class PEdump::Loader::Minidump

Constants

MemoryRange

Attributes

hdr[RW]
io[RW]
streams[RW]

Public Class Methods

new(io) click to toggle source
# File lib/pedump/loader/minidump.rb, line 147
def initialize io
  @io = io
  @hdr = MINIDUMP_HEADER.read(@io)
  raise "invalid minidump" unless @hdr.valid?
end

Public Instance Methods

memory64_list() click to toggle source
# File lib/pedump/loader/minidump.rb, line 187
def memory64_list
  # MINIDUMP_MEMORY64_LIST
  stream = stream_by_name(:Memory64ListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY64_LIST.read io
end
memory_info_list() click to toggle source
# File lib/pedump/loader/minidump.rb, line 171
def memory_info_list
  # MINIDUMP_MEMORY_INFO_LIST
  stream = stream_by_name(:MemoryInfoListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY_INFO_LIST.read io
end
memory_list() click to toggle source
# File lib/pedump/loader/minidump.rb, line 179
def memory_list
  # MINIDUMP_MEMORY_LIST
  stream = stream_by_name(:MemoryListStream)
  return nil unless stream
  io.seek stream.Location.Rva
  MINIDUMP_MEMORY_LIST.read io
end
memory_ranges(options = {}) click to toggle source

set options = true to merge adjacent memory ranges

# File lib/pedump/loader/minidump.rb, line 198
def memory_ranges options = {}
  if memory64_list
    ml = memory64_list
    file_offset = ml.BaseRva
    r = []
    if options[:merge]
      ml.entries.each do |x|
        if r.last && r.last.va + r.last.size == x.StartOfMemoryRange
          # if section VA == prev_section.VA + prev_section.SIZE
          # then just increase the size of previous section
          r.last.size += x.DataSize
        else
          r << MemoryRange.new( file_offset, x.StartOfMemoryRange, x.DataSize )
        end
        file_offset += x.DataSize
      end
    else
      ml.entries.each do |x|
        r << MemoryRange.new( file_offset, x.StartOfMemoryRange, x.DataSize )
        file_offset += x.DataSize
      end
    end
    return r
  elsif memory_list
    ml = memory_list
    r = []
    if options[:merge]
      ml.entries.each do |x|
        if r.last && r.last.va + r.last.size == x.StartOfMemoryRange
          # if section VA == prev_section.VA + prev_section.SIZE
          # then just increase the size of previous section
          r.last.size += x.DataSize
        else
          r << MemoryRange.new( x.Rva, x.StartOfMemoryRange, x.DataSize )
        end
      end
    else
      ml.entries.each do |x|
        r << MemoryRange.new( x.Rva, x.StartOfMemoryRange, x.DataSize )
      end
    end
    return r
  else
    raise "Could not find memory ranges"
  end
end
stream_by_name(name) click to toggle source
# File lib/pedump/loader/minidump.rb, line 164
def stream_by_name(name)
  type = MINIDUMP_STREAM_TYPE.invert[name]
  raise "Unknown type symbol #{name}!" if !type

  streams.find { |s| s.StreamType == type }
end