---

memgrep.h

#ifndef _MEMGREP_H
#define _MEMGREP_H

#include <elf.h>

#define MEMGREP_CMD_INITIALIZE      0x00000001 

#define MEMGREP_CMD_DEINITIALIZE    0x00000002

#define MEMGREP_CMD_SET             0x00000003

#define MEMGREP_CMD_GET             0x00000004

#define MEMGREP_CMD_POPULATE        0x00000005

#define MEMGREP_CMD_SEARCH          0x00000006

#define MEMGREP_CMD_REPLACE         0x00000007

#define MEMGREP_CMD_SEARCHREPLACE   0x00000008

#define MEMGREP_CMD_DUMP            0x00000009

#define MEMGREP_CMD_LISTSEGMENTS    0x0000000A

#define MEMGREP_CMD_DESTROYRESULT   0x0000000B

#define MEMGREP_CMD_HEAPENUMERATE   0x0000000C

#define MEMGREP_PARAM_FLAGS         0x00000001

#define MEMGREP_PARAM_LENGTH        0x00000002

#define MEMGREP_PARAM_PADDING       0x00000003

#define MEMGREP_PARAM_DUMPFORMAT    0x00000004

#define MEMGREP_RESULT_TYPE_SEARCH  0x00000001

#define MEMGREP_RESULT_TYPE_REPLACE 0x00000002

#define MEMGREP_RESULT_TYPE_DUMP    0x00000003

#define MEMGREP_RESULT_TYPE_HEAP    0x00000004

#define MEMGREP_FLAG_VERBOSE        (1 << 0)

#define MEMGREP_FLAG_PROMPT         (1 << 1)

#define MEMGREP_FLAG_DUMPCLEAN      (1 << 2)

enum MemoryMedium {
        MEMORY_MEDIUM_UNKNOWN = 0,
        MEMORY_MEDIUM_PID     = 1,
        MEMORY_MEDIUM_CORE    = 2
};

enum MemoryDumpFormat {
        MEMORY_DUMP_FORMAT_HEXINT   = 0,
        MEMORY_DUMP_FORMAT_HEXSHORT = 1,
        MEMORY_DUMP_FORMAT_HEXBYTE  = 2,
        MEMORY_DUMP_FORMAT_DECINT   = 3,
        MEMORY_DUMP_FORMAT_DECSHORT = 4,
        MEMORY_DUMP_FORMAT_DECBYTE  = 5,
        MEMORY_DUMP_FORMAT_PRINTABLE = 6,
};

typedef struct _process_section_addrs {

        unsigned long text;
        unsigned long textLength;
        unsigned long rodata;
        unsigned long rodataLength;
        unsigned long data;
        unsigned long dataLength;
        unsigned long bss;

        unsigned long stack;

} PROCESS_SECTION_ADDRS;

typedef struct _core_memory_sections {

        unsigned long vma;
        unsigned long length;

        unsigned long rma;

} CORE_MEMORY_SECTIONS;

typedef struct _mem_ctx_core_data {

        int                  fd;

        Elf32_Ehdr           elfHeader;
        Elf32_Phdr           *programHeaders;

        CORE_MEMORY_SECTIONS *sections;
        unsigned long        numSections;

} MEM_CTX_CORE_DATA;

struct _mem_ctx;

typedef struct _memgrep_functions {

        unsigned long  (*open)(struct _mem_ctx *ctx);
        unsigned long  (*close)(struct _mem_ctx *ctx);

        unsigned long  (*getSections)(struct _mem_ctx *ctx);
        unsigned char *(*get)(struct _mem_ctx *ctx, unsigned long addr, unsigned long length);
        unsigned long  (*put)(struct _mem_ctx *ctx, unsigned long addr, unsigned char *buf, unsigned long bufLength);
        unsigned long  (*populateKeyword)(struct _mem_ctx *ctx, const char *keyword);
        unsigned long  (*listSegments)(struct _mem_ctx *ctx);

        unsigned long  (*heapEnumerate)(struct _mem_ctx *ctx, unsigned long current, unsigned long *addr, unsigned long *size);

} MEMGREP_FUNCTIONS;

typedef struct _memgrep_result_row {

        unsigned long length;
        unsigned long type;

} MEMGREP_RESULT_ROW;

typedef struct _memgrep_result {

        unsigned long      error;

        unsigned long      numRows;
        MEMGREP_RESULT_ROW **rows;

} MEMGREP_RESULT;

typedef struct _memgrep_result_row_search {

        MEMGREP_RESULT_ROW base;

        unsigned long      addr;

} MEMGREP_RESULT_ROW_SEARCH;

typedef struct _memgrep_result_row_heap {

        MEMGREP_RESULT_ROW base;

        unsigned long      addr;

        unsigned long      size;

} MEMGREP_RESULT_ROW_HEAP;

typedef struct _memgrep_result_row_replace {

        MEMGREP_RESULT_ROW base;

        unsigned long      addr;

} MEMGREP_RESULT_ROW_REPLACE;

typedef struct _memgrep_result_row_dump {

        MEMGREP_RESULT_ROW base;

        unsigned long      addr;
        unsigned char      *buf;
        unsigned long      bufLength;

} MEMGREP_RESULT_ROW_DUMP;

typedef struct _mem_ctx {

        unsigned long         flags;

        enum MemoryMedium     medium;

        int                   pid;
        char                  *core;

        MEMGREP_FUNCTIONS     functions;
        PROCESS_SECTION_ADDRS sections;

        unsigned long         *addrs;
        unsigned long         numAddrs;
        unsigned long         length;
        unsigned long         padding;
        enum MemoryDumpFormat dumpFormat;

        MEM_CTX_CORE_DATA     coreData;


        int procCtlFd;
        int procAsFd;

} MEM_CTX;

unsigned long memgrep(MEM_CTX *ctx, unsigned long cmd, MEMGREP_RESULT *result, unsigned long param, unsigned long data);

/*
 * These functions should not be called directly.
 */

unsigned long memgrep_initialize(MEM_CTX *ctx, enum MemoryMedium medium, void *data); // 1 for success, 0 for failure
unsigned long memgrep_deinitialize(MEM_CTX *ctx); // 1 for success, 0 for failure
unsigned long memgrep_set(MEM_CTX *ctx, unsigned long param, unsigned long data); // 1 for success, 0 for failure
unsigned long memgrep_get(MEM_CTX *ctx, unsigned long param); // the value associated w/ the param
unsigned long memgrep_populate_string(MEM_CTX *ctx, const char *addresses); // number of addresses populated
unsigned long memgrep_populate_array(MEM_CTX *ctx, unsigned long *array, unsigned long elements); // number of addresses populated
unsigned long memgrep_search(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *searchPhrase); // number of addresses found
unsigned long memgrep_replace(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *replacePhrase); // number of addresses replaced
unsigned long memgrep_searchreplace(MEM_CTX *ctx, MEMGREP_RESULT *result, const char *searchPhrase, const char *replacePhrase); // number of addresses search/replaced
unsigned long memgrep_dump(MEM_CTX *ctx, MEMGREP_RESULT *result); // 1 for success, 0 for failure
unsigned long memgrep_listSegments(MEM_CTX *ctx); // 1 for success, 0 for failure
unsigned long memgrep_destroy(MEM_CTX *ctx, MEMGREP_RESULT *result); // Destroy a resultant value, 1 for success 0 for failure
unsigned long memgrep_heapenumerate(MEM_CTX *ctx, MEMGREP_RESULT *result, unsigned long minSize); // 1 for success, 0 for failure

#endif

---