memdump.c
void resolve_string(const char *str, int pid, void *base, void* end, int* nb_val)
{
  long*res;
  int length;
  int i;
  int j;
  int inc = sizeof(long);
  int flag = 0;/* disabled */
  int flag_toobig = 0;
  
  //  [--------------------------------------------] = L>1Go
  //                        |
  //                        v
  //  [----]oooooooooooooooooooooooooooooooooo[----] = 2 * 1/QUOTIENT_TOO_BIG eme * L
  // base big_end                      big_start  end
  
  void * big_end = NULL, * big_start = NULL;
  void * debut = base;
  unsigned long taille_segment = (ulong)(end - base);
  printf("Taille du segment: %lu\n",taille_segment);
  //Si on a un segment de plus d'1G on a un probleme
  
  if(taille_segment > TAILLE_MAX_SEGMENT){
    flag_toobig = 1;
    big_end = base + (taille_segment / QUOTIENT_TOO_BIG);
    big_start = end - (taille_segment / QUOTIENT_TOO_BIG);
  }
  
  /*
  ** length % inc should be equal to 0.
  */
  length = strlen(str) + 1;
  if (length % inc) {
    length += inc - (length % inc);
  }
  if ((res = malloc(length)) == 0) {
    perror("malloc");
    exit(1);
  }
  /*
  ** _Ugly_ memory parsing.
  */
  //printf ("Searching... from %p\n",base);
  while (1) {
    for (i = 0, j = 0; i < length; i += inc, j++) {
      void*tmpbase;
      
      tmpbase = (void *) ((long) base + i);
      //      if((ulong)tmpbase % 1000 == 0)
      //printf("tmp = %p\n",tmpbase);
      /*
      ** Read memory
      */
      if(tmpbase > end){
	printf("On est trop loin pos=%p end=%p\n",tmpbase,end);
	free(res);
	*nb_val = tmpbase - debut;
	return;
      }
      if((res[j] = ptrace(PTRACE_PEEKDATA, pid, tmpbase, 0)) == (-1)){
	
	
	/*
	** Error ?
	*/
	if (errno) {
	  if(errno == EFAULT)
	    printf("Efault \n");
	  printf("Arret sur %p \n",tmpbase);
	  free(res);
	  *nb_val = tmpbase - debut;
	  return;
	}
      }
    }
    /*
    ** Compare data with requested string
    */
    if (!strcmp((char *) res, str)) {
      printf("[%s] found in processus %d at : %p.\n",
	     str, pid, base);
      flag = 1;
    }
    /*
    ** Look next bytes
    */
    base = (void *) ((unsigned int) base + 1);
    //on verifie que si on est dans le cas big:
    //si base entre bg_end et big_start -> base = big_start
    if(flag_toobig == 1 && base > big_end && base < big_start){
      printf("On passe le point big_end\n");
      base = (void*)big_start;
    }
  }
  return;
}
/*
** This function is based on ptrace(). It looks each byte of the memory for
** a string matching *str.
** It will print error messages on error while attaching but not if reading
** memory fails.
*/
This function is based on ptrace(). It looks each byte of the memory for
a string matching *str.
It will print error messages on error while attaching but not if reading
memory fails.
This function is based on ptrace () . It looks each byte of the memory for a string matching * str . It will print error messages on error while attaching but not if reading memory fails .
void resolve_string(const char *str, int pid, void *base, void* end, int* nb_val)
{
  long*res;
  int length;
  int i;
  int j;
  int inc = sizeof(long);
  int flag = 0;
  int flag_toobig = 0;
  void * big_end = NULL, * big_start = NULL;
  void * debut = base;
  unsigned long taille_segment = (ulong)(end - base);
  printf("Taille du segment: %lu\n",taille_segment);
  if(taille_segment > TAILLE_MAX_SEGMENT){
    flag_toobig = 1;
    big_end = base + (taille_segment / QUOTIENT_TOO_BIG);
    big_start = end - (taille_segment / QUOTIENT_TOO_BIG);
  }
  length = strlen(str) + 1;
  if (length % inc) {
    length += inc - (length % inc);
  }
  if ((res = malloc(length)) == 0) {
    perror("malloc");
    exit(1);
  }
  while (1) {
    for (i = 0, j = 0; i < length; i += inc, j++) {
      void*tmpbase;
      tmpbase = (void *) ((long) base + i);
      if(tmpbase > end){
	printf("On est trop loin pos=%p end=%p\n",tmpbase,end);
	free(res);
	*nb_val = tmpbase - debut;
	return;
      }
      if((res[j] = ptrace(PTRACE_PEEKDATA, pid, tmpbase, 0)) == (-1)){
	if (errno) {
	  if(errno == EFAULT)
	    printf("Efault \n");
	  printf("Arret sur %p \n",tmpbase);
	  free(res);
	  *nb_val = tmpbase - debut;
	  return;
	}
      }
    }
    if (!strcmp((char *) res, str)) {
      printf("[%s] found in processus %d at : %p.\n",
	     str, pid, base);
      flag = 1;
    }
    base = (void *) ((unsigned int) base + 1);
    if(flag_toobig == 1 && base > big_end && base < big_start){
      printf("On passe le point big_end\n");
      base = (void*)big_start;
    }
  }
  return;
}
void resolve_string ( const char * str , int pid , void * base , void * end , int * nb_val ) { long * res ; int length ; int i ; int j ; int inc = sizeof ( long ) ; int flag = 0 ; int flag_toobig = 0 ; void * big_end = NULL , * big_start = NULL ; void * debut = base ; unsigned long taille_segment = ( ulong ) ( end - base ) ; printf ( " \n " , taille_segment ) ; if ( taille_segment > TAILLE_MAX_SEGMENT ) { flag_toobig = 1 ; big_end = base + ( taille_segment / QUOTIENT_TOO_BIG ) ; big_start = end - ( taille_segment / QUOTIENT_TOO_BIG ) ; } length = strlen ( str ) + 1 ; if ( length % inc ) { length += inc - ( length % inc ) ; } if ( ( res = malloc ( length ) ) == 0 ) { perror ( " " ) ; exit ( 1 ) ; } while ( 1 ) { for ( i = 0 , j = 0 ; i < length ; i += inc , j ++ ) { void * tmpbase ; tmpbase = ( void * ) ( ( long ) base + i ) ; if ( tmpbase > end ) { printf ( " \n " , tmpbase , end ) ; free ( res ) ; * nb_val = tmpbase - debut ; return ; } if ( ( res [ j ] = ptrace ( PTRACE_PEEKDATA , pid , tmpbase , 0 ) ) == ( -1 ) ) { if ( errno ) { if ( errno == EFAULT ) printf ( " \n " ) ; printf ( " \n " , tmpbase ) ; free ( res ) ; * nb_val = tmpbase - debut ; return ; } } } if ( ! strcmp ( ( char * ) res , str ) ) { printf ( " \n " , str , pid , base ) ; flag = 1 ; } base = ( void * ) ( ( unsigned int ) base + 1 ) ; if ( flag_toobig == 1 && base > big_end && base < big_start ) { printf ( " \n " ) ; base = ( void * ) big_start ; } } return ; }
This function is based on ptrace().
This function is based on ptrace () .
/* disabled */ //  [--------------------------------------------] = L>1Go //                        | //                        v //  [----]oooooooooooooooooooooooooooooooooo[----] = 2 * 1/QUOTIENT_TOO_BIG eme * L // base big_end                      big_start  end //Si on a un segment de plus d'1G on a un probleme /*
  ** length % inc should be equal to 0.
  */ /*
  ** _Ugly_ memory parsing.
  */ //printf ("Searching... from %p\n",base); //      if((ulong)tmpbase % 1000 == 0) //printf("tmp = %p\n",tmpbase); /*
      ** Read memory
      */ /*
	** Error ?
	*/ /*
    ** Compare data with requested string
    */ /*
    ** Look next bytes
    */ //on verifie que si on est dans le cas big: //si base entre bg_end et big_start -> base = big_start