![]() |
miasm
Reverse engineering framework
|


Public Member Functions | |
| def | __init__ (self, minidump_str) |
| def | parse_content (self) |
| def | build_memory (self) |
| def | get (self, virt_start, virt_stop) |
Public Attributes | |
| modulelist | |
| memory64list | |
| memorylist | |
| memoryinfolist | |
| systeminfo | |
| streams | |
| threads | |
| memory | |
| minidumpHDR | |
Stand for a Minidump file Here is a few limitation: - only < 4GB Minidump are supported (LocationDescriptor handling) - only Stream relative to memory mapping are implemented Official description is available on MSDN: https://msdn.microsoft.com/en-us/library/ms680378(VS.85).aspx
| def miasm.loader.minidump_init.Minidump.__init__ | ( | self, | |
| minidump_str | |||
| ) |
| def miasm.loader.minidump_init.Minidump.build_memory | ( | self | ) |
Build an easier to use memory view based on ModuleList and Memory64List streams
| def miasm.loader.minidump_init.Minidump.get | ( | self, | |
| virt_start, | |||
| virt_stop | |||
| ) |
Return the content at the (virtual addresses) [virt_start:virt_stop]

| def miasm.loader.minidump_init.Minidump.parse_content | ( | self | ) |
Build structures corresponding to current content
| miasm.loader.minidump_init.Minidump.memory |
| miasm.loader.minidump_init.Minidump.memory64list |
| miasm.loader.minidump_init.Minidump.memoryinfolist |
| miasm.loader.minidump_init.Minidump.memorylist |
| miasm.loader.minidump_init.Minidump.minidumpHDR |
| miasm.loader.minidump_init.Minidump.modulelist |
| miasm.loader.minidump_init.Minidump.streams |
| miasm.loader.minidump_init.Minidump.systeminfo |
| miasm.loader.minidump_init.Minidump.threads |