ramdump is here

7 files changed, 48 insertions, 44 deletions

diff --git a/bruiser/CompletionHints.cpp b/bruiser/CompletionHints.cpp
index 0afe094..d7a6dbb 100644
--- a/bruiser/CompletionHints.cpp
+++ b/bruiser/CompletionHints.cpp
@@ -25,25 +25,14 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*
 /*standard headers*/
 #include <iostream>
 #include <string>
-/*LLVM headers*/
 /*other*/
 #include "linenoise/linenoise.h"
 /**********************************************************************************************************************/
-/*used namespaces*/
-/**********************************************************************************************************************/
-/*macros*/
-
-/**********************************************************************************************************************/
-namespace bruiser
-{
-  void ShellCompletion(const char* __buf, linenoiseCompletions* __lc)
-  {
-    if (__buf != NULL)
-    {
-      for(auto &iter : LUA_FUNCS)
-      {
-        if (iter.find(__buf) == 0U)
-        {
+namespace bruiser {
+  void ShellCompletion(const char* __buf, linenoiseCompletions* __lc) {
+    if (__buf != NULL) {
+      for(auto &iter : LUA_FUNCS) {
+        if (iter.find(__buf) != std::string::npos) {
           linenoiseAddCompletion(__lc, iter.c_str());
         }
       }
@@ -52,19 +41,13 @@ namespace bruiser
 
   char* ShellHints(const char* __buf, int* __color, int* __bold)
   {
-    if (__buf != NULL)
-    {
+    if (__buf != NULL) {
       auto dummy = std::string(__buf);
 
-      for(auto &iter : LUA_FUNCS)
-      {
-        if (dummy == "")
-        {
-          break;
-        }
+      for(auto &iter : LUA_FUNCS) {
+        if (dummy == "") break;
 
-        if (iter.find(__buf) == 0U)
-        {
+        if (iter.find(__buf) != std::string::npos) {
           *__color = 35;
           *__bold = 1;
           int sizet = dummy.length();
diff --git a/bruiser/bruiser-extra.h b/bruiser/bruiser-extra.h
index 58ff8e9..4e7ce11 100644
--- a/bruiser/bruiser-extra.h
+++ b/bruiser/bruiser-extra.h
@@ -134,6 +134,7 @@ std::vector<std::string> LUA_FUNCS =
   "getjmptable(",
   "freejmptable(",
   "dumpjmptable(",
+  "ramdump(",
   "_G",
   "_VERSION",
   "assert",
diff --git a/bruiser/bruiser.cpp b/bruiser/bruiser.cpp
index a18b48d..d6cf165 100644
--- a/bruiser/bruiser.cpp
+++ b/bruiser/bruiser.cpp
@@ -30,6 +30,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*
 #include "bruiserffi.h"
 #include "bruisercapstone.h"
 #include "asmrewriter.h"
+#include "ramdump.h"
 /*standard headers*/
 #include <exception>
 #include <fstream>
@@ -1692,8 +1693,13 @@ class LuaWrapper
 
     int BruiserRamDump(lua_State* __ls) {
       int numargs = lua_gettop(__ls);
-      if (numargs != 1) {PRINT_WITH_COLOR_LB(RED, "expected exactly one argument of type int.");}
-
+      if (numargs != 2) {PRINT_WITH_COLOR_LB(RED, "expected exactly two argument of type int.");}
+      int pid = lua_tointeger(__ls, 1);
+      std::string dumpname = lua_tostring(__ls, 2);
+      FILE* out_file = fopen(dumpname.c_str(), "w");
+      dump_ram(pid, out_file);
+      fclose(out_file);
+      return 0;
     }
 
     /*read the m0 report*/
@@ -2317,6 +2323,7 @@ int main(int argc, const char **argv) {
     lua_register(LE.GetLuaState(), "getjmptable", &LuaDispatch<&LuaWrapper::BruiserGetJumpTable>);
     lua_register(LE.GetLuaState(), "freejmptable", &LuaDispatch<&LuaWrapper::BruiserFreeJumpTable>);
     lua_register(LE.GetLuaState(), "dumpjmptable", &LuaDispatch<&LuaWrapper::BruiserDumpJumpTable>);
+    lua_register(LE.GetLuaState(), "ramdump", &LuaDispatch<&LuaWrapper::BruiserRamDump>);
     /*its just regisering the List function from LuaWrapper with X-macros.*/
 #define X(__x1, __x2) lua_register(LE.GetLuaState(), #__x1, &LuaDispatch<&LuaWrapper::List##__x1>);
 
diff --git a/bruiser/bruiser.h b/bruiser/bruiser.h
index b20d08f..943bfba 100644
--- a/bruiser/bruiser.h
+++ b/bruiser/bruiser.h
@@ -160,7 +160,8 @@ help CMDHelp[] = {
   {"xallocallglobals", "xallocallglobals()", "allocate all globals", "", ""},
   {"getjmptable", "getjmptable(size, code)", "get a table of all jumps", "", "returns a pointer to the head of the jump table linked-list as lightuserdata"},
   {"freejmptable", "freejmptable(head)", "free the jmp table linked-list", "", "nothing"},
-  {"dumpjmptable", "dumpjmptable(head)", "dumps the jmp table linked-list", "", "nothing"}
+  {"dumpjmptable", "dumpjmptable(head)", "dumps the jmp table linked-list", "", "nothing"},
+  {"ramdump", "ramdump(pid)", "dumps the ram", "", "ram contents"}
 };
 /**********************************************************************************************************************/
 /**
diff --git a/bruiser/makefile b/bruiser/makefile
index 60c90c6..c97a45e 100644
--- a/bruiser/makefile
+++ b/bruiser/makefile
@@ -52,7 +52,7 @@ $(LIB_LUA_JIT):
 	$(MAKE) -C LuaJIT
 	@echo "building with jit"
 
-$(BRUISER): $(BRUISER).o ../mutator_aux.o ../tinyxml2/tinyxml2.o linenoise.o CompletionHints.o mutagen.o ORCmutation.o bruiserffi.o asmrewriter.o bruisercapstone.o $(LIB_LUA)
+$(BRUISER): $(BRUISER).o ../mutator_aux.o ../tinyxml2/tinyxml2.o linenoise.o CompletionHints.o mutagen.o ORCmutation.o bruiserffi.o asmrewriter.o bruisercapstone.o ramdump.o $(LIB_LUA)
 	$(CXX) $^ $(LD_FLAGS) -o $@
 
 clean:
diff --git a/bruiser/ramdump.c b/bruiser/ramdump.c
index e481583..d06d3bc 100644
--- a/bruiser/ramdump.c
+++ b/bruiser/ramdump.c
@@ -18,6 +18,7 @@ You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*/
 /***********************************************************************************************************/
+//#include "ramdump.h"
 #include <inttypes.h>
 #include <limits.h>
 #include <stdio.h>
@@ -27,24 +28,23 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*
 #include <sys/wait.h>
 #include <unistd.h>
 /***********************************************************************************************************/
-FILE* dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length) {
-  FILE* out_file;
+void dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length, FILE* out_file) {
   uint64_t address;
   int pageLength = 4096;
-  unsigned char page[pageLength];
   fseeko(pMemFile, start_address, SEEK_SET);
+  unsigned char page[pageLength];
 
   for (address=start_address; address < start_address + length; address += pageLength) {
     fread(&page, 1, pageLength, pMemFile);
-      fwrite(&page, 1, pageLength, out_file);
+    fwrite(&page, 1, pageLength, out_file);
   }
 }
 
-FILE* dump_ram(unsigned int pid) {
-  long ptraceResult = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
+void dump_ram(unsigned int pid, FILE* out_file) {
+  uint64_t ptraceResult = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
   if (ptraceResult < 0) {
     printf("ramdump: unable to attach to the pid specified\n");
-    return NULL;
+    return;
   }
   wait(NULL);
 
@@ -57,12 +57,11 @@ FILE* dump_ram(unsigned int pid) {
   sprintf(memFilename, "/proc/%s/mem", proc_str);
   FILE* pMemFile = fopen(memFilename, "r");
   char line[256];
-  FILE* out_file;
   while (fgets(line, 256, pMapsFile) != NULL) {
     uint64_t start_address;
     uint64_t end_address;
     sscanf(line, "%08lx-%08lx\n", &start_address, &end_address);
-    dump_memory_region(pMemFile, start_address, end_address - start_address);
+    dump_memory_region(pMemFile, start_address, end_address - start_address, out_file);
   }
 
   fclose(pMapsFile);
@@ -70,17 +69,19 @@ FILE* dump_ram(unsigned int pid) {
 
   ptrace(PTRACE_CONT, pid, NULL, NULL);
   ptrace(PTRACE_DETACH, pid, NULL, NULL);
-  return out_file;
 }
 
 #pragma weak main
 int main(int argc, char **argv) {
   if (argc != 2) {
-    printf("you were supposed to type in the int value");
+    printf("what happened to the pid?\n");
     return 1;
   }
+  FILE* out_file = fopen("/tmp/ramdump", "w");
   int pid = atoi(argv[1]);
-  FILE* out_file = dump_ram(pid);
+  dump_ram(pid, out_file);
+  fclose(out_file);
+  return 0;
 }
 /***********************************************************************************************************/
 /*last line is intentionally left blank*/
diff --git a/bruiser/ramdump.h b/bruiser/ramdump.h
index fc60cd3..d7ce8b4 100644
--- a/bruiser/ramdump.h
+++ b/bruiser/ramdump.h
@@ -18,8 +18,19 @@ You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*/
 /***********************************************************************************************************/
-FILE* dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length);
-FILE* dump_ram(unsigned int pid);
+#ifndef RAMDUMP_H
+#define RAMDUMP_H
+#include <inttypes.h>
+#include <stdio.h>
+#ifdef __cplusplus
+extern "C" {
+#endif
+void dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length);
+void dump_ram(unsigned int pid, FILE* out_file);
+#ifdef __cplusplus
+}
+#endif
+#endif
 /***************************************************Project Mutator****************************************************/
 /*last line intentionally left blank.*/