find_first param for search

Author: skelsec

minidump/_version.py

@@ -1,5 +1,5 @@
 
-__version__ = "0.0.14"
+__version__ = "0.0.15"
 __banner__ = \
 """
 # minidump %s 

minidump/aminidumpreader.py

@@ -226,8 +226,8 @@ async def get_ptr_with_offset(self, pos):
 			await self.move(pos)
 			return await self.read_uint()
 
-	async def find_in_module(self, module_name, pattern):
-		t = await self.reader.search_module(module_name, pattern)
+	async def find_in_module(self, module_name, pattern, find_first = False, reverse_order = False):
+		t = await self.reader.search_module(module_name, pattern, find_first = find_first, reverse_order = reverse_order)
 		return t
 
 
@@ -271,18 +271,20 @@ def get_module_by_name(self, module_name):
 				return mod
 		return None
 
-	async def search_module(self, module_name, pattern):
+	async def search_module(self, module_name, pattern, find_first = False, reverse_order = False):
 		mod = self.get_module_by_name(module_name)
 		if mod is None:
 			raise Exception('Could not find module! %s' % module_name)
-		t = []
+		needles = []
 		for ms in self.memory_segments:
 			if mod.baseaddress <= ms.start_virtual_address < mod.endaddress:
-				t += await ms.asearch(pattern, self.file_handle)
+				needles += await ms.asearch(pattern, self.file_handle, find_first = find_first)
+				if len(needles) > 0 and find_first is True:
+					return needles
 
-		return t
+		return needles
 
-	async def search(self, pattern):
+	async def search(self, pattern, find_first = False):
 		t = []
 		for ms in self.memory_segments:
 			t += await ms.asearch(pattern, self.file_handle)

minidump/common_structs.py

@@ -155,7 +155,7 @@ async def aread(self, virtual_address, size, file_handler):
 		await file_handler.seek(pos, 0)
 		return data
 
-	def search(self, pattern, file_handler):
+	def search(self, pattern, file_handler, find_first = False):
 		if len(pattern) > self.size:
 			return []
 		pos = file_handler.tell()
@@ -171,10 +171,12 @@ def search(self, pattern, file_handler):
 			fl.append(marker + offset + self.start_virtual_address)
 			data = data[marker+1:]
 			offset = marker + 1
+			if find_first is True:
+				return fl
 
 		return fl
 
-	async def asearch(self, pattern, file_handler):
+	async def asearch(self, pattern, file_handler, find_first = False):
 		if len(pattern) > self.size:
 			return []
 		pos = file_handler.tell()
@@ -190,6 +192,8 @@ async def asearch(self, pattern, file_handler):
 			fl.append(marker + offset + self.start_virtual_address)
 			data = data[marker+1:]
 			offset = marker + 1
+			if find_first is True:
+				return fl
 
 		return fl
 

minidump/minidumpreader.py

@@ -216,8 +216,8 @@ def get_ptr_with_offset(self, pos):
 			self.move(pos)
 			return self.read_uint()
 
-	def find_in_module(self, module_name, pattern):
-		t = self.reader.search_module(module_name, pattern)
+	def find_in_module(self, module_name, pattern, find_first = False, reverse_order = False):
+		t = self.reader.search_module(module_name, pattern, find_first = find_first, reverse_order = reverse_order)
 		return t
 
 
@@ -261,21 +261,25 @@ def get_module_by_name(self, module_name):
 				return mod
 		return None
 
-	def search_module(self, module_name, pattern):
+	def search_module(self, module_name, pattern, find_first = False, reverse_order = False):
 		mod = self.get_module_by_name(module_name)
 		if mod is None:
 			raise Exception('Could not find module! %s' % module_name)
-		t = []
+		
+		needles = []
 		for ms in self.memory_segments:
 			if mod.baseaddress <= ms.start_virtual_address < mod.endaddress:
-				t+= ms.search(pattern, self.file_handle)
+				needles+= ms.search(pattern, self.file_handle, find_first = find_first)
+				if len(needles) > 0 and find_first is True:
+					return needles
 
-		return t
 
-	def search(self, pattern):
+		return needles
+
+	def search(self, pattern, find_first = False):
 		t = []
 		for ms in self.memory_segments:
-			t+= ms.search(pattern, self.file_handle)
+			t+= ms.search(pattern, self.file_handle, find_first = find_first)
 
 		return t