementedError

if not isinstance(other, PinnedPointers):

raise ValueError

if other.sig == self.sig: # well, not really

if other.offset >= self.offset and other.offset <= self.offset + \

len(self):

# if other.sequence in self.sequence: ## need subsearch

return True

return False

def addRelated(self, other, sig=None):

''' add a similar PinnedPointer from another offset or another sig '''

if self != other:

raise ValueError('We are not related PinnedPointers.')

if sig is None:

sig = self.sig

if sig not in self.relations:

self.relations[sig] = list()

self.relations[sig].append(other)

return

def getAddress(self, numOffset=0):

'''

if self.vaddr is None:

if numOffset >= len(self.sequence):

raise IndexError

self.vaddr = self.sig.getAddressForPreviousPointer(self.offset)

if numOffset != 0:

return self.sig.getAddressForPreviousPointer(

self.offset + numOffset)

return self.vaddr

def __str__(self):

return '<PinnedPointers %s[%d:%d] +%d bytes/%d pointers>' % (

self.sig, self.offset, self.offset + len(self), self.nb_bytes, len(self.sequence) + 1)

@classmethod

def link(cls, lstOfPinned):

for i, p1 in enumerate(lstOfPinned):

for p2 in lstOfPinned[i + 1:]:

p1.addRelated(p2, p2.sig)

p2.addRelated(p1, p1.sig)

'''

def __init__(self, pinnedPointer, word_size):

self.pinnedPointer = pinnedPointer

# by default we start at the first pointer

self.start = pinnedPointer.getAddress()

self.stop = pinnedPointer.getAddress(

len(pinnedPointer)) # by default we stop at the last pointer

# add the length of the last pointer

self.stop += word_size

self.pointers = None

self.pointersTypes = {}

self.pointersValues = None

self.typename = self.makeTypeName()

def getPointersAddr(self):

if self.pointers is None:

self.pointers = [self.pinnedPointer.getAddress(

i) for i in range(len(self.pinnedPointer) + 1)]

return self.pointers

def getPointersValues(self):

if self.pointersValues is None:

mmap = self.pinnedPointer.sig.mmap

self.pointersValues = [

mmap.read_word(addr) for addr in self.getPointersAddr()]

return self.pointersValues

def setPointerType(self, number, anonStruct):

''' set a specific pointer to a specific anonStruct type '''

if anonStruct.sig() != self.sig():

raise TypeError(

'You cant type with a AnonStruct from another PointerIntervalSignature. %s vs %s' %

(self, anonStruct))

if number in self.pointersTypes:

raise IndexError('%s Pointer number %d has already been identified as a type %s - new type : %s' % (

self, number, self.getPointerType(number).type(), anonStruct.type()))

self.pointersTypes[number] = anonStruct

myself = ''

if self == anonStruct:

myself = ' (MYSELF) '

log.debug(

'Set %s pointer number %d to type %s %s' %

(self.type(),

number,

self.getPointerType(number).type(),

myself))

return

def getPointerOffset(self, number):

return self.pinnedPointer.getAddress(number) - self.start

def getPointerType(self, number):

return self.pointersTypes[number]

def sig(self):

return self.pinnedPointer.sig

def sequence(self):

return self.pinnedPointer.sequence

def type(self):

return self.typename

def __contains__(self, other):

if isinstance(other, numbers.Number):

rel = other - self.start

if rel > len(self) or (rel < 0):

return False

return True

else:

return False

def __cmp__(self, other):

if other in self:

return 0

else:

return cmp(self.start, other)

def __len__(self):

return int(self.stop - self.start)

def makeTypeName(self):

return 'AnonStruct_%s_%s_%s_%s' % (len(self), len(

self.pinnedPointer), self.pinnedPointer.sig.name, self.pinnedPointer.offset)

def toCtypesString(self):

s = ''

return

def __str__(self):

'''

def __init__(self, word_size, sequenceLength=20):

self.cacheValues2 = {}

self.signatures = []

self.signatures_sequences = {}

self.started = False

self.common = []

self.length = sequenceLength

self.word_size = word_size

return

def addSignature(self, sig):

if self.started:

raise ValueError("Mapping has stated you can't add new signatures")

self.signatures.append(sig)

return

def _findCommonSequences(self):

log.info('Looking for common sequence of length %d' % self.length)

common = None

# make len(sig) sub sequences of size <length> ( in .sets )

for sig in self.signatures:

self.signatures_sequences[sig] = SequencesMaker(

sig.sig,

self.length,

False)

if common is None:

common = set(self.signatures_sequences[sig].sets[self.length])

else:

common &= self.signatures_sequences[sig].sets[self.length]

log.info(

'Common sequence of length %d: %d seqs' %

(self.length, len(common)))

return common

def _mapToSignature(self, sig):

# LOL. difflib.SequenceMatcher.

# maintenant il faut mapper le common set sur l'array original,

# a) on peut iter(sig) jusqu'a trouver une sequence non common.

# b) reduce previous slices to 1 bigger sequence.

# On peut aggreger les offsets, tant que la sequence start:start+<length> est dans common.

# on recupere un 'petit' nombre de sequence assez larges, censees etre

# communes.

sig_aggregated_seqs = []

sig_uncommon_slice_offset = []

start = 0

stop = 0

i = 0

length = self.length

seqs_sig1 = self.signatures_sequences[sig]

common = self.common

# all subsequences, offset by offset

enum_seqs_sig = enumerate(seqs_sig1)

try:

while i < len(seqs_sig1): # we wont have a StopIteration...

for i, subseq in enum_seqs_sig:

if subseq in common:

start = i

#log.debug('Saving a Uncommon slice %d-%d'%(stop,start))

sig_uncommon_slice_offset.append((stop, start))

break

del subseq

# enum is on first valid sequence of <length> intervals

#log.debug('Found next valid sequence at interval offset %d/%d/%d'%(i,len(sig.sig), len(seqs_sig1) ))

for i, subseq in enum_seqs_sig:

if subseq in common:

del subseq

continue

# the last interval in the tuple of <length> intervals is

# not common

else:

# so we need to aggregate from [start:stop+length]

# there CAN be another common slice starting between stop and stop+length.

# (1,2,3,4) is common , (1,2,3,4,6) is NOT common because of the 1, (2,3,4,6) is common.

# next valid slice is at start+1

# so Yes, we can have recovering Sequences

stop = i # end aggregation slice

seqStop = stop + length - 1

# we should also pin it in sig2, sig3, and relate to

# that...

pp = savePinned(

self.cacheValues2,

sig,

start,

seqStop -

start,

self.word_size)

sig_aggregated_seqs.append(pp) # save a big sequence

#log.debug('Saving an aggregated sequence %d-%d'%(start, stop))

del subseq

break # goto search next common

# find next valid interval

# wait for end of enum

except StopIteration as e:

pass

# done

# log.debug('%s'%sig1_uncommon_slice_offset)

log.info(

'There is %d uncommon slice zones in %s' %

(len(sig_uncommon_slice_offset), sig))

log.info(

'There is %d common aggregated sequences == struct types in %s' %

(len(sig_aggregated_seqs), sig))

return sig_uncommon_slice_offset, sig_aggregated_seqs

def _findMultipleInstances(self):

allpp = sorted([v for l in self.cacheValues2.values()

for v in l], reverse=True)

unresolved = []

linkedPP = []

linked = 0

multiple = 0

for k, g in itertools.groupby(allpp):

l = list(g)

# we can have multiple instances btu not less.

if len(l) < len(mapper.signatures):

unresolved.extend(l)

# print 'not same numbers'

continue

else:

allSigs = True

# we should have all 3 signatures

found = [pp.sig for pp in l]

for s in mapper.signatures:

if s not in found:

unresolved.extend(l)

# print 'not same sigs', s

allSigs = False

break

# if ok, link them all

if allSigs:

PinnedPointers.link(l)

linkedPP.extend(l)

multiple += 1

linked += len(l)

unresolved = sorted(unresolved, reverse=True)

linkedPP = sorted(linkedPP, reverse=True)

self.unresolved = unresolved

self.resolved = linkedPP

log.info(

'Linked %d PinnedPointers across all PointerIntervalSignatures, %d unique in all Signatures ' %

(linked, multiple))

log.info(

'left with %d/%d partially unresolved pp' %

(len(unresolved), len(allpp)))

# cache to disk

# cacheToDisk(self.resolved,'pinned-resolved')

# cacheToDisk(self.unresolved,'pinned-unresolved')

return

def run(self):

self.started = True

all_common_pp = []

CACHE = 'pinned-resolved'

CACHE2 = 'pinned-unresolved'

global mapper

mapper = self

# drop 1 : find common sequences

self.common = self._findCommonSequences()

# drop 2: Map sequence to signature, and aggregate overlapping

# sequences.

for sig in self.signatures:

unknown_slices, common_pp = self._mapToSignature(sig)

all_common_pp.extend(common_pp)

# drop 3: error case, we have been too optimistic about unicity of common sequence.

# lets try and reduce the errors.

# for each structLen, find at least one pp for each sig

# chance are that only the last interval is botched, so we only have to compare between

# pp1.sequence[:-1] and pp2.sequence[:-1] to find a perfect match

# we nee to find sole pointer. pop all equals in the 3 sigs.

# drop 3: Analyze and find multiple instances of the same Sequence

self._findMultipleInstances()

# drop 4: Sequence should have been linked, cross-signature. Try to extend them

# On peut pas agrandir les sequences. il n"y a plus de common pattern,

# Par contre, on peut essayer de trouver des sequences plus courtes dans les

# intervalles uncommon_slices

# on peut se servir des pointeur en stack pour trouver les vrai

# start-of-structure.

caches = self._makeCaches()

pickle.dump(

caches,

open(

'/home/jal/Compil/python-haystack/outputs/caches',

'wb'))

self._pinResolved(caches)

return

# 3 STEP 2 , pin them on the wall/heap

def _makeCaches(self):

caches = {}

for sig in self.signatures[:]:

a = Dummy()

resolved_for_sig = [pp for pp in self.resolved if pp.sig == sig]

unresolved_for_sig = [

pp for pp in self.unresolved if pp.sig == sig]

log.debug('Pin anonymous allocators on %s' % sig)

pinned = [AnonymousStructRange(pp, self.word_size) for pp in resolved_for_sig]

log.debug('Create list of allocators addresses for %s' % sig)

pinned_start = [pp.getAddress() for pp in resolved_for_sig]

# if sorted(pinned_start) != pinned_start:

# log.error('Damn !')

# raise ValueError('iscrewedupbadlyhere')

log.debug('Pin probable anonymous allocators on %s' % sig)

pinned_lightly = [

AnonymousStructRange(pp, self.word_size) for pp in unresolved_for_sig]

log.debug(

'Create list of probable allocators addresses for %s' %

sig)

pinned_lightly_start = [pp.getAddress()

for pp in unresolved_for_sig]

# save it

a.pinned = pinned

a.pinned_start = pinned_start

a.pinned_lightly = pinned_lightly

a.pinned_lightly_start = pinned_lightly_start

caches[sig] = a

return caches

def _pinResolved(self, caches):

#log.debug('Overlapping sequences can happen. we will filter them later using a tree of allocators.')

# for i, pp in enumerate(pinned):

# if pp.start in pinned[i+1:]:

# pass

# TODO stack pointers value and compare them to pinned_start,

# pinned_lightly_start

# In each anon structure Pa, get each pointers value.

# If the value is in the list of allocators head addresses, we have a start of struct (mostly true)

# we check Related Struct in the other signatures to see if everybody agrees.

# the parent in sig A (Pa) should point to children type in sig A (Ca)

# the parent in sig B (Pb) should point to children type in sig B (Cb)

# Pa and Pb are related, Ca and Cb should be related too.

sig = self.signatures[0]

pinned = caches[sig].pinned

pinned_start = caches[sig].pinned_start

pinned_lightly = caches[sig].pinned_lightly

pinned_lightly_start = caches[sig].pinned_lightly_start

# for as in pinned, get pointers values and make a tree

log.debug('Going through pointers')

startsWithPointer = 0

startsMaybeWithPointer = 0

pointsToStruct = 0

pointsToStruct2 = 0

self.startTree = []

self.startTree2 = []

self.tree = []

self.tree2 = []

startsWithPointerList = self.startTree

startsMaybeWithPointerList = self.startTree2

pointsToStructList = self.tree

pointsToStructList2 = self.tree2

for i, ap in enumerate(pinned):

ptrs = ap.getPointersValues()

crosscheck = False

# ptr is the value of pointer number j in the anonymoustruct ap

for j, ptr in enumerate(ptrs):

p_off = ap.getPointerOffset(j)

if ptr in pinned_start:

log.debug(

'--------------------------------------------------------------------------')

log.debug(

'Lucky guess s:%d, p:%d, we find a pointer to the start of %d PinnedPointer struct.' %

(i, j, pinned_start.count(ptr)))

startsWithPointerList.append((ap, j))

# check if the same struct in sig2, sig3... points to the

# same target struct

if self._crosscheckChild(caches, ap, j, ptr):

if ap == ap.getPointerType(j):

log.info(

'ID-ed %s.pointers[%d](0x%x) to type %s (MYSELF)' %

(ap, j, ap.getPointerOffset(j), ap.getPointerType(j)))

else:

log.info(

'ID-ed %s.pointers[%d](0x%x) to type %s (0x0)' %

(ap, j, ap.getPointerOffset(j), ap.getPointerType(j)))

crosscheck = True

log.debug(

'--------------------------------------------------------------------------')

elif ptr in pinned_lightly_start:

log.debug(

'Lucky guess s:%d, p:%d we find a pointer to %d maybe-PinnedPointer struct.' %

(i, j, pinned_lightly_start.count(ptr)))

startsMaybeWithPointerList.append((ap, j))

#log.info('ID-ed %s.pointers[%d] to LIGHTLY'%(ap, j))

# ptr is in the middle of a anonymous struct

elif ptr in pinned:

pointsToStructList.append((ap, j))

# check if the same struct in sig2, sig3... points to the

# same target struct

offset = self._crosscheckChildInMiddle(caches, ap, j, ptr)

if offset:

if ap == ap.getPointerType(j):

#p_off = ap.getPointerOffset(j)

# offset - p_off dans la meme structure donne une

# idee de la sequentialite des malloc

log.info(

'ID-ed %s.pointers[%d](0x%x) to type %s (0x%x) %d' %

(ap, j, p_off, ap.getPointerType(j), offset, offset - p_off))

prev_p_off = p_off

else:

log.info(

'ID-ed %s.pointers[%d](0x%x) to type %s (0x%x) ' %

(ap, j, p_off, ap.getPointerType(j), offset))

elif ptr in pinned_lightly:

pointsToStructList2.append((ap, j))

#log.info('ID-ed %s.pointers[%d] in LIGHTLY'%(ap, j))

else:

# the pointer is not in another struct. Find the next

# nearest

first_addr, anonStruct = self._findNearestStruct(

ptr, caches, sig)

# if there is at least one pointer type which crosschecked

if crosscheck:

self._relinkPointers(caches, ap)

# pointer to self means c++ object ?

sig._saveAddressCache()

log.debug(

'We have found %d pointers to pinned structs' %

startsWithPointer)

log.debug(

'We have found %d pointers to pinned maybe-structs' %

startsMaybeWithPointer)

return

def _findNearestStruct(self, ptr, caches, sig):

pinned = caches[sig].pinned

pinned_start = caches[sig].pinned_start

pinned_lightly = caches[sig].pinned_lightly

pinned_lightly_start = caches[sig].pinned_lightly_start

#

first_addr, anonStruct = self._findFirstStruct(

ptr, pinned_start, pinned)

first_addr_l, anonStruct_l = self._findFirstStruct(

ptr, pinned_lightly_start, pinned_lightly)

if first_addr == first_addr_l and first_addr == -1:

log.warning('No struct after ptr value 0x%x' % ptr)

return -1, None

if first_addr_l < first_addr: # TODO ???

ret = (anonStruct, first_addr)

else:

ret = (anonStruct_l, first_addr_l)

anonStruct = anonStruct_l

if not anonStruct:

return -1, None

offset = anonStruct.start - ptr

if offset < 64:

log.debug(

'Found a probable start of struct at %d bytes earlier' %

offset)

return ret

def _findFirstStruct(self, ptr, addresses, anons):

try:

first_addr = itertools.dropwhile(

lambda x: x < ptr,

addresses).next()

anon = anons[addresses.index(first_addr)] # same index

except StopIteration as e:

return -1, None

return first_addr, anon