Package com.pnfsoftware.jeb.core.units.code.asm.memory

Class VirtualMemoryUtil

java.lang.Object
com.pnfsoftware.jeb.core.units.code.asm.memory.VirtualMemoryUtil
public class VirtualMemoryUtil extends Object
Utility methods for virtual memory classes.

- Methods of this class do not raise MemoryException. Instead, they return a boolean value to notify success or failure of the operation.
- Unless otherwise specified, memory protection is disregarded when reading and writing using those methods.

  • Method Details

    • createMemory

      public static IVirtualMemory createMemory(int spaceBits, int pageBits, Endianness standardEndianness)
      Facade factory method returning a concrete, private implementation of an efficient page-based virtual memory.
      Parameters:
      spaceBits - address space bit size
      pageBits - page bit size
      standardEndianness - standard endianness
      Returns:
      virtual memory

    • getCopyOnWriteShim

      public static IVirtualMemoryShim getCopyOnWriteShim(IVirtualMemory mem)
      Create a copy-on-write shim of the provided virtual memory, if possible. The shim can be used to perform safe memory writes, that will not impact the underlying memory. Using a shim yields better performance than copying the entire source VM and working on the full copy.
      Parameters:
      mem - a VM
      Returns:
      the shim VM
      Throws:
      IllegalArgumentException - if the provided VM object does not support the creation of a shim

    • isPageAllocated

      public static boolean isPageAllocated(IVirtualMemory mem, long address)
      Verify if a page was allocated (regardless of protection rights on the page).
      Parameters:
      mem - virtual memory
      address - address within the page
      Returns:
      true if the page is allocated

    • findAvailableRange

      public static long findAvailableRange(IVirtualMemory mem, long start, int size)
      Search for an available memory range.
      Parameters:
      mem - virtual memory
      start - soft start address, a hint
      size - range size
      Returns:
      the range start address, -1 on error

    • allocate

      public static long allocate(IVirtualMemory mem, long start, int size, int protection)
      Search an available range and allocate at least the requested amount of bytes. Do not confuse this method with IVirtualMemory.allocate(long, int, int).
      Parameters:
      mem - virtual memory
      start - soft start address, considered a hint by this allocator routine; if you wish to allocate at a fixed, given address, use IVirtualMemory.allocate(long, int, int)
      size - range size
      protection - protection flags
      Returns:
      the base address of the allocated memory range; -1 on error

    • allocateFillGaps

      public static int allocateFillGaps(IVirtualMemory mem, long address, int size, int protection)
      Allocate a memory range, filling gaps in between already allocated pages if needed. (The given range [address, address + size) may have already allocated pages. Those pages will not be re-allocated.) When the method returns, the range [address, address + size) is guaranteed to be allocated.
      Parameters:
      mem - virtual memory
      address - start address
      size - range size
      protection - protection flags
      Returns:
      the number of pages that were actually allocated

    • deallocate

      public static boolean deallocate(IVirtualMemory mem, long addr, int size)
      Free a range previously allocated with allocate.
      Parameters:
      mem - virtual memory
      addr - range start address
      size - range size
      Returns:
      success indicator

    • checkPermissions

      public static boolean checkPermissions(IVirtualMemory mem, long addr, int size, int wantedPermissions)
      Check whether a range has the requested permissions.
      Parameters:
      mem - virtual memory
      addr - start address
      size - range size
      wantedPermissions - requested permissions
      Returns:
      true if all pages have the requested permissions

    • canWrite

      public static boolean canWrite(IVirtualMemory mem, long addr, int size)
      Check whether a range is writable.
      Parameters:
      mem - virtual memory
      addr - start address
      size - range size
      Returns:
      true if the range is writable

    • canRead

      public static boolean canRead(IVirtualMemory mem, long addr, int size)
      Check whether a range is readable.
      Parameters:
      mem - virtual memory
      addr - start address
      size - range size
      Returns:
      true if the range is readable

    • readBytesSafe

      public static int readBytesSafe(IVirtualMemory mem, long address, int size, byte[] dst, int dstOffset, int protection)
      Safely read at most the requested amount of bytes. Convert segment flags to virtual-memory access flags.
      Parameters:
      mem - the memory
      address - target address
      size - requested read size
      dst - destination buffer
      dstOffset - position within the destination buffer
      protection - the requested protection level, must contain at least IVirtualMemory.ACCESS_READ
      Returns:
      the number of bytes read; may be less than requested. -1 if an unknown error occurs

    • readBytesSafe

      public static int readBytesSafe(IVirtualMemory mem, long address, int size, byte[] dst, int dstOffset, boolean bypassProtection)
      Safely read at most the requested amount of bytes.
      Parameters:
      mem - the memory
      address - target address
      size - requested read size
      dst - destination buffer
      dstOffset - position within the destination buffer
      bypassProtection - if true, all pages will be read, including non-resable pages; else, only readable pages will be read
      Returns:
      the number of bytes read; may be less than requested. -1 if an unknown error occurs

    • convertSegmentFlagsToVMFlags

      public static int convertSegmentFlagsToVMFlags(int segmentFlags)
      Convert segment permissions to virtual memory access flags.
      Parameters:
      segmentFlags - ISegmentInformation (FLAG_xxx) flags
      Returns:
      a combination of IVirtualMemory (ACCESS_xxx) flags

    • readSafe

      public static boolean readSafe(IVirtualMemory mem, long address, byte[] data)
      Read an array of bytes from memory (this method does not raise MemoryException). Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      data - destination array
      Returns:
      success indicator

    • readByteSafe

      public static boolean readByteSafe(IVirtualMemory mem, long address, byte[] out)
      Read a byte safely (this method does not raise MemoryException). Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readByte

      public static boolean readByte(IVirtualMemory mem, long address, byte[] out, boolean bypassProtection)
      Read a byte safely (this method does not raise MemoryException). Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readLEShortSafe

      public static boolean readLEShortSafe(IVirtualMemory mem, long address, short[] out)
      Read a little-endian 16-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readShort

      public static boolean readShort(IVirtualMemory mem, long address, short[] out, boolean bypassProtection)
      Read a 16-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readLEIntSafe

      public static boolean readLEIntSafe(IVirtualMemory mem, long address, int[] out)
      Read a little-endian 32-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readInt

      public static boolean readInt(IVirtualMemory mem, long address, int[] out, boolean bypassProtection)
      Read a 32-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readLELongSafe

      public static boolean readLELongSafe(IVirtualMemory mem, long address, long[] out)
      Read a little-endian 64-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readLong

      public static boolean readLong(IVirtualMemory mem, long address, long[] out, boolean bypassProtection)
      Read a 64-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readBEShortSafe

      public static boolean readBEShortSafe(IVirtualMemory mem, long address, short[] out)
      Read a big-endian 16-bit integer.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readBEIntSafe

      public static boolean readBEIntSafe(IVirtualMemory mem, long address, int[] out)
      Read a big-endian 32-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • readBELongSafe

      public static boolean readBELongSafe(IVirtualMemory mem, long address, long[] out)
      Read a big-endian 64-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      out - single-element array that will receive the result of the read operation
      Returns:
      success indicator

    • writeZeros

      public static boolean writeZeros(IVirtualMemory mem, long address, int cnt, boolean bypassProtection)
      Write a sled of zeros. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - start memory address
      cnt - count of bytes
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator.

    • writeSled

      public static boolean writeSled(IVirtualMemory mem, long address, int cnt, byte val, boolean bypassProtection)
      Write a sled of bytes.
      Parameters:
      mem - virtual memory
      address - start memory address
      cnt - count of bytes
      val - byte value
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator.

    • writeSafe

      public static boolean writeSafe(IVirtualMemory mem, long address, byte[] data)
      Write an array of bytes to memory (this method does not raise MemoryException). Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      data - source array
      Returns:
      success indicator

    • writeByte

      public static boolean writeByte(IVirtualMemory mem, long address, byte v, boolean bypassProtection)
      Write an 8-bit integer.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to be written
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeByte

      public static boolean writeByte(IVirtualMemory mem, long address, byte v)
      Write an 8-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to be written
      Returns:
      success indicator

    • writeLEShortSafe

      public static boolean writeLEShortSafe(IVirtualMemory mem, long address, short v)
      Write a little-endian 16-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to be written
      Returns:
      success indicator

    • writeShort

      public static boolean writeShort(IVirtualMemory mem, long address, short v, boolean bypassProtection)
      Write a 16-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeLEIntSafe

      public static boolean writeLEIntSafe(IVirtualMemory mem, long address, int v)
      Write a little-endian 32-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to be written
      Returns:
      success indicator

    • writeInt

      public static boolean writeInt(IVirtualMemory mem, long address, int v, boolean bypassProtection)
      Write a 32-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeLELongSafe

      public static boolean writeLELongSafe(IVirtualMemory mem, long address, long v)
      Write a little-endian 64-bit integer. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to be written
      Returns:
      success indicator

    • writeLong

      public static boolean writeLong(IVirtualMemory mem, long address, long v, boolean bypassProtection)
      Write a 64-bit integer using the memory standard endianness.
      Parameters:
      mem - virtual memory
      address - memory address
      v - value to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeBooleans

      public static boolean writeBooleans(IVirtualMemory mem, long address, boolean[] array, int offset, int count, boolean bypassProtection)
      Write an array of booleans to memory. Each entry occupies 1 byte whose value will be set to 0(false) or 1(true).
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readBooleans

      public static boolean readBooleans(IVirtualMemory mem, long address, boolean[] array, int offset, int count, boolean bypassProtection)
      Read an array of booleans from memory. Each entry occupies 1 byte of memory, the lower-significant bit of the byte indicates false(0) or true(1).
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to read
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeBytes

      public static boolean writeBytes(IVirtualMemory mem, long address, byte[] array, int offset, int count, boolean bypassProtection)
      Write an array of bytes to memory.
      Parameters:
      mem - virtual memory
      address - memory address
      array - source array
      offset - start offset in the source array
      count - count of elements to read from the array and write to the memory
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeBytes

      public static boolean writeBytes(IVirtualMemory mem, long address, byte[] array, int offset, int count)
      Write an array of bytes to memory. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      array - source array
      offset - start offset in the source array
      count - count of elements to read from the array and write to the memory
      Returns:
      success indicator

    • readBytes

      public static boolean readBytes(IVirtualMemory mem, long address, byte[] array, int offset, int count, boolean bypassProtection)
      Read an array of bytes from memory.
      Parameters:
      mem - virtual memory
      address - memory address
      array - destination array
      offset - start offset in the destination array
      count - count of elements to read from memory and write to the array
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readBytes

      public static boolean readBytes(IVirtualMemory mem, long address, byte[] array, int offset, int count)
      Read an array of bytes from memory. Memory protection is disregarded.
      Parameters:
      mem - virtual memory
      address - memory address
      array - destination array
      offset - start offset in the destination array
      count - count of elements to read from memory and write to the array
      Returns:
      success indicator

    • writeChars

      public static boolean writeChars(IVirtualMemory mem, long address, char[] array, int offset, int count, boolean bypassProtection)
      Write an array of chars to memory. Each entry occupies 2 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readChars

      public static boolean readChars(IVirtualMemory mem, long address, char[] array, int offset, int count, boolean bypassProtection)
      Read an array of chars from memory. Each entry occupies 2 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeShorts

      public static boolean writeShorts(IVirtualMemory mem, long address, short[] array, int offset, int count, boolean bypassProtection)
      Write an array of shorts to memory. Each entry occupies 2 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readShorts

      public static boolean readShorts(IVirtualMemory mem, long address, short[] array, int offset, int count, boolean bypassProtection)
      Read an array of shorts from memory. Each entry occupies 2 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeInts

      public static boolean writeInts(IVirtualMemory mem, long address, int[] array, int offset, int count, boolean bypassProtection)
      Write an array of ints to memory. Each entry occupies 4 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readInts

      public static boolean readInts(IVirtualMemory mem, long address, int[] array, int offset, int count, boolean bypassProtection)
      Read an array of ints from memory. Each entry occupies 4 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to read
      bypassProtection - true to bypass memory protection checks
      Returns:
      success indicator

    • writeLongs

      public static boolean writeLongs(IVirtualMemory mem, long address, long[] array, int offset, int count, boolean bypassProtection)
      Write an array of longs to memory. Each entry occupies 8 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readLongs

      public static boolean readLongs(IVirtualMemory mem, long address, long[] array, int offset, int count, boolean bypassProtection)
      Read an array of longs from memory. Each entry occupies 8 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • writeFloats

      public static boolean writeFloats(IVirtualMemory mem, long address, float[] array, int offset, int count, boolean bypassProtection)
      Write an array of floats to memory. Each entry occupies 4 bytes of memory. The encoding used is IEEE754. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - if true, disregard memory protection
      Returns:
      success indicator

    • readFloats

      public static boolean readFloats(IVirtualMemory mem, long address, float[] array, int offset, int count, boolean bypassProtection)
      Read an array of floats from memory. Each entry occupies 4 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to read
      bypassProtection - true to bypass memory protection checks
      Returns:
      success indicator

    • writeDoubles

      public static boolean writeDoubles(IVirtualMemory mem, long address, double[] array, int offset, int count, boolean bypassProtection)
      Write an array of doubles to memory. Each entry occupies 8 bytes of memory. The encoding used is IEEE754. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to write
      bypassProtection - true to bypass memory protection checks
      Returns:
      success indicator

    • readDoubles

      public static boolean readDoubles(IVirtualMemory mem, long address, double[] array, int offset, int count, boolean bypassProtection)
      Read an array of doubles from memory. Each entry occupies 8 bytes of memory. Byte ordering is determined from the virtual memory endianness setting.
      Parameters:
      mem - virtual memory
      address - memory address
      array - array
      offset - start offset in the array
      count - count of elements to read
      bypassProtection - true to bypass memory protection checks
      Returns:
      success indicator

    • readNullTerminatedString

      public static String readNullTerminatedString(IVirtualMemory mem, long address)
      Read a null-terminated string from memory. No max size and UTF-8 encoding are used.

      This method does not raise MemoryException.

      Parameters:
      mem - virtual memory
      address - memory address
      Returns:
      string, or null

    • readNullTerminatedString

      public static String readNullTerminatedString(IVirtualMemory mem, long address, int maxSize)
      Read a null-terminated string from memory. A UTF-8 encoding is used.

      This method does not raise MemoryException.

      Parameters:
      mem - virtual memory
      address - memory address
      maxSize - maximum number of bytes to read
      Returns:
      string, or null

    • readNullTerminatedString

      public static String readNullTerminatedString(IVirtualMemory mem, long address, int maxSize, String encoding)
      Read a null-terminated string from memory.

      This method does not raise MemoryException.

      Parameters:
      mem - virtual memory
      address - memory address
      maxSize - maximum count of bytes; use a negative value for int-max (~2Gb)
      encoding - null for the default UTF8, else, a valid encoding
      Returns:
      string, or null

    • readNullTerminatedStringSafe

      @Deprecated public static String readNullTerminatedStringSafe(IVirtualMemory mem, long address, int maxSize)
      Deprecated.
      this method is deprecated. Prefer a flavor of readNullTerminatedString instead.
      Read from memory a series of ASCII characters, terminated by a null byte, and build the corresponding String. If no null-byte is found, the search stops at the provided maxSize.

      This method does not raise MemoryException.

      Parameters:
      mem - a VM
      address - memory address
      maxSize - maximum string length in ascii characters
      Returns:
      the string or null if a failure happened (e.g. string is too long, memory error occurred, etc.)

    • writeNullTerminatedBytes

      public static boolean writeNullTerminatedBytes(IVirtualMemory mem, long address, int maxSize, byte[] bytes)
      Write a sequence of bytes to memory. The sequence is appended by a null byte. If the sequence is too long, it is truncated to (maxSize-1) bytes to allow the appending of a null terminator.

      This method does not raise MemoryException.

      Parameters:
      mem - virtual memory
      address - destination address
      maxSize - the maximum amount of bytes to write, including the added null terminator (must be strictly positive)
      bytes - the string bytes (usually resulting from the ascii or utf8 encoding of the string to be written to memory)
      Returns:
      success indicator

    • writeStringField

      public static boolean writeStringField(IVirtualMemory mem, long objBaseAddress, IStructureType structType, String fieldName, String value)
      Write the string field of a structure object to memory. The encoding used is UTF-8. A null terminator is appended. The string is truncated to fit within the field, including the null terminator.

      This method does not raise MemoryException.

      Parameters:
      mem - virtual memory
      objBaseAddress - base address of the object
      structType - structure type
      fieldName - field name
      value - string value for the field
      Returns:
      success indicator

    • findByte

      public static long findByte(IVirtualMemory mem, long address, long lastAddress, int val)
      Search for a single byte of memory. Similar as memchr or memrchr (if lastAddress is less than address).
      Parameters:
      mem - virtual memory
      address - start address
      lastAddress - last address
      val - byte value
      Returns:
      matching address, or -1

    • findBytes

      public static long findBytes(IVirtualMemory mem, boolean bypassProtection, long address, long lastAddress, byte[] pattern, byte[] patternMask)
      Search for bytes in memory, with an optional binary mask. The search can either be forward (default), in which case the resulting found address will be either -1 or ≥ the start address, or backward, in which case the resulting found address will be either -1 or ≤ the start address.
      Parameters:
      mem - memory to be searched
      bypassProtection - if true, memory page protection is disregarded, in which case all pages, including non-readable ones, will be searched
      address - start address for the search (this value is treated as unsigned)
      lastAddress - end address (the value is treated as unsigned); may be less than the start address, in which case a reverse search will be performed
      pattern - bytes to search for; the maximum allowed length is the memory's page size
      patternMask - optional binary mask for a wildcard search; if non-null, must be the same length as the pattern's
      Returns:
      -1 if not found, else, the resulting address

    • readAsLongSafe

      public static Long readAsLongSafe(IVirtualMemory mem, long address, int size)
      Read an integer (byte, short, int or long) and converts it to Long. Standard memory byte ordering is used for decoding. Memory protection is disregarded.
      Parameters:
      mem - the virtual memory
      address - memory address of the data
      size - any of 1, 2, 4, or 8
      Returns:
      the long value or null on error

    • readAsLongSafe

      public static Long readAsLongSafe(IVirtualMemory mem, Endianness endianness, long address, int size)
      Read an integer and convert it to Long using the provided endianness.
      Parameters:
      mem - virtual memory
      endianness - endianness
      address - memory address
      size - any of 1, 2, 4, or 8
      Returns:
      long value, or null

    • readAsBigIntegerSafe

      public static BigInteger readAsBigIntegerSafe(IVirtualMemory mem, long address)
      Read an Big Integer (16-bytes). Standard memory byte ordering is used for decoding. Memory protection is disregarded.
      Parameters:
      mem - the virtual memory
      address - memory address of the data
      Returns:
      the Big Integer or null on error

    • readAsBigIntegerSafe

      public static BigInteger readAsBigIntegerSafe(IVirtualMemory mem, Endianness endianness, long address)
      Read a 16-byte integer using the provided endianness.
      Parameters:
      mem - virtual memory
      endianness - endianness
      address - memory address
      Returns:
      big integer value, or null

    • readAsUnsignedLongSafe

      public static Long readAsUnsignedLongSafe(IVirtualMemory mem, long address, int size)
      Read an integer (byte, short, int or long) and zero extend it to Long. Standard memory byte ordering is used for decoding. Note that if a signed long is read, the value may be negative (overflow should be appreciated by caller).
      Parameters:
      mem - the virtual memory
      address - memory address of the data
      size - any of 1, 2, 4, or 8
      Returns:
      the long value or null on error

    • readAsUnsignedLongSafe

      public static Long readAsUnsignedLongSafe(IVirtualMemory mem, Endianness endianness, long address, int size)
      Read an integer and zero-extend it to Long using the provided endianness.
      Parameters:
      mem - virtual memory
      endianness - endianness
      address - memory address
      size - any of 1, 2, 4, or 8
      Returns:
      long value, or null

    • dump

      public static byte[] dump(IVirtualMemory vm, long addr, long addrEnd)
      Dump a contiguous memory range of memory to a byte array. Illegal pages (non-allocated) are dumped as empty pages (all bytes are zero). Memory protection is disregarded.
      Parameters:
      vm - virtual memory
      addr - start address
      addrEnd - end address
      Returns:
      the byte buffer holding the dumped data

    • dump

      public static void dump(IVirtualMemory vm, long addr, long addrEnd, byte[] dst, int dstOffset)
      Dump a contiguous memory range of memory to a buffer. Illegal pages (non-allocated) are dumped as empty pages (all bytes are zero). Memory protection is disregarded.
      Parameters:
      vm - virtual memory
      addr - start address
      addrEnd - end address
      dst - destination buffer
      dstOffset - offset in the destination

    • dumpToImageFiles

      public static void dumpToImageFiles(IVirtualMemory vm, File folder) throws IOException
      Dump a virtual memory to files in a folder. The files will be named as the start of the memory range (in hex) they contain. Memory protection is disregarded.
      Parameters:
      vm - virtual memory
      folder - destination folder; if it does not exist, a new folder will be created
      Throws:
      IOException - if dumping fails

    • dumpToImageFiles

      public static void dumpToImageFiles(IVirtualMemory vm, File folder, String pfx, String sfx) throws IOException
      Dump a virtual memory to files in a folder. The files will be named [PREFIX][MEMORY_RANGE_START][SUFFIX]. Memory protection is disregarded.
      Parameters:
      vm - virtual memory
      folder - destination folder; if it does not exist, a new folder will be created
      pfx - optional prefix for the filenames
      sfx - optional suffix for the filenames
      Throws:
      IOException - if dumping fails