0vercl0k/kdmp-parserWindows 커널 덤프 C++ 파서 라이브러리로, Python 3 바인딩을 포함합니다.
이 C++ 라이브러리는 Windows 커널 full 덤프(WinDbg의 .dump /f), BMP 덤프(WinDbg의 .dump /ka) 및 ~2022년에 도입된 더 최신 덤프 유형을 파싱합니다.
이 라이브러리는 64비트 덤프 로드를 지원하며 다음과 같은 항목에 대한 읽기 액세스를 제공합니다:
컴파일된 바이너리는 릴리스 섹션에서 제공됩니다.
특별히 감사드립니다:
parser.exe 애플리케이션은 덤프 파일에 대한 다양한 정보(예외 레코드, 컨텍스트 레코드 등)를 덤프할 수 있습니다.
>parser.exe -c -e -p 0x1000 full.dmp
--------------------------------------------------------------------------------
Context Record:
rax=0000000000000003 rbx=fffff8050f4e9f70 rcx=0000000000000001
rdx=fffff805135684d0 rsi=0000000000000100 rdi=fffff8050f4e9f80
rip=fffff805108776a0 rsp=fffff805135684f8 rbp=fffff80513568600
r8=0000000000000003 r9=fffff805135684b8 r10=0000000000000000
r11=ffffa8848825e000 r12=fffff8050f4e9f80 r13=fffff80510c3c958
r14=0000000000000000 r15=0000000000000052
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040202
fpcw=0000 fpsw=0000 fptw=0001
st0=fffff80510bbf000fffff80510c3c9c0 st1=0005e5a800ab2000fffff805106b3000
st2=4000000000200000fffff80510beaea8 st3=000000000a0d656c69666f7250206465
st4=0000000a0d656c69666f725000000010 st5=0000000000000000fffff80510b16900
st6=0000000000000000fffff805133e9000 st7=fffff47c02899f480000000000000000
xmm0=000000000a0d656c69666f7250206465 xmm1=0000000a0d656c69666f725000000010
xmm2=0000000000000000fffff80510b16900 xmm3=0000000000000000fffff805133e9000
xmm4=fffff47c02899f480000000000000000 xmm5=00000000000000000000000000000000
xmm6=00000000000000000000000000000000 xmm7=00000000000000000000000000000000
xmm8=00000000000000000000000000000000 xmm9=00000000000000000000000000000000
xmm10=00000000000000000000000000000000 xmm11=00000000000000000000000000000000
xmm12=00000000000000000000000000000000 xmm13=00000000000000000000000000000000
xmm14=00000000000000000000000000000000 xmm15=00000000000000000000000000000000
--------------------------------------------------------------------------------
Exception Record:
KDMP_PARSER_EXCEPTION_RECORD64
+0x0000: ExceptionCode : 0x80000003.
+0x0004: ExceptionFlags : 0x00000000.
+0x0008: ExceptionRecord : 0x0000000000000000.
+0x0010: ExceptionAddress : 0xfffff805108776a0.
+0x0018: NumberParameters : 0x00000001.
+0x0020: ExceptionInformation[0] : 0x0000000000000000.
+0x0028: ExceptionInformation[1] : 0x0000000000000000.
+0x0030: ExceptionInformation[2] : 0xffffa8848825e000.
+0x0038: ExceptionInformation[3] : 0x00000000000002c0.
+0x0040: ExceptionInformation[4] : 0xfffff80511022203.
+0x0048: ExceptionInformation[5] : 0x0000000000004280.
+0x0050: ExceptionInformation[6] : 0xfffff80510880524.
+0x0058: ExceptionInformation[7] : 0xffffa88488282360.
+0x0060: ExceptionInformation[8] : 0x0000000000000280.
+0x0068: ExceptionInformation[9] : 0xfffff805135683d8.
+0x0070: ExceptionInformation[10] : 0xffffa8848d9d6fb0.
+0x0078: ExceptionInformation[11] : 0x0000000000004280.
+0x0080: ExceptionInformation[12] : 0x00001f8001004280.
+0x0088: ExceptionInformation[13] : 0x0000000000000003.
+0x0090: ExceptionInformation[14] : 0xfffff80513568578.
--------------------------------------------------------------------------------
Physical memory:
00001000: 00 00 00 00 00 00 00 00 00 00 f9 ff 00 00 00 00 |................|
00001010: 00 06 01 01 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000010a0: 00 00 00 00 00 00 00 00 00 a0 87 00 00 00 00 00 |................|
000010b0: ff ff ff ff ff ff ff ff 00 00 60 11 05 f8 ff ff |..........`.....|
000010c0: 00 90 2f 00 00 00 00 00 ff ff ff ff 03 80 ff ff |../.............|
000010d0: f8 00 00 c0 c1 f7 ff ff 00 00 00 00 03 00 00 00 |................|
000010e0: f8 00 00 c0 c1 f7 ff ff 00 00 00 00 03 00 00 00 |................|
000010f0: 00 00 00 00 00 00 00 00 70 37 01 c0 c1 f7 ff ff |........p7......|
...
CMake를 사용하여 직접 빌드할 수 있으며, Microsoft, LLVM Clang 및 GNU 컴파일러를 사용하여 Linux, Windows, OSX에서 빌드됩니다.
다음은 Windows에서의 예시입니다:
> mkdir build
> cd build
> cmake ..
-- Building for: Visual Studio 17 2022
...
> cmake --build . --config RelWithDebInfo
MSBuild version 17.8.3+195e7f5a3 for .NET Framework
...
> src\parser\RelWithDebInfo\parser.exe
You didn't provide the path to the dump file.
parser.exe [-p [<physical address>]] [-c] [-e] [-h] <kdump path>
Examples:
Show every structures of the dump:
parser.exe -a full.dmp
Show the context record:
parser.exe -c full.dmp
Show the exception record:
parser.exe -e full.dmp
Show all the physical memory (first 16 bytes of every pages):
parser.exe -p full.dmp
Show the context record as well as the page at physical address 0x1000:
parser.exe -c -p 0x1000 full.dmp
다음은 Linux에서의 또 다른 예시입니다(Python 바인딩 포함):
$ mkdir build
$ cd build
$ cmake .. -DBUILD_PYTHON_BINDING=ON
...
$ cmake --build . --config RelWithDebInfo
...
$ ./src/parser/parser
You didn't provide the path to the dump file.
parser.exe [-p [<physical address>]] [-c] [-e] [-h] <kdump path>
Examples:
Show every structures of the dump:
parser.exe -a full.dmp
Show the context record:
parser.exe -c full.dmp
Show the exception record:
parser.exe -e full.dmp
Show all the physical memory (first 16 bytes of every pages):
parser.exe -p full.dmp
Show the context record as well as the page at physical address 0x1000:
parser.exe -c -p 0x1000 full.dmp
가장 쉬운 방법은 다음과 같습니다:
pip install kdmp_parser
CMake 및 Python 3.8+ / pip를 설치한 후 다음을 실행하세요:
cd src/python
pip install requirements.txt
pip install .
wheel 패키지를 만들려면:
cd src/python
pip wheel .
import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
assert dmp.type == kdmp_parser.DumpType.FullDump
print(f"Dump RIP={dmp.context.Rip:#x}")
import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
dmp.read_virtual_page(dmp.context.Rip)
import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
pml4 = dmp.directory_table_base
print(f"{pml4=:#x}")
dmp.read_physical_page(pml4)
import kdmp_parser
dmp = kdmp_parser.KernelDumpParser("full.dmp")
VA = dmp.context.Rip
PA = dmp.translate_virtual(VA)
print(f"{VA=:#x} -> {PA=:#x}")