Skip to content

Commit 6fbe295

Browse files
mrexodiamrexodia
committed
Vendor the minidump library with patches
1 parent 238a0d5 commit 6fbe295

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+7312
-2
lines changed

‎setup.cfg

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[metadata]
44
name = dumpulator
5-
version = 0.0.1
5+
version = 0.0.2
66
author = Duncan Ogilvie
77
author_email = [email protected]
88
description = An easy-to-use library for emulating code in minidump files.
@@ -22,7 +22,7 @@ package_dir =
2222
packages = find:
2323
python_requires = >=3.6
2424
install_requires =
25-
minidump ==0.0.21
25+
#minidump ==0.0.21 # this library has a bug, is vendored locally
2626
unicorn ==1.0.3
2727
pefile ==2021.9.3
2828

‎src/minidump/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Patched version, see: https://github.com/skelsec/minidump/pull/28

‎src/minidump/__amain__.py

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Author:
4+
# Tamas Jos (@skelsec)
5+
#
6+
7+
import logging
8+
import asyncio
9+
from minidump.aminidumpfile import AMinidumpFile
10+
from minidump.common_structs import hexdump
11+
from minidump._version import __banner__
12+
13+
async def run():
14+
import argparse
15+
16+
parser = argparse.ArgumentParser(description='A parser for minidumnp files')
17+
parser.add_argument('minidumpfile', help='path to the minidump file of lsass.exe')
18+
parser.add_argument('-v', '--verbose', action='count', default=0)
19+
parser.add_argument('--header', action='store_true', help='File header info')
20+
parser.add_argument('--modules', action='store_true', help='List modules')
21+
parser.add_argument('--threads', action='store_true', help='List threads')
22+
parser.add_argument('--memory', action='store_true', help='List memory')
23+
parser.add_argument('--sysinfo', action='store_true', help='Show sysinfo')
24+
parser.add_argument('--comments', action='store_true', help='Show comments')
25+
parser.add_argument('--exception', action='store_true', help='Show exception records')
26+
parser.add_argument('--handles', action='store_true', help='List handles')
27+
parser.add_argument('--misc', action='store_true', help='Show misc info')
28+
parser.add_argument('--all', action='store_true', help='Show all info')
29+
parser.add_argument('-r', '--read-addr', type=lambda x: int(x,0), help='Dump a memory region from the process\'s addres space')
30+
parser.add_argument('-s', '--read-size', type=lambda x: int(x,0), default = 0x20, help='Dump a memory region from the process\'s addres space')
31+
32+
args = parser.parse_args()
33+
if args.verbose == 0:
34+
logging.basicConfig(level=logging.INFO)
35+
elif args.verbose == 1:
36+
logging.basicConfig(level=logging.DEBUG)
37+
else:
38+
logging.basicConfig(level=1)
39+
40+
print(__banner__)
41+
42+
43+
mf = await AMinidumpFile.parse(args.minidumpfile)
44+
reader = mf.get_reader()
45+
46+
if args.all or args.threads:
47+
if mf.threads is not None:
48+
print(str(mf.threads))
49+
if mf.threads_ex is not None:
50+
print(str(mf.threads_ex))
51+
if mf.thread_info is not None:
52+
print(str(mf.thread_info))
53+
if args.all or args.modules:
54+
if mf.modules is not None:
55+
print(str(mf.modules))
56+
if mf.unloaded_modules is not None:
57+
print(str(mf.unloaded_modules))
58+
if args.all or args.memory:
59+
if mf.memory_segments is not None:
60+
print(str(mf.memory_segments))
61+
if mf.memory_segments_64 is not None:
62+
print(str(mf.memory_segments_64))
63+
if mf.memory_info is not None:
64+
print(str(mf.memory_info))
65+
if args.all or args.sysinfo:
66+
if mf.sysinfo is not None:
67+
print(str(mf.sysinfo))
68+
if args.all or args.exception:
69+
if mf.exception is not None:
70+
print(str(mf.exception))
71+
if args.all or args.comments:
72+
if mf.comment_a is not None:
73+
print(str(mf.comment_a))
74+
if mf.comment_w is not None:
75+
print(str(mf.comment_w))
76+
if args.all or args.handles:
77+
if mf.handles is not None:
78+
print(str(mf.handles))
79+
if args.all or args.misc:
80+
if mf.misc_info is not None:
81+
print(str(mf.misc_info))
82+
if args.all or args.header:
83+
print(str(mf.header))
84+
85+
if args.read_addr:
86+
buff_reader = reader.get_buffered_reader()
87+
await buff_reader.move(args.read_addr)
88+
data = await buff_reader.peek(args.read_size)
89+
print(hexdump(data, start = args.read_addr))
90+
91+
def main():
92+
asyncio.run(run())
93+
94+
if __name__ == '__main__':
95+
main()

‎src/minidump/__init__.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
name = "minidump"

‎src/minidump/__main__.py

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Author:
4+
# Tamas Jos (@skelsec)
5+
#
6+
7+
import logging
8+
from minidump.minidumpfile import MinidumpFile
9+
from minidump.common_structs import hexdump
10+
from minidump.minidumpshell import MinidumpShell
11+
from minidump._version import __banner__
12+
13+
14+
def run():
15+
import argparse
16+
17+
parser = argparse.ArgumentParser(description='A parser for minidumnp files')
18+
parser.add_argument('minidumpfile', help='path to the minidump file of lsass.exe')
19+
parser.add_argument('-v', '--verbose', action='count', default=0)
20+
parser.add_argument('-i', '--interactive', action='store_true', help='Interactive minidump shell')
21+
parser.add_argument('--header', action='store_true', help='File header info')
22+
parser.add_argument('--modules', action='store_true', help='List modules')
23+
parser.add_argument('--threads', action='store_true', help='List threads')
24+
parser.add_argument('--memory', action='store_true', help='List memory')
25+
parser.add_argument('--sysinfo', action='store_true', help='Show sysinfo')
26+
parser.add_argument('--comments', action='store_true', help='Show comments')
27+
parser.add_argument('--exception', action='store_true', help='Show exception records')
28+
parser.add_argument('--handles', action='store_true', help='List handles')
29+
parser.add_argument('--misc', action='store_true', help='Show misc info')
30+
parser.add_argument('--all', action='store_true', help='Show all info')
31+
parser.add_argument('-r', '--read-addr', type=lambda x: int(x,0), help='Dump a memory region from the process\'s addres space')
32+
parser.add_argument('-s', '--read-size', type=lambda x: int(x,0), default = 0x20, help='Dump a memory region from the process\'s addres space')
33+
34+
args = parser.parse_args()
35+
if args.verbose == 0:
36+
logging.basicConfig(level=logging.INFO)
37+
elif args.verbose == 1:
38+
logging.basicConfig(level=logging.DEBUG)
39+
else:
40+
logging.basicConfig(level=1)
41+
42+
print(__banner__)
43+
44+
if args.interactive:
45+
shell = MinidumpShell()
46+
shell.do_open(args.minidumpfile)
47+
shell.cmdloop()
48+
49+
else:
50+
51+
mf = MinidumpFile.parse(args.minidumpfile)
52+
reader = mf.get_reader()
53+
54+
if args.all or args.threads:
55+
if mf.threads is not None:
56+
print(str(mf.threads))
57+
if mf.threads_ex is not None:
58+
print(str(mf.threads_ex))
59+
if mf.thread_info is not None:
60+
print(str(mf.thread_info))
61+
if args.all or args.modules:
62+
if mf.modules is not None:
63+
print(str(mf.modules))
64+
if mf.unloaded_modules is not None:
65+
print(str(mf.unloaded_modules))
66+
if args.all or args.memory:
67+
if mf.memory_segments is not None:
68+
print(str(mf.memory_segments))
69+
if mf.memory_segments_64 is not None:
70+
print(str(mf.memory_segments_64))
71+
if mf.memory_info is not None:
72+
print(str(mf.memory_info))
73+
if args.all or args.sysinfo:
74+
if mf.sysinfo is not None:
75+
print(str(mf.sysinfo))
76+
if args.all or args.exception:
77+
if mf.exception is not None:
78+
print(str(mf.exception))
79+
if args.all or args.comments:
80+
if mf.comment_a is not None:
81+
print(str(mf.comment_a))
82+
if mf.comment_w is not None:
83+
print(str(mf.comment_w))
84+
if args.all or args.handles:
85+
if mf.handles is not None:
86+
print(str(mf.handles))
87+
if args.all or args.misc:
88+
if mf.misc_info is not None:
89+
print(str(mf.misc_info))
90+
if args.all or args.header:
91+
print(str(mf.header))
92+
93+
if args.read_addr:
94+
buff_reader = reader.get_buffered_reader()
95+
buff_reader.move(args.read_addr)
96+
data = buff_reader.peek(args.read_size)
97+
print(hexdump(data, start = args.read_addr))
98+
99+
100+
if __name__ == '__main__':
101+
run()

‎src/minidump/_version.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
__version__ = "0.0.21"
3+
__banner__ = \
4+
"""
5+
# minidump %s
6+
# Author: Tamas Jos @skelsec ([email protected])
7+
""" % __version__

0 commit comments

Comments
 (0)