forked from skelsec/minidump
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathminidumpfile.py
More file actions
334 lines (299 loc) · 13.4 KB
/
Copy pathminidumpfile.py
File metadata and controls
334 lines (299 loc) · 13.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
#!/usr/bin/env python3
#
# Author:
# Tamas Jos (@skelsec)
#
import sys
import enum
import struct
import logging
from .exceptions import *
from .minidumpreader import *
from .common_structs import *
from .streams import *
class MINIDUMP_STREAM_TYPE(enum.Enum):
UnusedStream = 0
ReservedStream0 = 1
ReservedStream1 = 2
ThreadListStream = 3
ModuleListStream = 4
MemoryListStream = 5
ExceptionStream = 6
SystemInfoStream = 7
ThreadExListStream = 8
Memory64ListStream = 9
CommentStreamA = 10
CommentStreamW = 11
HandleDataStream = 12
FunctionTableStream = 13
UnloadedModuleListStream = 14
MiscInfoStream = 15
MemoryInfoListStream = 16
ThreadInfoListStream = 17
HandleOperationListStream = 18
TokenStream = 19
JavaScriptDataStream = 20
SystemMemoryInfoStream = 21
ProcessVmCountersStream = 22
ThreadNamesStream = 24
ceStreamNull = 25
ceStreamSystemInfo = 26
ceStreamException = 27
ceStreamModuleList = 28
ceStreamProcessList = 29
ceStreamThreadList = 30
ceStreamThreadContextList = 31
ceStreamThreadCallStackList = 32
ceStreamMemoryVirtualList = 33
ceStreamMemoryPhysicalList = 34
ceStreamBucketParameters = 35
ceStreamProcessModuleMap = 36
ceStreamDiagnosisList = 37
LastReservedStream = 0xffff
class MINIDUMP_TYPE(enum.IntFlag):
MiniDumpNormal = 0x00000000
MiniDumpWithDataSegs = 0x00000001
MiniDumpWithFullMemory = 0x00000002
MiniDumpWithHandleData = 0x00000004
MiniDumpFilterMemory = 0x00000008
MiniDumpScanMemory = 0x00000010
MiniDumpWithUnloadedModules = 0x00000020
MiniDumpWithIndirectlyReferencedMemory = 0x00000040
MiniDumpFilterModulePaths = 0x00000080
MiniDumpWithProcessThreadData = 0x00000100
MiniDumpWithPrivateReadWriteMemory = 0x00000200
MiniDumpWithoutOptionalData = 0x00000400
MiniDumpWithFullMemoryInfo = 0x00000800
MiniDumpWithThreadInfo = 0x00001000
MiniDumpWithCodeSegs = 0x00002000
MiniDumpWithoutAuxiliaryState = 0x00004000
MiniDumpWithFullAuxiliaryState = 0x00008000
MiniDumpWithPrivateWriteCopyMemory = 0x00010000
MiniDumpIgnoreInaccessibleMemory = 0x00020000
MiniDumpWithTokenInformation = 0x00040000
MiniDumpWithModuleHeaders = 0x00080000
MiniDumpFilterTriage = 0x00100000
MiniDumpValidTypeFlags = 0x001fffff
class MINIDUMP_DIRECTORY:
def __init__(self):
self.StreamType = None
self.Location = None
@staticmethod
def get_stream_type_value(buff, peek=False):
return int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
@staticmethod
def parse(buff):
raw_stream_type_value = MINIDUMP_DIRECTORY.get_stream_type_value(buff)
# StreamType value that are over 0xffff are considered MINIDUMP_USER_STREAM streams
# and their format depends on the client used to create the minidump.
# As per the documentation, this stream should be ignored : https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidumminidump_dirp_stream_type#remarks
is_user_stream = raw_stream_type_value > MINIDUMP_STREAM_TYPE.LastReservedStream.value
is_stream_supported = raw_stream_type_value in MINIDUMP_STREAM_TYPE._value2member_map_
if is_user_stream and not is_stream_supported:
return None
md = MINIDUMP_DIRECTORY()
md.StreamType = MINIDUMP_STREAM_TYPE(raw_stream_type_value)
md.Location = MINIDUMP_LOCATION_DESCRIPTOR.parse(buff)
return md
def __str__(self):
t = 'StreamType: %s %s' % (self.StreamType, self.Location)
return t
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680378(v=vs.85).aspx
class MinidumpHeader:
def __init__(self):
self.Signature = None
self.Version = None
self.ImplementationVersion = None
self.NumberOfStreams = None
self.StreamDirectoryRva = None
self.CheckSum = None
self.Reserved = None
self.TimeDateStamp = None
self.Flags = None
@staticmethod
def parse(buff):
mh = MinidumpHeader()
mh.Signature = buff.read(4).decode()[::-1]
if mh.Signature != 'PMDM':
raise MinidumpHeaderSignatureMismatchException(mh.Signature)
mh.Version = int.from_bytes(buff.read(2), byteorder = 'little', signed = False)
mh.ImplementationVersion = int.from_bytes(buff.read(2), byteorder = 'little', signed = False)
mh.NumberOfStreams = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.StreamDirectoryRva = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.CheckSum = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.Reserved = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.TimeDateStamp = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
try:
mh.Flags = MINIDUMP_TYPE(int.from_bytes(buff.read(4), byteorder = 'little', signed = False))
except Exception as e:
raise MinidumpHeaderFlagsException('Could not parse header flags!')
return mh
def __str__(self):
t = '== MinidumpHeader ==\n'
t+= 'Signature: %s\n' % self.Signature
t+= 'Version: %s\n' % self.Version
t+= 'ImplementationVersion: %s\n' % self.ImplementationVersion
t+= 'NumberOfStreams: %s\n' % self.NumberOfStreams
t+= 'StreamDirectoryRva: %s\n' % self.StreamDirectoryRva
t+= 'CheckSum: %s\n' % self.CheckSum
t+= 'Reserved: %s\n' % self.Reserved
t+= 'TimeDateStamp: %s\n' % self.TimeDateStamp
t+= 'Flags: %s\n' % self.Flags
return t
class MinidumpFile:
def __init__(self):
self.filename = None
self.file_handle = None
self.header = None
self.directories = []
self.threads_ex = None
self.threads = None
self.modules = None
self.memory_segments = None
self.memory_segments_64 = None
self.sysinfo = None
self.comment_a = None
self.comment_w = None
self.exception = None
self.handles = None
self.unloaded_modules = None
self.misc_info = None
self.memory_info = None
self.thread_info = None
@staticmethod
def parse(filename):
mf = MinidumpFile()
mf.filename = filename
mf.file_handle = open(filename, 'rb')
mf._parse()
return mf
def get_reader(self):
return MinidumpFileReader(self)
def _parse(self):
self.__parse_header()
self.__parse_directories()
def __parse_header(self):
self.header = MinidumpHeader.parse(self.file_handle)
for i in range(0, self.header.NumberOfStreams):
self.file_handle.seek(self.header.StreamDirectoryRva + i * 12, 0 )
minidump_dir = MINIDUMP_DIRECTORY.parse(self.file_handle)
if minidump_dir:
self.directories.append(minidump_dir)
else:
self.file_handle.seek(self.header.StreamDirectoryRva + i * 12, 0 )
user_stream_type_value = MINIDUMP_DIRECTORY.get_stream_type_value(self.file_handle)
logging.debug('Found Unknown UserStream directory Type: %x' % (user_stream_type_value))
def __parse_directories(self):
for dir in self.directories:
if dir.StreamType == MINIDUMP_STREAM_TYPE.UnusedStream:
logging.debug('Found UnusedStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
continue # Reserved. Do not use this enumeration value.
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ReservedStream0:
logging.debug('Found ReservedStream0 @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
continue # Reserved. Do not use this enumeration value.
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ReservedStream1:
logging.debug('Found ReservedStream1 @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
continue # Reserved. Do not use this enumeration value.
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ThreadListStream:
logging.debug('Found ThreadListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.threads = MinidumpThreadList.parse(dir, self.file_handle)
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ModuleListStream:
logging.debug('Found ModuleListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.modules = MinidumpModuleList.parse(dir, self.file_handle)
#logging.debug(str(modules_list))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.MemoryListStream:
logging.debug('Found MemoryListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.memory_segments = MinidumpMemoryList.parse(dir, self.file_handle)
#logging.debug(str(self.memory_segments))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.SystemInfoStream:
logging.debug('Found SystemInfoStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.sysinfo = MinidumpSystemInfo.parse(dir, self.file_handle)
#logging.debug(str(self.sysinfo))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ThreadExListStream:
logging.debug('Found ThreadExListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.threads_ex = MinidumpThreadExList.parse(dir, self.file_handle)
#logging.debug(str(self.threads_ex))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.Memory64ListStream:
logging.debug('Found Memory64ListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.memory_segments_64 = MinidumpMemory64List.parse(dir, self.file_handle)
#logging.debug(str(self.memory_segments_64))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.CommentStreamA:
logging.debug('Found CommentStreamA @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.comment_a = CommentStreamA.parse(dir, self.file_handle)
#logging.debug(str(self.comment_a))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.CommentStreamW:
logging.debug('Found CommentStreamW @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.comment_w = CommentStreamW.parse(dir, self.file_handle)
#logging.debug(str(self.comment_w))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ExceptionStream:
logging.debug('Found ExceptionStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.exception = ExceptionList.parse(dir, self.file_handle)
#logging.debug(str(self.comment_w))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.HandleDataStream:
logging.debug('Found HandleDataStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.handles = MinidumpHandleDataStream.parse(dir, self.file_handle)
#logging.debug(str(self.handles))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.FunctionTableStream:
logging.debug('Found FunctionTableStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
logging.debug('Parsing of this stream type is not yet implemented!')
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.UnloadedModuleListStream:
logging.debug('Found UnloadedModuleListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.unloaded_modules = MinidumpUnloadedModuleList.parse(dir, self.file_handle)
#logging.debug(str(self.unloaded_modules))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.MiscInfoStream:
logging.debug('Found MiscInfoStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.misc_info = MinidumpMiscInfo.parse(dir, self.file_handle)
#logging.debug(str(self.misc_info))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.MemoryInfoListStream:
logging.debug('Found MemoryInfoListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.memory_info = MinidumpMemoryInfoList.parse(dir, self.file_handle)
#logging.debug(str(self.memory_info))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ThreadInfoListStream:
logging.debug('Found ThreadInfoListStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
self.thread_info = MinidumpThreadInfoList.parse(dir, self.file_handle)
logging.debug(str(self.thread_info))
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.SystemMemoryInfoStream:
logging.debug('Found SystemMemoryInfoStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
logging.debug('SystemMemoryInfoStream parsing is not implemented (Missing documentation)')
continue
elif dir.StreamType == MINIDUMP_STREAM_TYPE.JavaScriptDataStream:
logging.debug('Found JavaScriptDataStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
logging.debug('JavaScriptDataStream parsing is not implemented (Missing documentation)')
elif dir.StreamType == MINIDUMP_STREAM_TYPE.ProcessVmCountersStream:
logging.debug('Found ProcessVmCountersStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
logging.debug('ProcessVmCountersStream parsing is not implemented (Missing documentation)')
elif dir.StreamType == MINIDUMP_STREAM_TYPE.TokenStream:
logging.debug('Found TokenStream @%x Size: %d' % (dir.Location.Rva, dir.Location.DataSize))
logging.debug('TokenStream parsing is not implemented (Missing documentation)')
else:
logging.debug('Found Unknown Stream! Type: %s @%x Size: %d' % (dir.StreamType.name, dir.Location.Rva, dir.Location.DataSize))
"""
elif dir.StreamType == MINIDUMP_STREAM_TYPE.HandleOperationListStream:
elif dir.StreamType == MINIDUMP_STREAM_TYPE.LastReservedStream:
"""
def __str__(self):
t = '== Minidump File ==\n'
t += str(self.header)
t += str(self.sysinfo)
for dir in self.directories:
t += str(dir) + '\n'
for mod in self.modules:
t += str(mod) + '\n'
for segment in self.memorysegments:
t+= str(segment) + '\n'
return t