From 268346ba6fc10c8b5476148d7ae8bc75748e1263 Mon Sep 17 00:00:00 2001 From: Loic Jaquemet Date: Thu, 15 Jun 2017 18:53:26 -0600 Subject: [PATCH] fix readme --- README.rst | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/README.rst b/README.rst index e65bb7ba..bf208372 100644 --- a/README.rst +++ b/README.rst @@ -5,8 +5,8 @@ python-haystack memory forensics Quick Start: ============ -`Quick usage guide ` in the docs/ folder. -`Haystack-reverse CLI `_ in the docs/ folder. +`Haystack-reverse CLI ` +The second function/API is the REVERSE function in the extension `python-haystack-reverse `_ It aims at helping an analyst in reverse engineering the memory records types present in a process heap. It focuses on reconstruction, classification of classic C structures from memory. It attempts to recreate types definition. @@ -69,6 +69,8 @@ While technically you could use many third party tool, haystack actually need memory mapping information to work with. So there is a dumping tool included ``haystack-live-dump``: +.. code-block:: bash + # haystack-live-dump myproc.dump You can easily reproduce the format of the dump, its a folder/archive @@ -131,6 +133,8 @@ The following constraints are supported: Example: +.. code-block:: python + [struct_name] myfield: [1,0xff] ptr_field: NotNull @@ -209,7 +213,7 @@ Pointers are always constrained to valid memory space. Where does the idea comes from ? : ---------------------------------- -http://www.hsc.fr/ressources/breves/passe-partout.html.fr originally. +`http://www.hsc.fr/ressources/breves/passe-partout.html.fr`_ originally. since I started in March 2011, I have uncovered several other related previous work. @@ -220,7 +224,7 @@ Other related work are mona.py from Immunity, some other Mandiant stuff... In a nutshell, this is probably not an original idea. But yet, I could not find a operational standalone lib for live memory extraction for my sslsnoop PoC, so.... -`Related work ` +`Related work `_ What are the dependencies ? : -----------------------------