Skip to content

Instantly share code, notes, and snippets.

@yannayl
Last active January 20, 2019 07:23
Show Gist options
  • Save yannayl/175573e920fc739575ed7e31415a07f3 to your computer and use it in GitHub Desktop.
Save yannayl/175573e920fc739575ed7e31415a07f3 to your computer and use it in GitHub Desktop.
Populates the RAM and adds references according to a memory dump
import sark
import construct as ct
import ida_xref
## I have dumped the memory content to ram.bin
dump = open("ram.bin", "rb").read()
ram = sark.Segment(name='RAM')
## memoizing can make it more efficient but IDC
def in_segs(ea, segs):
return any([seg.startEA <= ea < seg.endEA for seg in segs])
for l in ram.lines:
off = l.ea - ram.startEA
## 'swapped=True' means Little Endian
val = ct.BytesInteger(l.size, swapped=True).parse(dump[off:])
l.comments.regular = hex(val)
if not in_segs(val, sark.segments()): continue
ida_xref.add_dref(l.ea, val, 0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment