Package: haystack-reverse
python-haystack-reverse memory forensics########################################|travis| |coverage| |landscape| |pypi|Quick Start:============`Haystack-reverse CLI <docs/Haystack_reverse_CLI.ipynb>`_ in the docs/ folder.Introduction:=============python-haystack-reverse is extension of `python-haystack <https://github.com/trolldbois/python-haystack>`_ focused onreversing memory structure in allocated memory.It aims at helping an analyst in reverse engineering the memory records types present in a process heap.It focuses on reconstruction, classification of classic C structures from memory.It attempts to recreate types definition.Scripts & Entry Points:=======================A few entry points exists to handle the format your memory dump.Memory dump folder produced by ``haystack-live-dump`` from the haystack package-------------------------------------------------------------------------------- ``haystack-reverse`` reverse CLI - reverse all allocation chunks- ``haystack-reverse-show`` show the reversed record at a specific address- ``haystack-reverse-hex`` show a specific record hex bytes at a specific address- ``haystack-reverse-parents`` show the records pointing to the allocated record at a specific addressMemory dump file produced by a Minidump tool--------------------------------------------- ``haystack-minidump-reverse`` reverse CLI - reverse all allocation chunks- ``haystack-minidump-reverse-show`` show the reversed record at a specific address- ``haystack-minidump-reverse-hex`` show a specific record hex bytes at a specific address- ``haystack-minidump-reverse-parents`` show the records pointing to the allocated record at a specific addressHow to get a memory dump:=========================See `python-haystack <https://github.com/trolldbois/python-haystack>`_ or use Sysinternals procdump.Heap analysis / forensics:==========================Quick info:- The ``haystack-xxx-reverse`` family of entry points parse the heap for allocator structures,pointers values, small integers and text (ascii/utf).Given all the previous information, it can extract instances and helps youin classifying and defining structures types.IPython notebook usage guide:- `Haystack-reverse CLI <docs/Haystack_reverse_CLI.ipynb>`_ in the docs/ folder.Command line example:--------------------_The first step is to launch the analysis process with the ``haystack-xxx-reverse`` entry point.This will create several files in the ``cache/`` folder in the memory dump folder:.. code-block:: bash$ haystack-reverse haystack/test/src/test-ctypes6.64.dump$ ls -l haystack/test/src/test-ctypes6.64.dump/cache$ ls -l haystack/test/src/test-ctypes6.64.dump/cache/structsThis will create a few files. The most interesting one being the ``<yourdumpfolder>/cache/xxxxx.headers_values.py`` thatgives you an ctypes listing of all found structures, with guesstimateson fields types.A ``<yourdumpfolder>/cache/graph.gexf`` file is also produced to help you visualizeinstances links. It gets messy for any kind of serious application.- ``*.headers_values.py`` contains the list of heuristicly reversed record types.- ``*.strings`` contains the list of heuristicly typed strings field in reversed record.Other Entry points for reversing:---------------------------------- ``haystack-reverse-show`` show a specific record at a specific address- ``haystack-reverse-hex`` show a specific record hex bytes at a specific address- ``haystack-reverse-parents`` show the records pointing to the allocated record at a specific address- ``haystack-minidump-reverse-show`` show a specific record at a specific address- ``haystack-minidump-reverse-hex`` show a specific record hex bytes at a specific address- ``haystack-minidump-reverse-parents`` show the records pointing to the allocated record at a specific addressDependencies:-------------- haystack- python-numpy- python-networkx- python-levenshtein- several others..... |pypi| image:: https://img.shields.io/pypi/v/haystack-reverse.svg?style=flat-square&label=latest%20stable%20version:target: https://pypi.python.org/pypi/haystack-reverse:alt: Latest version released on PyPi.. |coverage| image:: https://img.shields.io/coveralls/trolldbois/python-haystack-reverse/master.svg?style=flat-square&label=coverage:target: https://coveralls.io/github/trolldbois/python-haystack-reverse?branch=master:alt: Test coverage.. |travis| image:: https://img.shields.io/travis/trolldbois/python-haystack-reverse/master.svg?style=flat-square&label=travis-ci:target: http://travis-ci.org/trolldbois/python-haystack-reverse:alt: Build status of the master branch on Mac/Linux.. |landscape| image:: https://landscape.io/github/trolldbois/python-haystack-reverse/master/landscape.svg?style=flat:target: https://landscape.io/github/trolldbois/python-haystack-reverse/master:alt: Code Health