* Updated for memflow 0.2.2
* Replaced periods with underscores in generated file names for easier inclusion
* Program execution now continues if analysis fails at any point
* Removed custom error type in favor of anyhow
* Added logging to cs2-dumper.log
* Now compilable on Linux
This commit is contained in:
a2x
2024-07-30 02:06:35 +10:00
parent 8897183075
commit 7933103b03
98 changed files with 8413 additions and 8332 deletions

View File

@@ -1,5 +1,7 @@
use std::collections::BTreeMap;
use anyhow::Result;
use log::debug;
use memflow::prelude::v1::*;
@@ -7,25 +9,20 @@ use memflow::prelude::v1::*;
use pelite::pe64::exports::Export;
use pelite::pe64::{Pe, PeView};
use serde::{Deserialize, Serialize};
use crate::error::Result;
use crate::mem::read_addr64_rip;
use crate::source2::InterfaceReg;
pub type InterfaceMap = BTreeMap<String, Vec<Interface>>;
#[derive(Debug, Deserialize, Serialize)]
pub struct Interface {
pub name: String,
pub value: u32,
}
pub type InterfaceMap = BTreeMap<String, BTreeMap<String, imem>>;
pub fn interfaces(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<InterfaceMap> {
process
.module_list()?
.iter()
.filter_map(|module| {
let buf = process.read_raw(module.base, module.size as _).ok()?;
let buf = process
.read_raw(module.base, module.size as _)
.data_part()
.ok()?;
let view = PeView::from_bytes(&buf).ok()?;
@@ -38,8 +35,7 @@ pub fn interfaces(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<Interfa
.ok()?;
if let Export::Symbol(symbol) = ci_export {
let list_addr = process
.read_addr64_rip(module.base + symbol)
let list_addr = read_addr64_rip(process, module.base + symbol)
.data_part()
.ok()?;
@@ -58,32 +54,29 @@ fn read_interfaces(
process: &mut IntoProcessInstanceArcBox<'_>,
module: &ModuleInfo,
list_addr: Address,
) -> Result<Vec<Interface>> {
let mut ifaces = Vec::new();
) -> Result<BTreeMap<String, imem>> {
let mut ifaces = BTreeMap::new();
let mut cur_reg = Pointer64::<InterfaceReg>::from(process.read_addr64(list_addr)?);
let mut cur_reg = Pointer64::<InterfaceReg>::from(process.read_addr64(list_addr).data_part()?);
while !cur_reg.is_null() {
let reg = cur_reg.read(process)?;
let name = reg.name.read_string(process)?.to_string();
let instance = process.read_addr64_rip(reg.create_fn.address())?;
let value = (instance - module.base) as u32;
let reg = process.read_ptr(cur_reg).data_part()?;
let name = process.read_utf8(reg.name.address(), 4096).data_part()?;
let instance = read_addr64_rip(process, reg.create_fn.address())?;
let value = instance - module.base;
debug!(
"found interface: {} @ {:#X} ({} + {:#X})",
"found interface: {} at {:#X} ({} + {:#X})",
name,
value as u64 + module.base.to_umem(),
module.name,
value
);
ifaces.push(Interface { name, value });
ifaces.insert(name, value);
cur_reg = reg.next;
}
ifaces.sort_unstable_by(|a, b| a.name.cmp(&b.name));
Ok(ifaces)
}