{"action":"created","issue":{"url":"https://api.github.com/repos/radare/radare2-extras/issues/72","repository_url":"https://api.github.com/repos/radare/radare2-extras","labels_url":"https://api.github.com/repos/radare/radare2-extras/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2-extras/issues/72/comments","events_url":"https://api.github.com/repos/radare/radare2-extras/issues/72/events","html_url":"https://github.com/radare/radare2-extras/pull/72","id":185050668,"number":72,"title":"Rework of the mdmp plugin","user":{"login":"AlexKornitzer","id":2750747,"avatar_url":"https://avatars.githubusercontent.com/u/2750747?v=3","gravatar_id":"","url":"https://api.github.com/users/AlexKornitzer","html_url":"https://github.com/AlexKornitzer","followers_url":"https://api.github.com/users/AlexKornitzer/followers","following_url":"https://api.github.com/users/AlexKornitzer/following{/other_user}","gists_url":"https://api.github.com/users/AlexKornitzer/gists{/gist_id}","starred_url":"https://api.github.com/users/AlexKornitzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlexKornitzer/subscriptions","organizations_url":"https://api.github.com/users/AlexKornitzer/orgs","repos_url":"https://api.github.com/users/AlexKornitzer/repos","events_url":"https://api.github.com/users/AlexKornitzer/events{/privacy}","received_events_url":"https://api.github.com/users/AlexKornitzer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-25T08:28:24Z","updated_at":"2016-10-26T09:08:58Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/radare/radare2-extras/pulls/72","html_url":"https://github.com/radare/radare2-extras/pull/72","diff_url":"https://github.com/radare/radare2-extras/pull/72.diff","patch_url":"https://github.com/radare/radare2-extras/pull/72.patch"},"body":"The previous implementation of the MDMP plugin was missing certain functionality required for useful analysis within radare2. So I spent the weekend reworking/reimplementing the plugin.\r\n\r\nMajor changes:\r\n\r\n- Refactored the code to remove unnecessary type definitions and converted to snake_case to match the rest of the project.\r\n- Updated the Sections section to map the physical address to the correct location in the MDMP file if present (i.e. full dumps). If not present the paddr is set to 0.\r\n\r\n```\r\nidx=00 vaddr=0xff7b0000 paddr=0x018825a8 sz=929792 vsz=929792 perm=----- name=C:_Windows_System32_calc.exe\r\nidx=01 vaddr=0x77720000 paddr=0x016d25a8 sz=1744896 vsz=1744896 perm=----- name=C:_Windows_System32_ntdll.dll\r\nidx=02 vaddr=0x77500000 paddr=0x014b95a8 sz=1175552 vsz=1175552 perm=----- name=C:_Windows_System32_kernel32.dll\r\n[snip]\r\nidx=25 vaddr=0x7fefd2b0000 paddr=0x01fd95a8 sz=61440 vsz=61440 perm=----- name=C:_Windows_System32_CRYPTBASE.dll\r\nidx=26 vaddr=0x7fefddb0000 paddr=0x022b25a8 sz=626688 vsz=626688 perm=----- name=C:_Windows_System32_clbcatq.dll\r\nidx=27 vaddr=0x7fef62b0000 paddr=0x019655a8 sz=344064 vsz=344064 perm=----- name=C:_Windows_System32_oleacc.dll\r\n```\r\n\r\n- Made use of the Memory section to store all memory mappings found within the MDMP file. Again used the paddr to display the location of the memory within the file.\r\n\r\n```\r\n0x00110000 +0x1000 ---- paddr=0x000b55a8 RAM\r\n0x00120000 +0xa000 ---- paddr=0x000b65a8 RAM\r\n0x00130000 +0x2000 ---- paddr=0x000c05a8 RAM\r\n0x00140000 +0xa000 ---- paddr=0x000c25a8 RAM\r\n0x00150000 +0xa000 ---- paddr=0x000cc5a8 RAM\r\n0x00160000 +0x10000 ---- paddr=0x000d65a8 RAM\r\n...\r\n```\r\n\r\nIssues:\r\n- Searching or analysing the memory within the MDMP file is not possible without setting `io.va=false`.\r\n- The `r_str_utf16_to_utf8()` function seems to remove `\\` characters?\r\n\r\nTODO:\r\n- Full Parsing - Currently parsing is only performed to depth one if the data is not going to be presented in radare2.\r\n- Find a way to present the debugging information to the radare2 debugger.\r\n- Add non-standard streams.\r\n- Test on more dumps than just basic/full of calc.exe\r\n\r\nFinal Notes: Hopefully I have not done anything too catastrophic to this plugin, and that people will find the changes useful. If any bugs are encountered from the implementation send them my way."},"comment":{"url":"https://api.github.com/repos/radare/radare2-extras/issues/comments/256291216","html_url":"https://github.com/radare/radare2-extras/pull/72#issuecomment-256291216","issue_url":"https://api.github.com/repos/radare/radare2-extras/issues/72","id":256291216,"user":{"login":"radare","id":917142,"avatar_url":"https://avatars.githubusercontent.com/u/917142?v=3","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"created_at":"2016-10-26T09:08:58Z","updated_at":"2016-10-26T09:08:58Z","body":"Looks good. i'll merge that, but it will be good to have some tests because im not really an MDMP user so i cant say how much better or worst those changes are :D"}}
{"actor":{"display_login":"radare"}}