Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature MemStruct #284

merged 44 commits into from Jan 18, 2016

Feature MemStruct #284

merged 44 commits into from Jan 18, 2016


Copy link

This PR introduces an API to easily interact with C structures in miasm's sandbox.

The example/jitter/ example file may be the best introduction to this feature. As a spoiler, here is how a linked list can be represented with this API (extracted from the aforementioned file):

class ListNode(MemStruct):
    fields = [
        # The "<I" is the struct-like format of the pointer in memory, in this
        # case a Little Endian 32 bits unsigned int
        # One way to handle reference to ListNode in ListNode is to use the
        # special marker MemSelf.
        # You could also set or modify ListNode.fields after the class
        # declaration and call ListNode.gen_fields()
        ("next", Ptr("<I", MemSelf)),
        # Ptr(_, MemVoid) is analogous to void*, MemVoid is just an empty
        # MemStruct type
        ("data", Ptr("<I", MemVoid)),

class LinkedList(MemStruct):
    fields = [
        ("head", Ptr("<I", ListNode)),
        ("tail", Ptr("<I", ListNode)),
        # Num can take any one-field struct-like format, including floats and
        # doubles
        ("size", Num("<I")),

# [...]

link = LinkedList(jitter.vm, some_addr) = other_addr
link.size += 1
# etc

Lots of FIXME/TODO are left there for now and lots of choices can be discussed, please tell me what you think!

-- Florent

@@ -0,0 +1,229 @@
#!/usr/bin/env python
"""This script is just a short example of common usages for miasm2.analysis.mem.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems that memstruct are more related to miasm2.core, as DiGraph than analysis module, such as miasm2.analysis.depgraph.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, if it is ok with @serpilliere too, I will move it.

This commit is the first phase of the Type refactor. The PinnedType
class has been separated from the more specific PinnedStruct class.
Doc is currently incoherent, impl will also be completed
Array access logic has moved to Array, Pinned(Sized)Array just contains
the logic to interface with memory
MemStr.from_str allows to allocate and set a string automatically if
ALLOCATOR is set. This avoids allocating a buffer and filling it later.
Shorthand for ("field", SomeMemStruct.get_type()) in a Struct or
MemStruct fields definition.
See the test addition for an example. A Struct, Union, or BitField field
with no name will be considered anonymous: all its fields will be added
to the parent Struct/Union/BitField. This implements this kind of C

struct foo {
    int a;
    union {
        int bar;
        struct {
            short baz;
            short foz;
Also added tests and MemArray.get_offset
Copy link
Contributor Author

Ready to merge for me, as soon as tests pass.

Copy link

Hey, Santa Claus brought another heavy gift! 🎅
Thanks for the feature: It will be very useful to rewrite cleaner Windows structures!

serpilliere added a commit that referenced this pull request Jan 18, 2016
@serpilliere serpilliere merged commit d49e05f into cea-sec:master Jan 18, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

Successfully merging this pull request may close these issues.

None yet

3 participants