forked from skelsec/minidump
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathheader.py
More file actions
61 lines (55 loc) · 2.62 KB
/
Copy pathheader.py
File metadata and controls
61 lines (55 loc) · 2.62 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
from minidump.constants import MINIDUMP_TYPE
from minidump.exceptions import MinidumpHeaderFlagsException, MinidumpHeaderSignatureMismatchException
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680378(v=vs.85).aspx
class MinidumpHeader:
def __init__(self):
self.Signature = 'MDMP'
self.Version = None
self.ImplementationVersion = None
self.NumberOfStreams = None
self.StreamDirectoryRva = None
self.CheckSum = 0
self.Reserved = 0
self.TimeDateStamp = 0
self.Flags = None
def to_bytes(self):
t = self.Signature.encode('ascii')
t += self.Version.to_bytes(2, byteorder = 'little', signed = False)
t += self.ImplementationVersion.to_bytes(2, byteorder = 'little', signed = False)
t += self.NumberOfStreams.to_bytes(4, byteorder = 'little', signed = False)
t += self.StreamDirectoryRva.to_bytes(4, byteorder = 'little', signed = False)
t += self.CheckSum.to_bytes(4, byteorder = 'little', signed = False)
t += self.Reserved.to_bytes(4, byteorder = 'little', signed = False)
t += self.TimeDateStamp.to_bytes(4, byteorder = 'little', signed = False)
t += self.Flags.value.to_bytes(4, byteorder = 'little', signed = False)
return t
@staticmethod
def parse(buff):
mh = MinidumpHeader()
mh.Signature = buff.read(4).decode()[::-1]
if mh.Signature != 'PMDM':
raise MinidumpHeaderSignatureMismatchException(mh.Signature)
mh.Version = int.from_bytes(buff.read(2), byteorder = 'little', signed = False)
mh.ImplementationVersion = int.from_bytes(buff.read(2), byteorder = 'little', signed = False)
mh.NumberOfStreams = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.StreamDirectoryRva = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.CheckSum = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.Reserved = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
mh.TimeDateStamp = int.from_bytes(buff.read(4), byteorder = 'little', signed = False)
try:
mh.Flags = MINIDUMP_TYPE(int.from_bytes(buff.read(4), byteorder = 'little', signed = False))
except Exception as e:
raise MinidumpHeaderFlagsException('Could not parse header flags!')
return mh
def __str__(self):
t = '== MinidumpHeader ==\n'
t+= 'Signature: %s\n' % self.Signature
t+= 'Version: %s\n' % self.Version
t+= 'ImplementationVersion: %s\n' % self.ImplementationVersion
t+= 'NumberOfStreams: %s\n' % self.NumberOfStreams
t+= 'StreamDirectoryRva: %s\n' % self.StreamDirectoryRva
t+= 'CheckSum: %s\n' % self.CheckSum
t+= 'Reserved: %s\n' % self.Reserved
t+= 'TimeDateStamp: %s\n' % self.TimeDateStamp
t+= 'Flags: %s\n' % self.Flags
return t