-
Notifications
You must be signed in to change notification settings - Fork 30
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add procmem slicing and refactor to make proper MemoryBuffer interface #122
base: master
Are you sure you want to change the base?
Conversation
c7fadb2
to
a32b73d
Compare
This requires a bit different approach. Main issue is that memoryview holds a pointer to the underlying buffer and need to be explicitly released before releasing the main buffer
In many modules and components we don't keep track on all derived procmems and we rely on GC there. When we release memory allocated by |
…eferences to memoryview on every from_memory call
ebf71a2
to
b85efbb
Compare
…here is desire to release main MmapMemoryBuffer
Added reference tracking of mmap slices in ab61f36 and c684022 When |
After looking at #119 I found that
bb4c7d48773b21c62885d0206c9414176c254e6104b4a0ffe730aa570b424948
is not actuallyb = open("x.exe").read(); b = b * 100
, but set of different binaries/The main problem was that
procmempe.from_memory(p, base=0x100)
doesn't makem
that starts from 0x100. It just makes reference to the same memory and setsimgbase
to 0x100. It means that first binarybb4c7d48773b21c62885d0206c9414176c254e6104b4a0ffe730aa570b424948
was ripped n times, so carving was not really working as intended 😅In this PR I moved the "memory management" part to the separate set of classes
MemoryBuffer
and implemented proper slicing.ProcessMemory has implemented one extra method
slicev
that allows to get a slice of memory view over MemoryBuffer. The only limitation is that slice must be within single region.Along with #121 reducing memory footprint, it should work a bit more correctly.