diff options
Diffstat (limited to 'src/parser.c')
| -rw-r--r-- | src/parser.c | 58 |
1 files changed, 37 insertions, 21 deletions
diff --git a/src/parser.c b/src/parser.c index 86f9563..1731c70 100644 --- a/src/parser.c +++ b/src/parser.c @@ -1,8 +1,10 @@ +#include "parser.h" + #include <Windows.h> -#include "types.h" #include "utils.h" #include "module.h" +#include "stack_walk.h" extern u8 expect_single_step; extern DWORD continue_status; @@ -12,6 +14,7 @@ enum TOKEN_TYPE { TOKEN_CONTINUE, TOKEN_CALLSTACK, TOKEN_LISTMODULE, + TOKEN_DUMP_SYMBOLS, TOKEN_PRINT_REG, TOKEN_STEP_INTO, TOKEN_DUMP_MEMORY, @@ -41,10 +44,13 @@ struct ast_node { struct ast_node* right; }; +#define DECLARE_COMMAND(x) { .start = x, .size = sizeof(x) } + static struct command commands[] = { { .start = "g", .size = 1 }, { .start = "k", .size = 1 }, { .start = "lm", .size = 2 }, + DECLARE_COMMAND("x"), { .start = "r", .size = 1 }, { .start = "t", .size = 1 }, { .start = "db", .size = 2 }, @@ -149,6 +155,13 @@ struct ast_node* parse_command(struct token* tokens, struct ast_node* nodes) { cur_node->left = NULL; cur_node->right = NULL; return cur_node; + case TOKEN_DUMP_SYMBOLS: + tokens++; + print("TOKEN_DUMP_SYMBOLS\n"); + cur_node->token = cur_token; + cur_node->left = NULL; + cur_node->right = NULL; + return cur_node; case TOKEN_PRINT_REG: tokens++; print("TOKEN_PRINT_REG\n"); @@ -167,8 +180,8 @@ struct ast_node* parse_command(struct token* tokens, struct ast_node* nodes) { tokens++; print("TOKEN_DUMP_MEMORY\n"); cur_node->token = cur_token; - cur_node->left = NULL; - cur_node->right = parse_primary(tokens, ++nodes); + cur_node->left = parse_primary(tokens++, ++nodes); + cur_node->right = parse_primary(tokens++, ++nodes); return cur_node; case TOKEN_QUIT: tokens++; @@ -215,18 +228,7 @@ void run(struct ast_node* root) { ); process_commands = FALSE; } else if (cur_node.token->type == TOKEN_CALLSTACK) { - for (u8 index = 0U; index < 64U; index++) { - if (((1ULL << index) & modules_list) == 0U) { - struct module* module = &modules[index]; - if ((u64)module->base_addr < ctx.Rip && ctx.Rip < ((u64)module->base_addr + module->nt_header.OptionalHeader.SizeOfImage)) { - print("Module name %s\n", module->name); - print("Module address %xu\n", (u64)module->base_addr); - print("Module size %xu\n", module->nt_header.OptionalHeader.SizeOfImage); - print("Function address %xu\n", ctx.Rip); - print("Function offset in module %xu\n", ctx.Rip - (u64)module->base_addr); - } - } - } + walk_stack(&ctx); } else if (cur_node.token->type == TOKEN_LISTMODULE) { for (u8 index = 0U; index < 64U; index++) { if (((1ULL << index) & modules_list) == 0U) { @@ -238,7 +240,6 @@ void run(struct ast_node* root) { } } else if (cur_node.token->type == TOKEN_PRINT_REG) { print("RIP : %xu\n", ctx.Rip); - print("RAX : %xu\n", ctx.Rax); print("RCX : %xu\n", ctx.Rcx); print("RDX : %xu\n", ctx.Rdx); print("RBX : %xu\n", ctx.Rbx); @@ -263,12 +264,13 @@ void run(struct ast_node* root) { is_open = FALSE; process_commands = FALSE; } else if (cur_node.token->type == TOKEN_DUMP_MEMORY) { - u64 addr = eval_number(cur_node.right); - u8 buf[16U] = { 0 }; + u64 addr = eval_number(cur_node.left); + u64 size = eval_number(cur_node.right); + u8* buf = VirtualAlloc(NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); - if(read_memory((const void*)addr, (void*)buf, sizeof(buf))) { - for (u32 index = 0U; index < sizeof(buf); index++) { - print("%b ", buf[index]); + if(read_memory((const void*)addr, (void*)buf, size)) { + for (u32 index = 0U; index < size; index += 8U) { + print("%xb %xb %xb %xb %xb %xb %xb %xb\n", buf[index], buf[index + 1U], buf[index + 2U], buf[index + 3U], buf[index + 4U], buf[index + 5U], buf[index + 6U], buf[index + 7U]); } print("\n"); } else { @@ -276,6 +278,20 @@ void run(struct ast_node* root) { print("Unable to read memory at this address, error %u\n", GetLastError()); } + VirtualFree(buf, size, MEM_RELEASE); + } else if (cur_node.token->type == TOKEN_DUMP_SYMBOLS) { + for (u8 index = 0U; index < 64U; index++) { + if (((1ULL << index) & modules_list) == 0U) { + struct module* module = &modules[index]; +#ifdef HASHMAP + iterate(&module->symbols); +#else + for (u32 sym_index = 0U; sym_index < module->functions_count; sym_index++) { + print("%s\n", module->functions_name[index]); + } +#endif + } + } } else { print("Command unknown\n"); process_commands = TRUE; |
