Description
An efficient mapping from an address space to stored data.
This class, a specialization of Sawyer::Container::AddressMap, maps 64-bit addresses to bytes. The address space is organized into non-overlapping, contiguous "segments" (Sawyer::Container::AddressSegment) that impart properties such as names and access permissions. Each segment points into a buffer (subclass of Sawyer::Container::Buffer) where the data bytes are stored.
The buffers pointed to by the segments are reference counted with smart pointers. Normally, each segment points to the beginning of its own buffer, but this is not always true. Sometimes segments share buffers, and sometimes segments point into the middle of buffers. This flexibility allows parts of an address space to be erased or replaced even from the middle of existing segments. It also allows the same data to be mapped and shared at multiple addresses.
The MemoryMap objects are also reference counted and created by the instance method. Copying a MemoryMap object is shallow: the new object will have its own mapping and segments, but will share the underying buffers with the source map.
Most of the low level functionality for a MemoryMap comes from the Sawyer::Container::AddressMap base class, such as the ability to add, erase, or replace parts of the address space and the ability to read data from the address space. The base class documentation has lots of example code. On the other hand, most of the more complex behaviors are defined in the MemoryMap class, such as initializing a MemoryMap from a Linux process or reading a NUL-terminated string.
Here's an example of mapping a file into an address space at virtual address 0x08040000 and then temporarily replacing the second 1kB page of the file with our own data. We demonstrate using a Sawyer::Container::MappedBuffer because these are very fast for large files, especially if only small parts of the file are ever accessed.
A MemoryMap provides methods to easily read from and write to the underlying data storage, addressing it in terms of the virtual address space. These functions return the addresses that were accessed, and are prefixed by calls that describe what data is to be accessed.
The Sawyer documentation contains many more examples.
Definition at line 112 of file MemoryMap.h.
#include <Rose/BinaryAnalysis/MemoryMap.h>
Classes | |
| struct | Attach |
| Attach with ptrace first when reading a process? More... | |
| class | Exception |
| Exception for MemoryMap operations. More... | |
| struct | Inconsistent |
| Exception for an inconsistent mapping. More... | |
| struct | NoFreeSpace |
| Exception thrown by find_free() when there's not enough free space left. More... | |
| struct | NotMapped |
| Exception for when we try to access a virtual address that isn't mapped. More... | |
| struct | ProcessMapRecord |
| Information about a process map. More... | |
| struct | SyntaxError |
| Exception thrown by load() when there's a syntax error in the index file. More... | |
Public Types | |
| enum | Clobber { NO, YES } |
| Overwrite (parts of) existing segments? | |
| enum | InsertFileMapMode { MAP_PRIVATE = 0, MAP_READWRITE = 1, MAP_RDONLY = 2 } |
| Mapping mode for insertFile. More... | |
| using | Ptr = MemoryMapPtr |
| Reference counting pointer. More... | |
| typedef rose_addr_t | Address |
| typedef uint8_t | Value |
| typedef Sawyer::Container::AddressMap< Address, Value > | Super |
| typedef Sawyer::Container::Buffer< Address, Value > | Buffer |
| typedef Sawyer::Container::AllocatingBuffer< Address, Value > | AllocatingBuffer |
| typedef Sawyer::Container::MappedBuffer< Address, Value > | MappedBuffer |
| typedef Sawyer::Container::NullBuffer< Address, Value > | NullBuffer |
| typedef Sawyer::Container::StaticBuffer< Address, Value > | StaticBuffer |
| typedef Sawyer::Container::SegmentPredicate< Address, Value > | SegmentPredicate |
| typedef Sawyer::Container::AddressMapConstraints< Sawyer::Container::AddressMap< rose_addr_t, uint8_t > > | Constraints |
| typedef Sawyer::Container::AddressMapConstraints< const Sawyer::Container::AddressMap< rose_addr_t, uint8_t > > | ConstConstraints |
 Public Types inherited from Sawyer::Container::AddressMap< rose_addr_t, uint8_t > | |
| typedef rose_addr_t | Address |
| Type for addresses. More... | |
| typedef uint8_t | Value |
| Type of data stored in the address space. More... | |
| typedef AddressSegment< rose_addr_t, uint8_t > | Segment |
| Type of segments stored by this map. More... | |
| typedef Sawyer::Container::Buffer< Address, Value > | Buffer |
| typedef Super::Node | Node |
| Storage node containing interval/segment pair. More... | |
| typedef Super::ValueIterator | SegmentIterator |
| Iterates over segments in the map. More... | |
| typedef Super::ConstValueIterator | ConstSegmentIterator |
| Iterators over segments in the map. More... | |
| typedef Super::ConstIntervalIterator | ConstIntervalIterator |
| Iterates over address intervals in the map. More... | |
| typedef Super::NodeIterator | NodeIterator |
| Iterates over address interval, segment pairs in the map. More... | |
| typedef Super::ConstNodeIterator | ConstNodeIterator |
| Iterates over address interval/segment pairs in the map. More... | |
| Public Types inherited from Sawyer::Container::IntervalMap< Interval< rose_addr_t >, AddressSegment< rose_addr_t, uint8_t >, AddressMapImpl::SegmentMergePolicy< rose_addr_t, uint8_t > > | |
| typedef Interval< rose_addr_t > | Interval |
| Interval type. More... | |
| typedef AddressSegment< rose_addr_t, uint8_t > | Value |
| Value type. More... | |
| typedef Container::Map< Interval, Value, IntervalCompare > | Map |
| Type of the underlying map. More... | |
| typedef Map::Node | Node |
| Storage node. More... | |
| typedef Map::ConstKeyIterator | ConstIntervalIterator |
| Interval iterator. More... | |
| typedef Map::ValueIterator | ValueIterator |
| Value iterator. More... | |
| typedef Map::ConstValueIterator | ConstValueIterator |
| Value iterator. More... | |
| typedef Map::NodeIterator | NodeIterator |
| Node iterator. More... | |
| typedef Map::ConstNodeIterator | ConstNodeIterator |
| Node iterator. More... | |
Public Member Functions | |
| Ptr | shallowCopy () |
| Create a new copy of the memory map. More... | |
| size_t | insertFile (const std::string &fileName, rose_addr_t va, InsertFileMapMode mode=MAP_PRIVATE, std::string segmentName="") |
| Insert file contents into memory map. More... | |
| AddressInterval | insertFile (const std::string &locatorString) |
| Insert file contents into memory map. More... | |
| AddressInterval | insertData (const std::string &locatorString) |
| Insert data into a memory map. More... | |
| void | adjustMap (const std::string &locatorString) |
| Adjusts a memory map according to the locator string. More... | |
| void | insertProcess (pid_t pid, Attach::Boolean attach) |
| Insert the memory of some other process into this memory map. More... | |
| void | insertProcess (const std::string &locatorString) |
| Insert the memory of some other process into this memory map. More... | |
| MemoryMap::Ptr | align (rose_addr_t lowAlignment, rose_addr_t highAlignment) const |
| Create a new map by padding and aligning segments. More... | |
| void | eraseZeros (size_t minsize) |
Erases regions of zero bytes that are executable and readable and at least minsize in size. More... | |
| bool | shrinkUnshare () |
| Shrink buffers and remove sharing. More... | |
| size_t | readQuick (void *buf, rose_addr_t startVa, size_t desired) const |
| Read data into buffer. More... | |
| std::string | readString (rose_addr_t startVa, size_t desired, int(*validChar)(int)=NULL, int(*invalidChar)(int)=NULL, unsigned requiredPerms=READABLE, unsigned prohibitedPerms=0, char terminator='\0') const |
| Reads a NUL-terminated string from the memory map. More... | |
| template<typename U > | |
| Sawyer::Optional< U > | readUnsigned (rose_addr_t startVa) const |
| Read an unsigned value. More... | |
| Sawyer::Optional< uint64_t > | readLongUnsinged (rose_addr_t startVa) const |
| Read a long unsigned value. More... | |
| size_t | writeUnsigned (uint32_t value, rose_addr_t startVa) |
| Write an unsigned value. More... | |
| size_t | writeUnsigned (uint64_t value, rose_addr_t startVa) |
| Write a long unsigned value. More... | |
| Sawyer::Optional< uint8_t > | readByte (rose_addr_t) const |
| Read a byte from memory. More... | |
| SgUnsignedCharList | readVector (rose_addr_t startVa, size_t desired, unsigned requiredPerms=READABLE) const |
| Read quickly into a vector. More... | |
| size_t | writeQuick (const void *buf, rose_addr_t startVa, size_t desired) |
| Write data from buffer. More... | |
| Sawyer::Optional< rose_addr_t > | findSequence (const AddressInterval &interval, const std::vector< uint8_t > &sequence) const |
| Search for a byte sequence. More... | |
| Combinatorics::Hasher & | hash (Combinatorics::Hasher &) const |
| Compute a hash of the entire memory contents. More... | |
| ByteOrder::Endianness | byteOrder () const |
| Property: byte order. More... | |
| void | byteOrder (ByteOrder::Endianness order) |
| Property: byte order. More... | |
| bool | insertProcessPid (pid_t, const AddressInterval &where, unsigned accessibility, const std::string &name) |
| Insert part of another process's memory into this memory map. | |
| void | insertProcessPid (pid_t, const std::vector< ProcessMapRecord > &) |
| Insert part of another process's memory into this memory map. | |
| bool | insertProcessMemory (int memFile, const AddressInterval &where, unsigned accessibility, std::string name) |
| Insert part of another process's memory into this memory map. | |
| AddressIntervalSet | linkTo (const MemoryMap::Ptr &source, const AddressIntervalSet &where, Clobber=Clobber::YES) |
| Insert part of another map by reference. More... | |
| AddressIntervalSet | linkTo (const MemoryMap::Ptr &source, const AddressInterval &where, Clobber=Clobber::YES) |
| Insert part of another map by reference. More... | |
| Sawyer::Optional< rose_addr_t > | findAny (const Extent &limits, const std::vector< uint8_t > &bytesToFind, unsigned requiredPerms=READABLE, unsigned prohibitedPerms=0) const |
| Search for any byte. More... | |
| Sawyer::Optional< rose_addr_t > | findAny (const AddressInterval &limits, const std::vector< uint8_t > &bytesToFind, unsigned requiredPerms=READABLE, unsigned prohibitedPerms=0) const |
| Search for any byte. More... | |
| void | dump (FILE *, const char *prefix="") const |
| Prints the contents of the map for debugging. More... | |
| void | dump (std::ostream &, std::string prefix="") const |
| Prints the contents of the map for debugging. More... | |
| void | print (std::ostream &o, std::string prefix="") const |
| Prints the contents of the map for debugging. More... | |
| void | dump () const |
| Prints the contents of the map for debugging. More... | |
| Public Member Functions inherited from Sawyer::Container::AddressMap< rose_addr_t, uint8_t > | |
| AddressMap () | |
| Constructs an empty address map. More... | |
| AddressMap (const AddressMap &other, bool copyOnWrite=false) | |
| Copy constructor. More... | |
| void | checkConsistency () const |
| Check map consistency. More... | |
| Address | nSegments () const |
| Number of segments contained in the map. More... | |
| Optional< Address > | next (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Minimum or maximum address that satisfies constraints. More... | |
| Sawyer::Container::Interval< Address > | available (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Adress interval that satisfies constraints. More... | |
| bool | exists (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Determines if an address exists with the specified constraints. More... | |
| Sawyer::Container::Interval< Address > | unmapped (Address boundary, MatchFlags flags=0) const |
| Find unmapped interval. More... | |
| Optional< Address > | findFreeSpace (size_t nValues, size_t alignment=1, Sawyer::Container::Interval< Address > restriction=Sawyer::Container::Interval< Address >::whole(), MatchFlags flags=0) const |
| Find free space. More... | |
| void | prune (const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Prune away addresses that match constraints. More... | |
| void | keep (const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Keep only addresses that match constraints. More... | |
| void | changeAccess (unsigned requiredAccess, unsigned prohibitedAccess, const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Change access bits for addresses that match constraints. More... | |
| AddressMapConstraints< const AddressMap > | require (unsigned x) const |
| Constraint: required access bits. More... | |
| AddressMapConstraints< AddressMap > | require (unsigned x) |
| Constraint: required access bits. More... | |
| AddressMapConstraints< const AddressMap > | prohibit (unsigned x) const |
| Constraint: prohibited access bits. More... | |
| AddressMapConstraints< AddressMap > | prohibit (unsigned x) |
| Constraint: prohibited access bits. More... | |
| AddressMapConstraints< const AddressMap > | access (unsigned x) const |
| Constraint: required and prohibited access bits. More... | |
| AddressMapConstraints< AddressMap > | access (unsigned x) |
| Constraint: required and prohibited access bits. More... | |
| AddressMapConstraints< const AddressMap > | substr (const std::string &x) const |
| Constraint: segment name substring. More... | |
| AddressMapConstraints< AddressMap > | substr (const std::string &x) |
| Constraint: segment name substring. More... | |
| AddressMapConstraints< const AddressMap > | at (Address x) const |
| Constraint: anchor point. More... | |
| AddressMapConstraints< AddressMap > | at (Address x) |
| Constraint: anchor point. More... | |
| AddressMapConstraints< const AddressMap > | at (const Sawyer::Container::Interval< Address > &x) const |
| Constraint: anchored interval. More... | |
| AddressMapConstraints< AddressMap > | at (const Sawyer::Container::Interval< Address > &x) |
| Constraint: anchored interval. More... | |
| AddressMapConstraints< const AddressMap > | limit (size_t x) const |
| Constraint: limit matched size. More... | |
| AddressMapConstraints< AddressMap > | limit (size_t x) |
| Constraint: limit matched size. More... | |
| AddressMapConstraints< const AddressMap > | atOrAfter (Address x) const |
| Constraint: address lower bound. More... | |
| AddressMapConstraints< AddressMap > | atOrAfter (Address x) |
| Constraint: address lower bound. More... | |
| AddressMapConstraints< const AddressMap > | atOrBefore (Address x) const |
| Constraint: address upper bound. More... | |
| AddressMapConstraints< AddressMap > | atOrBefore (Address x) |
| Constraint: address upper bound. More... | |
| AddressMapConstraints< const AddressMap > | within (const Sawyer::Container::Interval< Address > &x) const |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< AddressMap > | within (const Sawyer::Container::Interval< Address > &x) |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< const AddressMap > | within (Address x, Address y) const |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< AddressMap > | within (Address x, Address y) |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< const AddressMap > | baseSize (Address base, Address size) const |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< AddressMap > | baseSize (Address base, Address size) |
| Constraint: address lower and upper bounds. More... | |
| AddressMapConstraints< const AddressMap > | after (Address x) const |
| Constraint: address lower bound. More... | |
| AddressMapConstraints< AddressMap > | after (Address x) |
| Constraint: address lower bound. More... | |
| AddressMapConstraints< const AddressMap > | before (Address x) const |
| Constraint: address upper bound. More... | |
| AddressMapConstraints< AddressMap > | before (Address x) |
| Constraint: address upper bound. More... | |
| AddressMapConstraints< const AddressMap > | singleSegment () const |
| Constraint: single segment. More... | |
| AddressMapConstraints< AddressMap > | singleSegment () |
| Constraint: single segment. More... | |
| AddressMapConstraints< const AddressMap > | segmentPredicate (SegmentPredicate< Address, Value > *p) const |
| Constraint: arbitrary segment constraint. More... | |
| AddressMapConstraints< AddressMap > | segmentPredicate (SegmentPredicate< Address, Value > *p) |
| Constraint: arbitrary segment constraint. More... | |
| AddressMapConstraints< const AddressMap > | any () const |
| Constraint: matches anything. More... | |
| AddressMapConstraints< AddressMap > | any () |
| Constraint: matches anything. More... | |
| AddressMapConstraints< const AddressMap > | none () const |
| Constraint: matches nothing. More... | |
| AddressMapConstraints< AddressMap > | none () |
| Constraint: matches nothing. More... | |
| boost::iterator_range< SegmentIterator > | segments () |
| Iterator range for all segments. More... | |
| boost::iterator_range< ConstSegmentIterator > | segments () const |
| Iterator range for all segments. More... | |
| boost::iterator_range< ConstSegmentIterator > | segments (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Segments that overlap with constraints. More... | |
| boost::iterator_range< SegmentIterator > | segments (const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Iterator range for all segments. More... | |
| boost::iterator_range< NodeIterator > | nodes () |
| Iterator range for nodes. More... | |
| boost::iterator_range< ConstNodeIterator > | nodes () const |
| Iterator range for nodes. More... | |
| boost::iterator_range< ConstNodeIterator > | nodes (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Nodes that overlap with constraints. More... | |
| boost::iterator_range< NodeIterator > | nodes (const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Nodes that overlap with constraints. More... | |
| ConstNodeIterator | findNode (const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Find node containing address. More... | |
| NodeIterator | findNode (const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Find node containing address. More... | |
| void | traverse (Functor &functor, const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Invoke a function on each address interval. More... | |
| void | traverse (Functor &functor, const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Invoke a function on each address interval. More... | |
| void | traverse (Visitor &visitor, const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Invoke a function on each address interval. More... | |
| void | traverse (Visitor &visitor, const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Invoke a function on each address interval. More... | |
| Sawyer::Container::Interval< Address > | read (Value *buf, const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Reads data into the supplied buffer. More... | |
| Sawyer::Container::Interval< Address > | read (std::vector< Value > &buf, const AddressMapConstraints< const AddressMap > &c, MatchFlags flags=0) const |
| Reads data into the supplied buffer. More... | |
| Sawyer::Container::Interval< Address > | write (const Value *buf, const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Writes data from the supplied buffer. More... | |
| Sawyer::Container::Interval< Address > | write (const std::vector< Value > &buf, const AddressMapConstraints< AddressMap > &c, MatchFlags flags=0) |
| Writes data from the supplied buffer. More... | |
| Public Member Functions inherited from Sawyer::Container::IntervalMap< Interval< rose_addr_t >, AddressSegment< rose_addr_t, uint8_t >, AddressMapImpl::SegmentMergePolicy< rose_addr_t, uint8_t > > | |
| IntervalMap () | |
| Default constructor. More... | |
| IntervalMap (const IntervalMap< Interval2, T2, Policy2 > &other) | |
| Copy constructor. More... | |
| IntervalMap & | operator= (const IntervalMap< Interval2, T2, Policy2 > &other) |
| Assignment operator. More... | |
| boost::iterator_range< ConstIntervalIterator > | intervals () const |
| Iterators for traversing keys. More... | |
| Interval | firstUnmapped (typename Interval::Value minAddr) const |
| Find the first unmapped region. More... | |
| Interval | lastUnmapped (typename Interval::Value maxAddr) const |
| Find the last unmapped region. More... | |
| bool | exists (const typename Interval::Value &size) const |
| Returns true if element exists. More... | |
| Optional< Value > | getOptional (const typename Interval::Value &scalar) const |
| Lookup and return a value or nothing. More... | |
| const Value & | getOrDefault (const typename Interval::Value &scalar) const |
| Lookup and return a value or a default. More... | |
| bool | isEmpty () const |
| Determine if the container is empty. More... | |
| size_t | nIntervals () const |
| Number of nodes in the container. More... | |
| Interval::Value | size () const |
| Returns the number of values represented by this container. More... | |
| Interval::Value | least () const |
| Returns the minimum scalar key. More... | |
| Optional< typename Interval::Value > | least (typename Interval::Value lowerLimit) const |
| Returns the limited-minimum scalar key. More... | |
| Interval::Value | greatest () const |
| Returns the maximum scalar key. More... | |
| Optional< typename Interval::Value > | greatest (typename Interval::Value upperLimit) const |
| Returns the limited-maximum scalar key. More... | |
| Optional< typename Interval::Value > | leastUnmapped (typename Interval::Value lowerLimit) const |
| Returns the limited-minimum unmapped scalar key. More... | |
| Optional< typename Interval::Value > | greatestUnmapped (typename Interval::Value upperLimit) const |
| Returns the limited-maximum unmapped scalar key. More... | |
| Interval | hull () const |
| Returns the range of values in this map. More... | |
| void | clear () |
| Empties the container. More... | |
| void | erase (const Interval &erasure) |
| Erase the specified interval. More... | |
| void | eraseMultiple (const IntervalMap< Interval, T2, Policy2 > &other) |
| Erase intervals specified in another IntervalMap. More... | |
| void | insert (Interval key, Value value, bool makeHole=true) |
| Insert a key/value pair. More... | |
| void | insertMultiple (const IntervalMap< Interval, T2, Policy2 > &other, bool makeHole=true) |
| Insert values from another container. More... | |
| bool | overlaps (const Interval &interval) const |
| bool | overlaps (const IntervalMap< Interval, T2, Policy2 > &other) const |
| bool | isOverlapping (const Interval &interval) const |
| bool | isOverlapping (const IntervalMap< Interval, T2, Policy2 > &other) const |
| bool | isDistinct (const Interval &interval) const |
| bool | isDistinct (const IntervalMap< Interval, T2, Policy2 > &other) const |
| bool | contains (Interval key) const |
| bool | contains (const IntervalMap< Interval, T2, Policy2 > &other) const |
| boost::iterator_range< NodeIterator > | nodes () |
| Iterators for traversing nodes. More... | |
| boost::iterator_range< ConstNodeIterator > | nodes () const |
| Iterators for traversing nodes. More... | |
| boost::iterator_range< ValueIterator > | values () |
| Iterators for traversing values. More... | |
| boost::iterator_range< ConstValueIterator > | values () const |
| Iterators for traversing values. More... | |
| NodeIterator | lowerBound (const typename Interval::Value &scalar) |
| Find the first node whose interval ends at or above the specified scalar key. More... | |
| ConstNodeIterator | lowerBound (const typename Interval::Value &scalar) const |
| Find the first node whose interval ends at or above the specified scalar key. More... | |
| NodeIterator | upperBound (const typename Interval::Value &scalar) |
| Find the first node whose interval begins above the specified scalar key. More... | |
| ConstNodeIterator | upperBound (const typename Interval::Value &scalar) const |
| Find the first node whose interval begins above the specified scalar key. More... | |
| const Value & | operator[] (const typename Interval::Value &scalar) const |
| Returns a reference to an existing value. More... | |
| const Value & | get (const typename Interval::Value &scalar) const |
| Returns a reference to an existing value. More... | |
| Value & | getOrElse (const typename Interval::Value &scalar, Value &dflt) |
| Lookup and return a value or something else. More... | |
| const Value & | getOrElse (const typename Interval::Value &scalar, const Value &dflt) const |
| Lookup and return a value or something else. More... | |
| NodeIterator | findPrior (const typename Interval::Value &scalar) |
| Find the last node whose interval starts at or below the specified scalar key. More... | |
| ConstNodeIterator | findPrior (const typename Interval::Value &scalar) const |
| Find the last node whose interval starts at or below the specified scalar key. More... | |
| NodeIterator | find (const typename Interval::Value &scalar) |
| Find the node containing the specified scalar key. More... | |
| ConstNodeIterator | find (const typename Interval::Value &scalar) const |
| Find the node containing the specified scalar key. More... | |
| boost::iterator_range< NodeIterator > | findAll (const Interval &interval) |
| Finds all nodes overlapping the specified interval. More... | |
| boost::iterator_range< ConstNodeIterator > | findAll (const Interval &interval) const |
| Finds all nodes overlapping the specified interval. More... | |
| NodeIterator | findFirstOverlap (const Interval &interval) |
| Find first interval that overlaps with the specified interval. More... | |
| ConstNodeIterator | findFirstOverlap (const Interval &interval) const |
| Find first interval that overlaps with the specified interval. More... | |
| std::pair< NodeIterator, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator > | findFirstOverlap (typename IntervalMap::NodeIterator thisIter, const IntervalMap< Interval, T2, Policy2 > &other, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator otherIter) |
| Find first interval that overlaps with any in another container. More... | |
| std::pair< ConstNodeIterator, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator > | findFirstOverlap (typename IntervalMap::ConstNodeIterator thisIter, const IntervalMap< Interval, T2, Policy2 > &other, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator otherIter) const |
| Find first interval that overlaps with any in another container. More... | |
| NodeIterator | firstFit (const typename Interval::Value &size, NodeIterator start) |
| Find the first fit node at or after a starting point. More... | |
| ConstNodeIterator | firstFit (const typename Interval::Value &size, ConstNodeIterator start) const |
| Find the first fit node at or after a starting point. More... | |
| NodeIterator | bestFit (const typename Interval::Value &size, NodeIterator start) |
| Find the best fit node at or after a starting point. More... | |
| ConstNodeIterator | bestFit (const typename Interval::Value &size, ConstNodeIterator start) const |
| Find the best fit node at or after a starting point. More... | |
| Public Member Functions inherited from Sawyer::SharedObject | |
| SharedObject () | |
| Default constructor. More... | |
| SharedObject (const SharedObject &) | |
| Copy constructor. More... | |
| virtual | ~SharedObject () |
| Virtual destructor. More... | |
| SharedObject & | operator= (const SharedObject &) |
| Assignment. More... | |
Static Public Member Functions | |
| static Ptr | instance () |
| Construct an empty memory map. More... | |
| static std::string | insertFileDocumentation () |
| Documentation string for insertFile. More... | |
| static std::string | insertDataDocumentation () |
| Documentation string for insertData. More... | |
| static std::string | adjustMapDocumentation () |
| Documentation string for adjustMap. More... | |
| static std::vector< ProcessMapRecord > | readProcessMap (pid_t) |
| Obtain the memory map information for a process. More... | |
| static std::string | insertProcessDocumentation () |
| Documentation string for insertProcess. More... | |
| static std::pair< Buffer::Ptr, std::string > | copyFromFile (int fd, const AddressInterval &) |
| Copy part of a file into a buffer. More... | |
| static std::string | segmentTitle (const Segment &) |
| Title of a segment when printing the map. More... | |
| Static Public Member Functions inherited from Sawyer::Container::IntervalMap< Interval< rose_addr_t >, AddressSegment< rose_addr_t, uint8_t >, AddressMapImpl::SegmentMergePolicy< rose_addr_t, uint8_t > > | |
| static IntervalMapTraits< IMap >::NodeIterator | findPriorImpl (IMap &imap, const typename Interval::Value &scalar) |
| Find the last node whose interval starts at or below the specified scalar key. More... | |
| static IntervalMapTraits< IMap >::NodeIterator | findImpl (IMap &imap, const typename Interval::Value &scalar) |
| Find the node containing the specified scalar key. More... | |
| static boost::iterator_range< typename IntervalMapTraits< IMap >::NodeIterator > | findAllImpl (IMap &imap, const Interval &interval) |
| Finds all nodes overlapping the specified interval. More... | |
| static IntervalMapTraits< IMap >::NodeIterator | findFirstOverlapImpl (IMap &imap, const Interval &interval) |
| Find first interval that overlaps with the specified interval. More... | |
| static std::pair< typename IntervalMapTraits< IMap >::NodeIterator, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator > | findFirstOverlapImpl (IMap &imap, typename IntervalMapTraits< IMap >::NodeIterator thisIter, const IntervalMap< Interval, T2, Policy2 > &other, typename IntervalMap< Interval, T2, Policy2 >::ConstNodeIterator otherIter) |
| Find first interval that overlaps with any in another container. More... | |
| static IntervalMapTraits< IMap >::NodeIterator | firstFitImpl (IMap &imap, const typename Interval::Value &size, typename IntervalMapTraits< IMap >::NodeIterator start) |
| Find the first fit node at or after a starting point. More... | |
| static IntervalMapTraits< IMap >::NodeIterator | bestFitImpl (IMap &imap, const typename Interval::Value &size, typename IntervalMapTraits< IMap >::NodeIterator start) |
| Find the best fit node at or after a starting point. More... | |
Protected Member Functions | |
| MemoryMap () | |
| Constructs an empty memory map. More... | |
Friends | |
| std::ostream & | operator<< (std::ostream &, const MemoryMap &) |
Member Typedef Documentation
Reference counting pointer.
Definition at line 115 of file MemoryMap.h.
Member Enumeration Documentation
Mapping mode for insertFile.
Definition at line 290 of file MemoryMap.h.
Constructor & Destructor Documentation
|
inlineprotected |
Constructs an empty memory map.
Definition at line 259 of file MemoryMap.h.
Referenced by shallowCopy().
Member Function Documentation
|
inlinestatic |
Construct an empty memory map.
Definition at line 263 of file MemoryMap.h.
|
inline |
Create a new copy of the memory map.
The copy maintains its own independent list of segments, but points to the same data buffers as the source map.
Definition at line 270 of file MemoryMap.h.
References MemoryMap().
|
inline |
Property: byte order.
Every map has a default byte order property which can be used by functions that read and write multi-byte values when the user does not provide a byte order to those functions. The MemoryMap constructors initialize this property to ByteOrder::ORDER_UNSPECIFIED.
Definition at line 281 of file MemoryMap.h.
|
inline |
Property: byte order.
Every map has a default byte order property which can be used by functions that read and write multi-byte values when the user does not provide a byte order to those functions. The MemoryMap constructors initialize this property to ByteOrder::ORDER_UNSPECIFIED.
Definition at line 282 of file MemoryMap.h.
| size_t Rose::BinaryAnalysis::MemoryMap::insertFile | ( | const std::string & | fileName, |
| rose_addr_t | va, | ||
| InsertFileMapMode | mode = MAP_PRIVATE, |
||
| std::string | segmentName = "" |
||
| ) |
Insert file contents into memory map.
Insert the contents of a file into the memory map at the specified address. This is just a convenience wrapper that creates a new MappedBuffer and inserts it into the mapping. Returns the size of the file mapping.
| AddressInterval Rose::BinaryAnalysis::MemoryMap::insertFile | ( | const std::string & | locatorString | ) |
Insert file contents into memory map.
Uses a locator string to load a file into a memory map.
Returns the address interval that was inserted into this memory map, or throws an std::runtime_error for syntax errors and problems reading the file.
Locator Syntax
The locator string is a file name preceded by various other parameters to control where the file is loaded in memory. It takes the form:
* :[ADDR][+VMSIZE][=PERM]:[OFFSET[+FSIZE]]:FILENAME *
The fields between the first and second colon are parameters for virtual memory; the fields between the second and third colon are parameters for the file. Their meanings are:
ADDR:The virtual address where the first byte of the file is mapped. This can be specified in decimal, octal, or hexadecimal using the usual C syntax. If no address is specified then the file is mapped at the lowest unmapped region which is large enough to hold the file.
VMSIZE:Size of virtual memory to map. If VMSIZE is not specified then it is either the FSIZE (if specified) or the file size. On POSIX systems the file size is that which is reported bystat, and on other systems it is the number of bytes that can be read from the file. The size can be specified as decimal, octal, or hexadecimal with the usual C syntax. If VMSIZE is greater than the specified or calculated FSIZE then the data from the file is padded with zero bytes.
PERM:Accessibility for the mapped segment. If present, it should be any of the letters "r", "w", and/or "x" in that order to indicate readable, writable, and/or executable. If not present, the accessibility of the segment is the same as the user's accessibility of the file (on POSIX systems; "rwx" on Windows systems).
OFFSET:Byte offset within file for first byte to map. If no offset is specified then zero is assumed. The size can be decimal, octal, or hexadecimal in the usual C sytax.
FSIZE:Number of file bytes to map. If not specified the entire readable content of the file is mapped beginning at the specified OFFSET but not exceeding a specified VMSIZE. If this number of bytes cannot be read from the file then an error is thrown.
FILENAME:Name of file to read. The file must be readable by the user and its contents are copied into the memory map. Once inside the memory map, the segment can be given any accessibility according to PERM. The name of the segment will be the non-directory part of the FILENAME (e.g., on POSIX systems, the part after the final slash).
Examples
To load a couple raw files at the lowest available addresses:
To load a 4k page of zeros with read and execute permission at address 0x7ffff000 (won't work on Microsoft systems):
To load the .text and .data segments from a PE file when we know where they occur in the PE file but the PE file is damaged to the point where it cannot be loaded by ROSE's frontend. Both sections are zero-padded since the memory segment size is larger than the file size. But if one wants to more closely emulate the Windows loader, leave off the file sizes:
- See also
- insertFileDocumentation
|
static |
Documentation string for insertFile.
| AddressInterval Rose::BinaryAnalysis::MemoryMap::insertData | ( | const std::string & | locatorString | ) |
Insert data into a memory map.
This is intended for insert small pieces of data parsed from the locator string. The locator string has the form:
* :[ADDR][+VMSIZE][=PERM]::DATA *
The fields between the first and second colon are parameters for virtual memory; the fields between the second and third colon are parameters for the data (none currently defined). Their meanings are:
ADDR:The virtual address where the first byte of data is mapped. This can be specified in decimal, octal, or hexadecimal using the usual C syntax. If no address is specified then the data is mapped at the lowest unmapped region which is large enough to hold it.
VMSIZE:Size in bytes of the virtual memory to map. If VMSIZE is not specified then it is the same as the number of bytes of DATA. If VMSIZE is smaller than DATA then the DATA will be truncated; if VMSIZE is larger than DATA then DATA is zero-padded. If the resulting memory are size is zero then no change is made to the memory map.
PERM:Accessibility for the mapped segment. If present, it should be any of the letters "r", "w", and/or "x" in that order to indicate readable, writable, and/or executable. If not present, then the new memory is readable, writable, and executable.
DATA:The byte values in ascending address order. The values should be separated from one another by white space and all values must be in the range 0 through 255, inclusive. Values can be specified in hexadecimal (leading "0x"), binary (leading "0b"), octal (leading "0"), or decimal.
|
static |
Documentation string for insertData.
| void Rose::BinaryAnalysis::MemoryMap::adjustMap | ( | const std::string & | locatorString | ) |
Adjusts a memory map according to the locator string.
See –help output from tools that support this feature, or look at the implementation of adjustMapDocumentation for details about the syntax of the locatorString.
|
static |
Documentation string for adjustMap.
|
static |
Obtain the memory map information for a process.
Returns an empty vector if there was an error parsing the process information.
| void Rose::BinaryAnalysis::MemoryMap::insertProcess | ( | pid_t | pid, |
| Attach::Boolean | attach | ||
| ) |
Insert the memory of some other process into this memory map.
| void Rose::BinaryAnalysis::MemoryMap::insertProcess | ( | const std::string & | locatorString | ) |
Insert the memory of some other process into this memory map.
The locator string follows the syntax described in insertProcessDocumentation.
|
static |
Documentation string for insertProcess.
| AddressIntervalSet Rose::BinaryAnalysis::MemoryMap::linkTo | ( | const MemoryMap::Ptr & | source, |
| const AddressIntervalSet & | where, | ||
| Clobber | = Clobber::YES |
||
| ) |
Insert part of another map by reference.
The segments of the source map that overlap with the addresses specified by where are copied and inserted into this map. The new copied segments point to the same data buffers as source, therefore the segments in the new map will share the same data as the old map and changing the data in either map will change the data in the other map as well.
If the Clobber flag is set, then any segment that previously existed in the this map will be overwritten by segments copied from the source map. Otherwise, when Clobber is clear, only those parts of the source map that are not already mapped in this map are copied.
The return value is the set of addresses that were actually copied from the source to this map.
| AddressIntervalSet Rose::BinaryAnalysis::MemoryMap::linkTo | ( | const MemoryMap::Ptr & | source, |
| const AddressInterval & | where, | ||
| Clobber | = Clobber::YES |
||
| ) |
Insert part of another map by reference.
The segments of the source map that overlap with the addresses specified by where are copied and inserted into this map. The new copied segments point to the same data buffers as source, therefore the segments in the new map will share the same data as the old map and changing the data in either map will change the data in the other map as well.
If the Clobber flag is set, then any segment that previously existed in the this map will be overwritten by segments copied from the source map. Otherwise, when Clobber is clear, only those parts of the source map that are not already mapped in this map are copied.
The return value is the set of addresses that were actually copied from the source to this map.
| MemoryMap::Ptr Rose::BinaryAnalysis::MemoryMap::align | ( | rose_addr_t | lowAlignment, |
| rose_addr_t | highAlignment | ||
| ) | const |
Create a new map by padding and aligning segments.
A new map is created by padding the segments of this map so they're aligned in the returned map. Data is copied (not linked) from this map to the new map. After alignment and padding, it's possible that more than one segment from the source maps to a single segment in the destination. When this happens, the destination segment's name comes from the first corresponding source segment, and the destination access permissions are the union of all the corresponding source segment access permissions.
A low or high aligment of zero is treated as an alignment of one; that is, the endpoint is not aligned. Higher values will cause segment beginning address to be aligned downward, and segment one-past-end addresses to be aligned upward.
|
static |
Copy part of a file into a buffer.
This copies (rather than directly references) part of a file and returns a pointer to a new buffer containing the data. If an error occurs when reading the file, then a buffer is still returned but its length will only be what was actually read, and a string is also returned containing the error message.
| void Rose::BinaryAnalysis::MemoryMap::eraseZeros | ( | size_t | minsize | ) |
Erases regions of zero bytes that are executable and readable and at least minsize in size.
| bool Rose::BinaryAnalysis::MemoryMap::shrinkUnshare | ( | ) |
Shrink buffers and remove sharing.
Creates a new buffer per segment and copies the data for that segment into the new buffer. The new buffers are allocated to be just large enough to hold the data for the segment's interval. Segments that shared the same underlying data no longer share data.
Returns true if new buffers could be allocated for all segments, and false otherwise. A false return value could occur if a buffer does not support the Sawyer::Container::Buffer::data. As of this writing (Nov 2016) the only buffer type that doesn't support data is NullBuffer, which doesn't appear in memory maps created by ROSE's binary specimen mappers.
|
inline |
Read data into buffer.
Definition at line 520 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at().
| std::string Rose::BinaryAnalysis::MemoryMap::readString | ( | rose_addr_t | startVa, |
| size_t | desired, | ||
| int(*)(int) | validChar = NULL, |
||
| int(*)(int) | invalidChar = NULL, |
||
| unsigned | requiredPerms = READABLE, |
||
| unsigned | prohibitedPerms = 0, |
||
| char | terminator = '\0' |
||
| ) | const |
Reads a NUL-terminated string from the memory map.
Reads data beginning at startVa in the memory map and continuing until one of the following conditions is met:
- The desired number of characters has been read (returns empty string)
- The next character is the termination character (defaults to NUL)
- An
invalidCharfunction is specified and the next character causes it to return true (returns empty string) - A validChar function is specified and the next character causes it to return false (returns empty string)
The empty string is returned unless the terminator character is encountered.
The validChar and invalidChar take an integer argument and return an integer value so that the C character classification functions from <ctype.h> can be used directly.
|
inline |
Read an unsigned value.
Reads an unsigned value from memory and converts it from the memory byte order to the host byte order. If the entire value is not mapped in memory then return nothing (not even any part of the multi-byte value that might have been present.
Definition at line 545 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at(), Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::limit(), Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::read(), and Sawyer::Container::IntervalMap< Interval< rose_addr_t >, AddressSegment< rose_addr_t, uint8_t >, AddressMapImpl::SegmentMergePolicy< rose_addr_t, uint8_t > >::size().
|
inline |
Read a long unsigned value.
Reads a long unsigned value from memory and converts it from the memory byte order to the host byte order. If the entire value is not mapped in memory then return nothing (not even any part of the multi-byte value that might have been present.
Definition at line 558 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at(), Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::limit(), Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::read(), and Sawyer::Container::IntervalMap< Interval< rose_addr_t >, AddressSegment< rose_addr_t, uint8_t >, AddressMapImpl::SegmentMergePolicy< rose_addr_t, uint8_t > >::size().
|
inline |
Write an unsigned value.
Takes a unsigned value converts it from the memory byte order to the host byte order then writes to memory. This does not verify the memory is writable. Returns the number of bytes written.
Definition at line 570 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at().
|
inline |
Write a long unsigned value.
Takes a long unsigned value converts it from the memory byte order to the host byte order then writes to memory. This does not verify the memory is writable. Returns the number of bytes written.
Definition at line 578 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at().
| Sawyer::Optional<uint8_t> Rose::BinaryAnalysis::MemoryMap::readByte | ( | rose_addr_t | ) | const |
Read a byte from memory.
Reads a byte at the specified address and returns it. Returns nothing if the address is not mapped.
| SgUnsignedCharList Rose::BinaryAnalysis::MemoryMap::readVector | ( | rose_addr_t | startVa, |
| size_t | desired, | ||
| unsigned | requiredPerms = READABLE |
||
| ) | const |
Read quickly into a vector.
|
inline |
Write data from buffer.
Definition at line 591 of file MemoryMap.h.
References Sawyer::Container::AddressMap< rose_addr_t, uint8_t >::at().
| Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::MemoryMap::findAny | ( | const Extent & | limits, |
| const std::vector< uint8_t > & | bytesToFind, | ||
| unsigned | requiredPerms = READABLE, |
||
| unsigned | prohibitedPerms = 0 |
||
| ) | const |
Search for any byte.
Searches for all of the specified bytes simultaneously and returns the lowest address (subject to limits) where one of the specified values appears. If none of the specified bytes appear within the given address extent, then this method returns none.
| Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::MemoryMap::findAny | ( | const AddressInterval & | limits, |
| const std::vector< uint8_t > & | bytesToFind, | ||
| unsigned | requiredPerms = READABLE, |
||
| unsigned | prohibitedPerms = 0 |
||
| ) | const |
Search for any byte.
Searches for all of the specified bytes simultaneously and returns the lowest address (subject to limits) where one of the specified values appears. If none of the specified bytes appear within the given address extent, then this method returns none.
| Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::MemoryMap::findSequence | ( | const AddressInterval & | interval, |
| const std::vector< uint8_t > & | sequence | ||
| ) | const |
Search for a byte sequence.
Searches for the bytes specified by sequence occuring within the specified interval. If the interval is empty or the sequence cannot be found then nothing is returned. Otherwise, the virtual address for the start of the sequence is returned. An empty sequence matches at the beginning of the interval.
| void Rose::BinaryAnalysis::MemoryMap::dump | ( | FILE * | , |
| const char * | prefix = "" |
||
| ) | const |
Prints the contents of the map for debugging.
The prefix string is added to the beginning of every line of output and typically is used to indent the output.
| void Rose::BinaryAnalysis::MemoryMap::dump | ( | std::ostream & | , |
| std::string | prefix = "" |
||
| ) | const |
Prints the contents of the map for debugging.
The prefix string is added to the beginning of every line of output and typically is used to indent the output.
|
inline |
Prints the contents of the map for debugging.
The prefix string is added to the beginning of every line of output and typically is used to indent the output.
Definition at line 620 of file MemoryMap.h.
References dump().
| void Rose::BinaryAnalysis::MemoryMap::dump | ( | ) | const |
Prints the contents of the map for debugging.
The prefix string is added to the beginning of every line of output and typically is used to indent the output.
Referenced by print().
| Combinatorics::Hasher& Rose::BinaryAnalysis::MemoryMap::hash | ( | Combinatorics::Hasher & | ) | const |
Compute a hash of the entire memory contents.
This hashes the memory contents. Segment information (names, addresses, permissions, etc) are not included in the hash; only the bytes stored in the map. The user should supply a hasher whose append method will be called to add memory map contents to the hash. For instance, here's one way to hash the contents of a file without having to read the entire file into memory first:
|
static |
Title of a segment when printing the map.
The documentation for this class was generated from the following file:
