1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
import os,sys,struct
sys.path.insert(0,os.path.join(os.path.dirname(__file__),".."));sys.path.insert(0,os.path.dirname(__file__))
import fuzz_sysdrv as F
f=F.SysDrvFuzzer(seed=1); c=f.c
LO,HI=0xea4fbc,0xeb7000 # table .. end of mapped SYS_DRV data (fault boundary seen earlier)
data=c.read(LO,HI-LO)
# scan for code-pointer dwords (SYS_DRV text 0xe00100..0xe27790, or tlapi 0xf00xxx)
print("scanning [%#x,%#x) for code pointers (0xe001xx..0xe277xx or 0xf00xxx):"%(LO,HI))
n=0
for off in range(0,len(data)-3,4):
v=struct.unpack_from('<I',data,off)[0]
if (0xe00100<=v<0xe27790) or (0xf00000<=v<0xf01000):
print(" @%#x = %#x"%(LO+off,v)); n+=1
if n>60: print(" ...(more)"); break
print("total code-pointer dwords in reachable range:",n)
|
