00001 #ifndef _MEMGREP_H
00002 #define _MEMGREP_H
00003
00004 #include <elf.h>
00005
00029 #define MEMGREP_CMD_INITIALIZE 0x00000001
00030
00036 #define MEMGREP_CMD_DEINITIALIZE 0x00000002
00037
00049 #define MEMGREP_CMD_SET 0x00000003
00050
00062 #define MEMGREP_CMD_GET 0x00000004
00063
00078 #define MEMGREP_CMD_POPULATE 0x00000005
00079
00094 #define MEMGREP_CMD_SEARCH 0x00000006
00095
00112 #define MEMGREP_CMD_REPLACE 0x00000007
00113
00138 #define MEMGREP_CMD_SEARCHREPLACE 0x00000008
00139
00146 #define MEMGREP_CMD_DUMP 0x00000009
00147
00152 #define MEMGREP_CMD_LISTSEGMENTS 0x0000000A
00153
00160 #define MEMGREP_CMD_DESTROYRESULT 0x0000000B
00161
00165 #define MEMGREP_PARAM_FLAGS 0x00000001
00166
00169 #define MEMGREP_PARAM_LENGTH 0x00000002
00170
00173 #define MEMGREP_PARAM_PADDING 0x00000003
00174
00178 #define MEMGREP_RESULT_TYPE_SEARCH 0x00000001
00179
00182 #define MEMGREP_RESULT_TYPE_REPLACE 0x00000002
00183
00186 #define MEMGREP_RESULT_TYPE_DUMP 0x00000003
00187
00191 #define MEMGREP_FLAG_VERBOSE (1 << 0)
00192
00195 #define MEMGREP_FLAG_PROMPT (1 << 1)
00196
00199 #define MEMGREP_FLAG_DUMPCLEAN (1 << 2)
00200
00206 enum MemoryMedium {
00210 MEMORY_MEDIUM_UNKNOWN = 0,
00214 MEMORY_MEDIUM_PID = 1,
00218 MEMORY_MEDIUM_CORE = 2
00219 };
00220
00226 typedef struct _process_section_addrs {
00227
00231 unsigned long rodata;
00235 unsigned long data;
00239 unsigned long bss;
00240
00244 unsigned long stack;
00245
00246 } PROCESS_SECTION_ADDRS;
00247
00253 typedef struct _core_memory_sections {
00254
00258 unsigned long vma;
00262 unsigned long length;
00263
00267 unsigned long rma;
00268
00269 } CORE_MEMORY_SECTIONS;
00270
00276 typedef struct _mem_ctx_core_data {
00277
00281 int fd;
00282
00286 Elf32_Ehdr elfHeader;
00290 Elf32_Phdr *programHeaders;
00291
00295 CORE_MEMORY_SECTIONS *sections;
00299 unsigned long numSections;
00300
00301 } MEM_CTX_CORE_DATA;
00302
00303 struct _mem_ctx;
00304
00310 typedef struct _memgrep_functions {
00311
00318 unsigned long (*open)(struct _mem_ctx *ctx);
00325 unsigned long (*close)(struct _mem_ctx *ctx);
00326
00333 unsigned long (*getSections)(struct _mem_ctx *ctx);
00342 unsigned char *(*get)(struct _mem_ctx *ctx, unsigned long addr, unsigned long length);
00352 unsigned long (*put)(struct _mem_ctx *ctx, unsigned long addr, unsigned char *buf, unsigned long bufLength);
00360 unsigned long (*populateKeyword)(struct _mem_ctx *ctx, const char *keyword);
00367 unsigned long (*listSegments)(struct _mem_ctx *ctx);
00368
00369 } MEMGREP_FUNCTIONS;
00370
00376 typedef struct _memgrep_result_row {
00377
00381 unsigned long length;
00392 unsigned long type;
00393
00394 } MEMGREP_RESULT_ROW;
00395
00401 typedef struct _memgrep_result {
00402
00406 unsigned long error;
00407
00411 unsigned long numRows;
00415 MEMGREP_RESULT_ROW **rows;
00416
00417 } MEMGREP_RESULT;
00418
00424 typedef struct _memgrep_result_row_search {
00425
00429 MEMGREP_RESULT_ROW base;
00430
00434 unsigned long addr;
00435
00436 } MEMGREP_RESULT_ROW_SEARCH;
00437
00443 typedef struct _memgrep_result_row_replace {
00444
00448 MEMGREP_RESULT_ROW base;
00449
00453 unsigned long addr;
00454
00455 } MEMGREP_RESULT_ROW_REPLACE;
00456
00462 typedef struct _memgrep_result_row_dump {
00463
00467 MEMGREP_RESULT_ROW base;
00468
00472 unsigned long addr;
00476 unsigned char *buf;
00480 unsigned long bufLength;
00481
00482 } MEMGREP_RESULT_ROW_DUMP;
00483
00489 typedef struct _mem_ctx {
00490
00501 unsigned long flags;
00502
00511 enum MemoryMedium medium;
00512
00516 int pid;
00520 char *core;
00521
00525 MEMGREP_FUNCTIONS functions;
00529 PROCESS_SECTION_ADDRS sections;
00530
00534 unsigned long *addrs;
00538 unsigned long numAddrs;
00542 unsigned long length;
00546 unsigned long padding;
00547
00551 MEM_CTX_CORE_DATA coreData;
00552
00553 } MEM_CTX;
00554
00565 unsigned long memgrep(MEM_CTX *ctx, unsigned long cmd, MEMGREP_RESULT *result, unsigned long param, unsigned long data);
00566
00567
00568
00569
00570
00571 unsigned long memgrep_initialize(MEM_CTX *ctx, enum MemoryMedium medium, void *data);
00572 unsigned long memgrep_deinitialize(MEM_CTX *ctx);
00573 unsigned long memgrep_set(MEM_CTX *ctx, unsigned long param, unsigned long data);
00574 unsigned long memgrep_get(MEM_CTX *ctx, unsigned long param);
00575 unsigned long memgrep_populate_string(MEM_CTX *ctx, const char *addresses);
00576 unsigned long memgrep_populate_array(MEM_CTX *ctx, unsigned long *array, unsigned long elements);
00577 unsigned long memgrep_search(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *searchPhrase);
00578 unsigned long memgrep_replace(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *replacePhrase);
00579 unsigned long memgrep_searchreplace(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *searchPhrase, const char *replacePhrase);
00580 unsigned long memgrep_dump(MEM_CTX *ctx, MEMGREP_RESULT *result);
00581 unsigned long memgrep_listSegments(MEM_CTX *ctx);
00582 unsigned long memgrep_destroy(MEM_CTX *ctx, MEMGREP_RESULT *result);
00583
00588 #endif