From b8c9a36897a9fc4eb66b165a0ba66d4b1d1d9d39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Mr=C3=A1zek?= Date: Sun, 15 Nov 2009 20:41:10 +0000 Subject: [PATCH] cursor/window offsets for all versions, finished incremental search tool --- library/DFProcess.cpp | 1 + output/Memory.xml | 59 +++++++++---- tools/incrementalsearch.cpp | 172 ++++++++++++++++++++++++++++++++++++ 3 files changed, 216 insertions(+), 16 deletions(-) diff --git a/library/DFProcess.cpp b/library/DFProcess.cpp index 7a8e9c187..0ff3361c3 100644 --- a/library/DFProcess.cpp +++ b/library/DFProcess.cpp @@ -114,6 +114,7 @@ void Process::getMemRanges( vector & ranges ) while (fgets(buffer, 1024, mapFile)) { t_memrange temp; + temp.name[0] = 0; sscanf(buffer, "%llx-%llx %s %llx %2llu:%2llu %llu %s", &temp.start, &temp.end, diff --git a/output/Memory.xml b/output/Memory.xml index ea6d715f5..3e230d9a3 100644 --- a/output/Memory.xml +++ b/output/Memory.xml @@ -734,6 +734,11 @@ + +
0x9fc294
+
0xd457f4
+
0xd73868
+
0xd73844
@@ -819,6 +824,10 @@ +
0x9662a4
+
0xcae368
+
0xcdc3dc
+
0xcdc3b8
@@ -826,6 +835,10 @@ 6f81231b845e9c9dc29aaf57705ccc7c +
0x9652a4
+
0xcdf5a0
+
0xd0d64c
+
0xd0d628
@@ -859,7 +872,11 @@
0x015FCE3C
- + +
0x95f2b4
+
0xd995a0
+
0xdc764c
+
0xdc7628
@@ -868,6 +885,10 @@ +
0x009642b4
+
0x00d9e600
+
0x00dcc6ac
+
0x00dcc688
@@ -876,6 +897,10 @@ +
0x009662B4
+
0x00DA060C
+
0x00DCE6B8
+
0x00DCE694
@@ -884,6 +909,10 @@ +
0x009662B4
+
0x00DA061C
+
0x00DCE6C8
+
0x00DCE6A4
@@ -891,19 +920,6 @@ 59ab29021aca9f3c66b1ab102fb3ceea -
0x009662B4
-
0x00DA061C
-
0x00DCE6C8
-
0x00DCE6A4
-
.-"""-. @@ -941,6 +957,11 @@
0x09335CB0
0x093326AC
+ +
0x8877634
+
0x8d17ff4
+
0x8d17ff8
+
0x8d17ffC
0x09374FA8
@@ -1107,6 +1128,7 @@ fb8ecac8a12af5d0d7b1707078985d0d +
0x88073d4
@@ -1119,7 +1141,12 @@
0x08F55740
0x08F58890
0x08F55250
- + +
0x0877B33C
+
0x893ABD4
+
0x893ABD8
+
0x893ABDC
+
0x08F97BA4
@@ -1148,6 +1175,7 @@ 2f3cb9d720e9fe8844c02c72a2b20bbd +
0x8780354
@@ -1170,7 +1198,6 @@ - diff --git a/tools/incrementalsearch.cpp b/tools/incrementalsearch.cpp index 3c226a1ce..7f30de343 100644 --- a/tools/incrementalsearch.cpp +++ b/tools/incrementalsearch.cpp @@ -6,10 +6,15 @@ #include #include #include +#include +#include +#include using namespace std; #ifndef LINUX_BUILD #define WINVER 0x0500 + // this one prevents windows from infecting the global namespace with filth + #define NOMINMAX #define WIN32_LEAN_AND_MEAN #include #endif @@ -17,9 +22,82 @@ using namespace std; #include #include #include +#include + +//TODO: lots of optimization +void searchLoop(DFHack::API & DF, vector & ranges, int size, int alignment) +{ + int32_t test1; + int32_t test2; + vector found; + vector newfound; + found.reserve(100000); + newfound.reserve(100000); + + //bool initial = 1; + cout << "search ready - insert integers, 'p' for results" << endl; + + string select; + while (1) + { + cout << ">>"; + DF.Detach(); + std::getline(cin, select); + DF.Attach(); + if(select == "p") + { + cout << "Found addresses:" << endl; + for(int i = 0; i < found.size();i++) + { + cout << hex << "0x" << found[i] << endl; + } + } + else if(sscanf(select.c_str(),"%d", &test1) == 1) + { + newfound.clear(); + bool initial = found.empty(); + + if(initial) + { + // for each range + for (int i = 0; i < ranges.size();i++) + { + // can't read? range is invalid to us + if(!ranges[i].read) + continue; + + //loop + for(uint64_t offset = ranges[i].start;offset <= ranges[i].end - size; offset+=alignment) + { + DF.ReadRaw(offset, size, (uint8_t *) &test2); + if(test1 == test2 ) + found.push_back(offset); + } + } + cout << "found " << found.size() << " addresses" << endl; + } + else + { + for(int j = 0; j < found.size();j++) + { + DF.ReadRaw(found[j], size, (uint8_t *) &test2); + if(test1 == test2) + { + newfound.push_back(found[j]); + } + } + + cout << "matched " << newfound.size() << " addresses out of " << found.size() << endl; + found = newfound; + } + } + else break; + } +} int main (void) { + string select; DFHack::API DF("Memory.xml"); if(!DF.Attach()) { @@ -28,11 +106,105 @@ int main (void) } DFHack::Process * p = DF.getProcess(); vector ranges; + vector selected_ranges; p->getMemRanges(ranges); + cout << "Which range to search? (default is 1-4)" << endl; for(int i = 0; i< ranges.size();i++) { + cout << dec << "(" << i << ") "; ranges[i].print(); } + + try_again_ranges: + cout << ">>"; + std::getline(cin, select); + int start, end; + if(select.empty()) + { + // empty input, assume default. observe the length of the memory range vector + // these are hardcoded values, intended for my convenience only + if(p->getDescriptor()->getOS() == DFHack::memory_info::OS_WINDOWS) + { + start = min(11, (int)ranges.size()); + end = min(14, (int)ranges.size()); + } + else if(p->getDescriptor()->getOS() == DFHack::memory_info::OS_LINUX) + { + start = min(11, (int)ranges.size()); + end = min(14, (int)ranges.size()); + } + else + { + start = 1; + end = 1; + } + } + // I like the C variants here. much less object clutter + else if(sscanf(select.c_str(), "%d-%d", &start, &end) == 2) + { + start = min(start, (int)ranges.size()); + end = min(end, (int)ranges.size()); + } + else + { + goto try_again_ranges; // yes, this is a goto. bite me. + } + end++; + cout << "selected ranges:" <>"; + std::getline(cin, select); + int size; + if(select.empty()) + { + size = 4; + } + else if( sscanf(select.c_str(), "%d", &size) == 1 ) + { + if(/*size != 8 &&*/ size != 4 && size != 2 && size != 1) + { + goto try_again_size; + } + } + else + { + goto try_again_size; + } + + // input / validation of variable alignment (default is to use the same alignment as size) + try_again_align: + cout << "Variable alignment (1,2,4 bytes, default is " << size << ")" << endl; + cout << ">>"; + std::getline(cin, select); + int alignment = size; + if(select.empty()) + { + alignment = size; + } + else if( sscanf(select.c_str(), "%d", &alignment) == 1 ) + { + if(/*alignment != 8 &&*/ alignment != 4 && alignment != 2 && alignment != 1) + { + goto try_again_align; + } + } + else + { + goto try_again_align; + } + + searchLoop(DF,selected_ranges, size, alignment); + + // initial value + // cycle until you get only a few offsets (~10?) if(!DF.Detach()) {