node/lib/metasm/metasm/disassemble_api.rb
# scans all the sections raw for a given regexp
# return/yields all the addresses matching
# if yield returns nil/false, do not include the addr in the final result
# sections are scanned MB by MB, so this should work (slowly) on 4GB sections (eg debugger VM)
# with addr_start/length, symbol-based section are skipped
scans all the sections raw for a given regexp
return/yields all the addresses matching
if yield returns nil/false, do not include the addr in the final result
sections are scanned MB by MB, so this should work (slowly) on 4GB sections
with addr_start/length, symbol-based section are skipped
scans all the sections raw for a given regexp return / yields all the addresses matching if yield returns nil / false do not include the addr in the final result sections are scanned MB by MB so this should work ( slowly ) on 4GB sections with addr_start / length symbol - based section are skipped
def pattern_scan(pat, addr_start=nil, length=nil, chunksz=nil, margin=nil, &b)
		chunksz ||= 4*1024*1024	
		margin ||= 65536	
		pat = Regexp.new(Regexp.escape(pat)) if pat.kind_of? ::String
		found = []
		@sections.each { |sec_addr, e|
			if addr_start
				length ||= 0x1000_0000
				begin
					if sec_addr < addr_start
						next if sec_addr+e.length <= addr_start
						e = e[addr_start-sec_addr, e.length]
						sec_addr = addr_start
					end
					if sec_addr+e.length > addr_start+length
						next if sec_addr > addr_start+length
						e = e[0, sec_addr+e.length-(addr_start+length)]
					end
				rescue
					puts $!, $!.message, $!.backtrace if $DEBUG
					next
				end
			end
			e.pattern_scan(pat, chunksz, margin) { |eo|
				match_addr = sec_addr + eo
				found << match_addr if not b or b.call(match_addr)
				false
			}
		}
		found
	end
def pattern_scan ( pat , addr_start = nil , length = nil , chunksz = nil , margin = nil , & b ) chunksz ||= 4 * 1024 * 1024 margin ||= 65536 pat = Regexp . new ( Regexp . escape ( pat ) ) if pat . kind_of? :: String found = [ ] @sections . each { | sec_addr , e | if addr_start length ||= 0x1000_0000 begin if sec_addr < addr_start next if sec_addr + e . length <= addr_start e = e [ addr_start - sec_addr , e . length ] sec_addr = addr_start end if sec_addr + e . length > addr_start + length next if sec_addr > addr_start + length e = e [ 0 , sec_addr + e . length - ( addr_start + length ) ] end rescue puts $! , $! . message , $! . backtrace if $DEBUG next end end e . pattern_scan ( pat , chunksz , margin ) { | eo | match_addr = sec_addr + eo found << match_addr if not b or b . call ( match_addr ) false } } found end
scans all the sections raw for a given regexp
return/yields all the addresses matching
if yield returns nil/false, do not include the addr in the final result
sections are scanned MB by MB, so this should work (slowly) on 4GB sections (eg debugger VM)
with addr_start/length, symbol-based section are skipped
scans all the sections raw for a given regexp return / yields all the addresses matching if yield returns nil / false do not include the addr in the final result sections are scanned MB by MB so this should work ( slowly ) on 4GB sections ( eg debugger VM ) with addr_start / length symbol - based section are skipped
# scan 4MB at a time # add this much bytes at each chunk to find /pat/ over chunk boundaries # catch arithmetic error with symbol-based section
pat
addr_start
length
chunksz
margin
b