docs/Haystack_reverse_CLI.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Usage reference guide for haystack-reverse\n",
    "\n",
    "this is an example of every haystack-reverse commands.\n",
    "\n",
    "The zeus.vmem.856.dump is there https://dl.dropboxusercontent.com/u/10222931/HAYSTACK/zeus.vmem.856.dump.tgz\n",
    "\n",
    "It was extracted from pid 856 from the zeus.img image from http://malwarecookbook.googlecode.com/svn-history/r26/trunk/17/1/zeus.vmem.zip"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "usage: haystack-reverse [-h] [--debug | --quiet] [--interactive] [--nommap] dump_folder_name\r\n",
      "\r\n",
      "Reverse the data structure from the process memoryThe process dump is a folder produced by a haystack-dump script.\r\n",
      "\r\n",
      "positional arguments:\r\n",
      "  dump_folder_name  Use this memory dump folder\r\n",
      "\r\n",
      "optional arguments:\r\n",
      "  -h, --help        show this help message and exit\r\n",
      "  --debug           Set verbosity to DEBUG\r\n",
      "  --quiet           Set verbosity to ERROR only\r\n",
      "  --interactive     drop to python command line after action\r\n",
      "  --nommap          disable mmap()-ing\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse --help"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "First we need to generate the analysis for the process memory dump."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "INFO:reverse.api:Reversing Fields\n",
      "INFO:model:[+] <FieldReverser>: START\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x1a0000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x350000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x3b0000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x460000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0xc30000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0xd60000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0xe20000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0xe80000\n",
      "INFO:model:[+] <FieldReverser>: START on heap 0x7f6f0000\n",
      "INFO:reverse.api:Fixing Text Fields\n",
      "INFO:model:[+] <TextFieldCorrection>: START\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x90000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x190000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x1a0000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x350000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x3b0000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x460000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0xc30000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0xd60000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0xe20000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0xe80000\n",
      "INFO:model:[+] <TextFieldCorrection>: START on heap 0x7f6f0000\n",
      "INFO:reverse.api:Reversing DoubleLinkedListReverser\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x1a0000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x350000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x3b0000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x460000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0xc30000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0xd60000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0xe20000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0xe80000\n",
      "INFO:model:[+] <DoubleLinkedListReverser>: START on heap 0x7f6f0000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <CommonTypeReverser>: START\n",
      "INFO:model:[+] <CommonTypeReverser>: START on heap 0x90000\n",
      "INFO:reverse.api:Reversing PointerFields\n",
      "INFO:model:[+] <PointerFieldReverser>: START\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x90000\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x190000\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x1a0000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x350000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x3b0000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x460000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0xc30000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0xd60000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0xe20000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0xe80000\n",
      "INFO:model:[+] <PointerFieldReverser>: START on heap 0x7f6f0000\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "INFO:reverse.api:Saving reversed records instances\n",
      "INFO:context:\t[.] saved in 6.64 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.43 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.01 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.02 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.17 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.07 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.08 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.00 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.20 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.12 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:context:\t[.] saved in 0.01 secs\n",
      "INFO:reverse.api:[+] saving headers\n",
      "INFO:reverse.api:Saving reversed records types\n",
      "INFO:reverse.api:Reversing PointerGraph\n",
      "INFO:model:[+] <PointerGraphReverser>: START\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "INFO:reversers:[+] Heap 0x90000 Graph += 2660 Nodes\n",
      "INFO:reversers:[+] Heap 0x90000 Graph += 3814 Edges\n",
      "INFO:reversers:[+] Heap 0x190000 Graph += 139 Nodes\n",
      "INFO:reversers:[+] Heap 0x190000 Graph += 269 Edges\n",
      "INFO:reversers:[+] Heap 0x1a0000 Graph += 0 Nodes\n",
      "INFO:reversers:[+] Heap 0x1a0000 Graph += 0 Edges\n",
      "INFO:reversers:[+] Heap 0x350000 Graph += 1 Nodes\n",
      "INFO:reversers:[+] Heap 0x350000 Graph += 0 Edges\n",
      "INFO:reversers:[+] Heap 0x3b0000 Graph += 2 Nodes\n",
      "INFO:reversers:[+] Heap 0x3b0000 Graph += 1 Edges\n",
      "INFO:reversers:[+] Heap 0x460000 Graph += 1 Nodes\n",
      "INFO:reversers:[+] Heap 0x460000 Graph += 0 Edges\n",
      "INFO:reversers:[+] Heap 0xc30000 Graph += 110 Nodes\n",
      "INFO:reversers:[+] Heap 0xc30000 Graph += 97 Edges\n",
      "INFO:reversers:[+] Heap 0xd60000 Graph += 79 Nodes\n",
      "INFO:reversers:[+] Heap 0xd60000 Graph += 73 Edges\n",
      "INFO:reversers:[+] Heap 0xe20000 Graph += 8 Nodes\n",
      "INFO:reversers:[+] Heap 0xe20000 Graph += 4 Edges\n",
      "INFO:reversers:[+] Heap 0xe80000 Graph += 6 Nodes\n",
      "INFO:reversers:[+] Heap 0xe80000 Graph += 4 Edges\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "WARNING:utils:misuse of closestFloorValue\n",
      "INFO:reversers:[+] Heap 0x7f6f0000 Graph += 95 Nodes\n",
      "INFO:reversers:[+] Heap 0x7f6f0000 Graph += 166 Edges\n",
      "INFO:reversers:[+] Process Graph == 3079 Nodes\n",
      "INFO:reversers:[+] Process Graph == 4428 Edges\n",
      "INFO:reversers:[+] Process Heaps Graph == 2265 Nodes\n",
      "INFO:reversers:[+] Process Heaps Graph == 2462 Edges\n",
      "INFO:reverse.api:Reversing strings\n",
      "INFO:model:[+] <StringsReverser>: START\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x90000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x190000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x1a0000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x350000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x3b0000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x460000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0xc30000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0xd60000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0xe20000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0xe80000\n",
      "INFO:model:[+] <StringsReverser>: START on heap 0x7f6f0000\n",
      "INFO:reverse.api:Analysis results are in /home/other/Compil/python-haystack/test/dumps/vol/zeus.vmem.856.dump/cache\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse ../test/dumps/vol/zeus.vmem.856.dump"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Then we can start to use some of the cli"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 4536\r\n",
      "drwxrwxr-x 3 jal jal    4096 mar 15 17:14 .\r\n",
      "drwxrwxr-x 3 jal jal   20480 jan 20 21:08 ..\r\n",
      "-rw-rw-r-- 1 jal jal     228 mar 15 17:14 190000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal   42545 mar 15 17:14 190000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   97335 mar 15 17:14 190000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal    1088 jan 20 21:08 190000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal    1088 jan 20 21:08 190000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal    1120 jan 20 21:08 190000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal    1120 jan 20 21:08 190000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal    3337 mar 15 17:14 190000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     228 mar 15 17:14 1a0000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal     318 mar 15 17:14 1a0000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 1a0000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 1a0000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 1a0000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 1a0000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     228 mar 15 17:14 350000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal     695 mar 15 17:14 350000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal      87 mar 15 17:14 350000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 350000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 350000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 350000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 350000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 350000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     228 mar 15 17:14 3b0000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal     814 mar 15 17:14 3b0000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal    8194 mar 15 17:14 3b0000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 3b0000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 3b0000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 3b0000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 3b0000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 3b0000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     228 mar 15 17:14 460000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal     695 mar 15 17:14 460000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal      87 mar 15 17:14 460000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 460000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 460000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 460000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 460000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 460000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     228 jan 22 16:22 531000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal     318 jan 22 16:22 531000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 531000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      80 jan 20 21:08 531000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     231 mar 15 17:14 7f6f0000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal   27035 mar 15 17:14 7f6f0000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   34640 mar 15 17:14 7f6f0000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal     424 jan 20 21:08 7f6f0000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal     424 jan 20 21:08 7f6f0000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     592 jan 20 21:08 7f6f0000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal     592 jan 20 21:08 7f6f0000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal    1989 mar 15 17:14 7f6f0000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     227 mar 15 17:14 90000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal  623558 mar 15 17:14 90000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal 1733271 mar 15 17:14 90000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal    4848 jan 20 21:08 90000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal    4848 jan 20 21:08 90000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal   14336 jan 20 21:08 90000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal   14336 jan 20 21:08 90000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal   33237 mar 15 17:14 90000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     229 mar 15 17:14 c30000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal   26931 mar 15 17:14 c30000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   54837 mar 15 17:14 c30000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal     328 jan 20 21:08 c30000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal     328 jan 20 21:08 c30000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     912 jan 20 21:08 c30000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal     912 jan 20 21:08 c30000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal    3341 mar 15 17:14 c30000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     229 mar 15 17:14 d60000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal   14321 mar 15 17:14 d60000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   46236 mar 15 17:14 d60000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal     112 jan 20 21:08 d60000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal     112 jan 20 21:08 d60000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     384 jan 20 21:08 d60000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal     384 jan 20 21:08 d60000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal    2198 mar 15 17:14 d60000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     229 mar 15 17:14 e20000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal    1815 mar 15 17:14 e20000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   18777 mar 15 17:14 e20000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      96 jan 20 21:08 e20000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      96 jan 20 21:08 e20000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     112 jan 20 21:08 e20000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal     112 jan 20 21:08 e20000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal       0 mar 15 17:14 e20000.strings\r\n",
      "-rw-rw-r-- 1 jal jal     229 mar 15 17:14 e80000.ctx\r\n",
      "-rw-rw-r-- 1 jal jal    1477 mar 15 17:14 e80000.graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal   19686 mar 15 17:14 e80000.headers_values.py\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 e80000.heap.pointers.offsets\r\n",
      "-rw-rw-r-- 1 jal jal      88 jan 20 21:08 e80000.heap.pointers.values\r\n",
      "-rw-rw-r-- 1 jal jal     104 jan 20 21:08 e80000.mchunks.addrs\r\n",
      "-rw-rw-r-- 1 jal jal     104 jan 20 21:08 e80000.mchunks.sizes\r\n",
      "-rw-rw-r-- 1 jal jal     104 mar 15 17:14 e80000.strings\r\n",
      "-rw-rw-r-- 1 jal jal  734097 mar 15 17:14 graph.gexf\r\n",
      "-rw-rw-r-- 1 jal jal  572566 mar 15 17:14 graph.heaps.gexf\r\n",
      "-rw-rw-r-- 1 jal jal  101801 mar 15 17:14 headers_values.py\r\n",
      "drwxrwxr-x 2 jal jal   69632 jan 20 21:49 structs\r\n"
     ]
    }
   ],
   "source": [
    "!ls -al ../test/dumps/vol/zeus.vmem.856.dump/cache/"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0xc64e8,64,u'http://193.104.41.75/cbd/75.bro\\x00'\r\n",
      "0xc32d98,32,'http://193.104.41.75/cbd/75.bro\u0000'\r\n",
      "0xc329f8,64,'Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome'\r\n"
     ]
    }
   ],
   "source": [
    "!cat ../test/dumps/vol/zeus.vmem.856.dump/cache/*.strings| grep -a http"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mhh interesting string... I wonder what memory chunk was that allocated in."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\r\n",
      "class struct_c64e8(ctypes.Structure):  # rlevel:50 SIG:T64 size:64\r\n",
      "  _fields_ = [ \r\n",
      "\t( 'utf16_0' , ctypes.c_char*64 ), #  # ctypes.c_char: u'http://193.104.41.75/cbd/75.bro\\x00'\r\n",
      " ]\r\n",
      "\r\n",
      "\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-show ../test/dumps/vol/zeus.vmem.856.dump 0xc64e8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Ah, that make sense.. It's a classic utf16 string. The whole allocated memory chunk is being used for a string.\n",
    "\n",
    "Lets look at the bytes behind the scene."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x001\\x009\\x003\\x00.\\x001\\x000\\x004\\x00.\\x004\\x001\\x00.\\x007\\x005\\x00/\\x00c\\x00b\\x00d\\x00/\\x007\\x005\\x00.\\x00b\\x00r\\x00o\\x00\\x00\\x00'\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-hex ../test/dumps/vol/zeus.vmem.856.dump 0xc64e8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "I wonder if this record was referenced in some other record...\n",
    "Maybe we can find a parent record that points to this string..."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "None\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-parents ../test/dumps/vol/zeus.vmem.856.dump 0xc64e8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Tough luck... What about the others ?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "None\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-parents ../test/dumps/vol/zeus.vmem.856.dump 0xc32d98"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#0xc31e90\r\n",
      "\r\n",
      "class struct_c31e90(ctypes.Structure):  # rlevel:50 SIG:P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4P4a8 size:336\r\n",
      "  _fields_ = [ \r\n",
      "\t( 'ptr_string_c32000_0' , ctypes.c_void_p ), # @ 0x00c32000 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32020_4' , ctypes.c_void_p ), # @ 0x00c32020 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32040_8' , ctypes.c_void_p ), # @ 0x00c32040 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32060_12' , ctypes.c_void_p ), # @ 0x00c32060 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c320a8_16' , ctypes.c_void_p ), # @ 0x00c320a8 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c320d0_20' , ctypes.c_void_p ), # @ 0x00c320d0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c320f8_24' , ctypes.c_void_p ), # @ 0x00c320f8 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32120_28' , ctypes.c_void_p ), # @ 0x00c32120 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32148_32' , ctypes.c_void_p ), # @ 0x00c32148 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32170_36' , ctypes.c_void_p ), # @ 0x00c32170 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32198_40' , ctypes.c_void_p ), # @ 0x00c32198 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c321c0_44' , ctypes.c_void_p ), # @ 0x00c321c0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32230_48' , ctypes.c_void_p ), # @ 0x00c32230 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c322a8_52' , ctypes.c_void_p ), # @ 0x00c322a8 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c322c0_56' , ctypes.c_void_p ), # @ 0x00c322c0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32378_60' , ctypes.c_void_p ), # @ 0x00c32378 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32088_64' , ctypes.c_void_p ), # @ 0x00c32088 # [vol_mapping_058]\r\n",
      "\t( 'ptr_struct_c31fe8_68' , ctypes.c_void_p ), # @ 0x00c31fe9 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c323e0_72' , ctypes.c_void_p ), # @ 0x00c323e1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32418_76' , ctypes.c_void_p ), # @ 0x00c32418 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c323f8_80' , ctypes.c_void_p ), # @ 0x00c323f8 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32460_84' , ctypes.c_void_p ), # @ 0x00c32460 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c324a0_88' , ctypes.c_void_p ), # @ 0x00c324a0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c324c8_92' , ctypes.c_void_p ), # @ 0x00c324c8 # [vol_mapping_058]\r\n",
      "\t( 'ptr_struct_c32480_96' , ctypes.c_void_p ), # @ 0x00c32481 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32448_100' , ctypes.c_void_p ), # @ 0x00c32449 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c324f0_104' , ctypes.c_void_p ), # @ 0x00c324f1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32508_108' , ctypes.c_void_p ), # @ 0x00c32509 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32528_112' , ctypes.c_void_p ), # @ 0x00c32529 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32540_116' , ctypes.c_void_p ), # @ 0x00c32541 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32558_120' , ctypes.c_void_p ), # @ 0x00c32559 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32570_124' , ctypes.c_void_p ), # @ 0x00c32571 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32590_128' , ctypes.c_void_p ), # @ 0x00c32591 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c325b0_132' , ctypes.c_void_p ), # @ 0x00c325b1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c325e0_136' , ctypes.c_void_p ), # @ 0x00c325e1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32600_140' , ctypes.c_void_p ), # @ 0x00c32601 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32628_144' , ctypes.c_void_p ), # @ 0x00c32629 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32650_148' , ctypes.c_void_p ), # @ 0x00c32651 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32678_152' , ctypes.c_void_p ), # @ 0x00c32679 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c326a0_156' , ctypes.c_void_p ), # @ 0x00c326a1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c326b8_160' , ctypes.c_void_p ), # @ 0x00c326b9 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c326d8_164' , ctypes.c_void_p ), # @ 0x00c326d9 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c326f8_168' , ctypes.c_void_p ), # @ 0x00c326f9 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32720_172' , ctypes.c_void_p ), # @ 0x00c32721 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32740_176' , ctypes.c_void_p ), # @ 0x00c32741 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32758_180' , ctypes.c_void_p ), # @ 0x00c32759 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32778_184' , ctypes.c_void_p ), # @ 0x00c32779 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32790_188' , ctypes.c_void_p ), # @ 0x00c32791 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c327a8_192' , ctypes.c_void_p ), # @ 0x00c327a9 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c327c0_196' , ctypes.c_void_p ), # @ 0x00c327c1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c327d8_200' , ctypes.c_void_p ), # @ 0x00c327d9 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c327f0_204' , ctypes.c_void_p ), # @ 0x00c327f1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32808_208' , ctypes.c_void_p ), # @ 0x00c32809 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32820_212' , ctypes.c_void_p ), # @ 0x00c32821 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32838_216' , ctypes.c_void_p ), # @ 0x00c32839 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32850_220' , ctypes.c_void_p ), # @ 0x00c32851 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32868_224' , ctypes.c_void_p ), # @ 0x00c32869 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32888_228' , ctypes.c_void_p ), # @ 0x00c32889 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c328a0_232' , ctypes.c_void_p ), # @ 0x00c328a1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c328b8_236' , ctypes.c_void_p ), # @ 0x00c328b9 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c328d0_240' , ctypes.c_void_p ), # @ 0x00c328d1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c328f0_244' , ctypes.c_void_p ), # @ 0x00c328f1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32908_248' , ctypes.c_void_p ), # @ 0x00c32909 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32928_252' , ctypes.c_void_p ), # @ 0x00c32929 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32940_256' , ctypes.c_void_p ), # @ 0x00c32941 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32958_260' , ctypes.c_void_p ), # @ 0x00c32959 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32970_264' , ctypes.c_void_p ), # @ 0x00c32971 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32988_268' , ctypes.c_void_p ), # @ 0x00c32989 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c329a0_272' , ctypes.c_void_p ), # @ 0x00c329a1 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c329d0_276' , ctypes.c_void_p ), # @ 0x00c329d1 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c329f8_280' , ctypes.c_void_p ), # @ 0x00c329f9 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32338_284' , ctypes.c_void_p ), # @ 0x00c32339 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32a48_288' , ctypes.c_void_p ), # @ 0x00c32a49 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32a88_292' , ctypes.c_void_p ), # @ 0x00c32a88 # [vol_mapping_058]\r\n",
      "\t( 'ptr_struct_c32a68_296' , ctypes.c_void_p ), # @ 0x00c32a69 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32ad0_300' , ctypes.c_void_p ), # @ 0x00c32ad0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32af0_304' , ctypes.c_void_p ), # @ 0x00c32af0 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32ab8_308' , ctypes.c_void_p ), # @ 0x00c32ab9 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32b08_312' , ctypes.c_void_p ), # @ 0x00c32b09 # Unaligned pointer value\r\n",
      "\t( 'ptr_struct_c32b20_316' , ctypes.c_void_p ), # @ 0x00c32b21 # Unaligned pointer value\r\n",
      "\t( 'ptr_string_c32b88_320' , ctypes.c_void_p ), # @ 0x00c32b88 # [vol_mapping_058]\r\n",
      "\t( 'ptr_string_c32c30_324' , ctypes.c_void_p ), # @ 0x00c32c30 # [vol_mapping_058]\r\n",
      "\t( 'zerroes_328' , ctypes.c_ubyte*8 ), # # array\r\n",
      " ]\r\n",
      "\r\n",
      "\r\n",
      "\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-parents ../test/dumps/vol/zeus.vmem.856.dump 0xc329f8"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "That looks interesting. A record made of 82x 4-bytes pointers and some trailings zeroes/padding.\n",
    "\n",
    "Let's see if we can check that out with haystack CLI.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "import ctypes\r\n",
      "\r\n",
      "\r\n",
      "class array_of_pointers(ctypes.Structure):\r\n",
      "    _fields_ = [('array', ctypes.CString*82)]\r\n",
      "\r\n",
      "\r\n",
      "class array_of_wcharp(ctypes.Structure):\r\n",
      "    _fields_ = [('array', ctypes.CWString*82)]\r\n"
     ]
    }
   ],
   "source": [
    "!cat ../test/structures/zeus/records.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "So, due to a little monkey patching, there is a CString ctypes types available in the haystack ctypes module."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[# --------------- 0x1 \r\n",
      "{ # <array_of_pointers at 0xc31e90>\r\n",
      "\"array\": [\r\n",
      "\t\"l\" , # (CString)\r\n",
      "\t\"u\" , # (CString)\r\n",
      "\t\"l\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"w\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"e\" , # (CString)\r\n",
      "\t\"_\" , # (CString)\r\n",
      "\t\"_\" , # (CString)\r\n",
      "\t\"_\" , # (CString)\r\n",
      "\t\"_\" , # (CString)\r\n",
      "\t\"_\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"U\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"u\" , # (CString)\r\n",
      "\t\"software\" , # (CString)\r\n",
      "\t\"system\" , # (CString)\r\n",
      "\t\"%\" , # (CString)\r\n",
      "\t\"%\" , # (CString)\r\n",
      "\t\"n\" , # (CString)\r\n",
      "\t\"o\" , # (CString)\r\n",
      "\t\"z\" , # (CString)\r\n",
      "\t\"*%u.%u.%u.%u*\" , # (CString)\r\n",
      "\t\"winsta0\" , # (CString)\r\n",
      "\t\"default\" , # (CString)\r\n",
      "\t\"gdiplus.dll\" , # (CString)\r\n",
      "\t\"ole32.dll\" , # (CString)\r\n",
      "\t\"gdi32.dll\" , # (CString)\r\n",
      "\t\"DISPLAY\" , # (CString)\r\n",
      "\t\"GdiplusStartup\" , # (CString)\r\n",
      "\t\"GdiplusShutdown\" , # (CString)\r\n",
      "\t\"GdipCreateBitmapFromHBITMAP\" , # (CString)\r\n",
      "\t\"GdipDisposeImage\" , # (CString)\r\n",
      "\t\"GdipGetImageEncodersSize\" , # (CString)\r\n",
      "\t\"GdipGetImageEncoders\" , # (CString)\r\n",
      "\t\"GdipSaveImageToStream\" , # (CString)\r\n",
      "\t\"CreateStreamOnHGlobal\" , # (CString)\r\n",
      "\t\"CreateDCA\" , # (CString)\r\n",
      "\t\"CreateCompatibleDC\" , # (CString)\r\n",
      "\t\"GetDeviceCaps\" , # (CString)\r\n",
      "\t\"CreateCompatibleBitmap\" , # (CString)\r\n",
      "\t\"SelectObject\" , # (CString)\r\n",
      "\t\"BitBlt\" , # (CString)\r\n",
      "\t\"DeleteObject\" , # (CString)\r\n",
      "\t\"DeleteDC\" , # (CString)\r\n",
      "\t\"reboot\" , # (CString)\r\n",
      "\t\"shutdown\" , # (CString)\r\n",
      "\t\"resetgrab\" , # (CString)\r\n",
      "\t\"upcfg\" , # (CString)\r\n",
      "\t\"kbot\" , # (CString)\r\n",
      "\t\"rename_bot\" , # (CString)\r\n",
      "\t\"getcerts\" , # (CString)\r\n",
      "\t\"getmff\" , # (CString)\r\n",
      "\t\"delmff\" , # (CString)\r\n",
      "\t\"sethomepage\" , # (CString)\r\n",
      "\t\"bc_add\" , # (CString)\r\n",
      "\t\"bc_del\" , # (CString)\r\n",
      "\t\"block_url\" , # (CString)\r\n",
      "\t\"unblock_url\" , # (CString)\r\n",
      "\t\"block_fake\" , # (CString)\r\n",
      "\t\"unblock_fake\" , # (CString)\r\n",
      "\t\"kos\" , # (CString)\r\n",
      "\t\"rexeci\" , # (CString)\r\n",
      "\t\"rexec\" , # (CString)\r\n",
      "\t\"lexeci\" , # (CString)\r\n",
      "\t\"lexec\" , # (CString)\r\n",
      "\t\"application/x-www-form-urlencoded\" , # (CString)\r\n",
      "\t\"Content-Type: %s\r\n",
      "ZCID: %s\" , # (CString)\r\n",
      "\t\"https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome\" , # (CString)\r\n",
      "\t\"CustomerServiceMenuEntryPoint?custAction=75\" , # (CString)\r\n",
      "\t\"Q%u: %s\r\n",
      "A%u: %s\r\n",
      "\" , # (CString)\r\n",
      "\t\"d\" , # (CString)\r\n",
      "\t\"Accept-Encoding:\r\n",
      "\" , # (CString)\r\n",
      "\t\"%\" , # (CString)\r\n",
      "\t\"*\" , # (CString)\r\n",
      "\t\"getfile\" , # (CString)\r\n",
      "\t\"addsf\" , # (CString)\r\n",
      "\t\"delsf\" , # (CString)\r\n",
      "\t\"s\" , # (CString)\r\n",
      "\t\"f\" , # (CString)\r\n",
      "\t],\r\n",
      "}]\r\n"
     ]
    }
   ],
   "source": [
    "!haystack-show ../test/dumps/vol/zeus.vmem.856.dump test.structures.zeus.records.array_of_pointers 0xc31e90"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Oh, that is pretty good...\n",
    "but it seems the first few strings are not quite right.."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'l\\x00o\\x00w\\x00s\\x00e\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\n",
      "\n",
      "class string_c32000(ctypes.Structure):  # rlevel:50 SIG:T12a12 size:24\n",
      "  _fields_ = [ \n",
      "\t( 'utf16_0' , ctypes.c_char*12 ), #  # ctypes.c_char: u'lowsec'\n",
      "\t( 'zerroes_12' , ctypes.c_ubyte*12 ), # # array\n",
      " ]\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "!haystack-reverse-hex ../test/dumps/vol/zeus.vmem.856.dump 0x00c32000\n",
    "!haystack-reverse-show ../test/dumps/vol/zeus.vmem.856.dump 0x00c32000"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Mhh, it seems the first few strings are utf16 strings. Lets try with a Wide char string type.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[# --------------- 0x1 \n",
      "{ # <array_of_wcharp at 0xc31e90>\n",
      "\"array\": [\n",
      "\t\"l\u0000o\u0000w\u0000s\u0000e\u0000c\" , # (CWString)\n",
      "\t\"u\u0000s\u0000e\u0000r\u0000.\u0000d\u0000s\" , # (CWString)\n",
      "\t\"l\u0000o\u0000c\u0000a\u0000l\u0000.\u0000d\u0000s\" , # (CWString)\n",
      "\t\"s\u0000d\u0000r\u0000a\u00006\u00004\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"w\u0000i\u0000n\u0000l\u0000o\u0000g\u0000o\u0000n\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"s\u0000v\u0000c\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"e\u0000x\u0000p\u0000l\u0000o\u0000r\u0000e\u0000r\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"_\u0000A\u0000V\u0000I\u0000R\u0000A\u0000_\u00002\u00001\u00001\u00000\" , # (CWString)\n",
      "\t\"_\u0000A\u0000V\u0000I\u0000R\u0000A\u0000_\u00002\u00001\u00000\u00001\" , # (CWString)\n",
      "\t\"_\u0000A\u0000V\u0000I\u0000R\u0000A\u0000_\u00002\u00001\u00000\u00008\" , # (CWString)\n",
      "\t\"_\u0000A\u0000V\u0000I\u0000R\u0000A\u0000_\u00002\u00001\u00000\u00009\" , # (CWString)\n",
      "\t\"_\u0000A\u0000V\u0000I\u0000R\u0000A\u0000_\u00002\u00001\u00000\u00009\u00009\" , # (CWString)\n",
      "\t\"s\u0000o\u0000f\u0000t\u0000w\u0000a\u0000r\u0000e\u0000\\\u0000m\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000w\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u0000n\u0000t\u0000\\\u0000c\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\\\u0000n\u0000e\u0000t\u0000w\u0000o\u0000r\u0000k\" , # (CWString)\n",
      "\t\"U\u0000I\u0000D\" , # (CWString)\n",
      "\t\"s\u0000o\u0000f\u0000t\u0000w\u0000a\u0000r\u0000e\u0000\\\u0000m\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000w\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u0000n\u0000t\u0000\\\u0000c\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\\\u0000w\u0000i\u0000n\u0000l\u0000o\u0000g\u0000o\u0000n\" , # (CWString)\n",
      "\t\"s\u0000o\u0000f\u0000t\u0000w\u0000a\u0000r\u0000e\u0000\\\u0000m\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000w\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\\\u0000c\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\\\u0000r\u0000u\u0000n\" , # (CWString)\n",
      "\t\"u\u0000s\u0000e\u0000r\u0000i\u0000n\u0000i\u0000t\" , # (CWString)\n",
      "\t\"software\" , # (CWString)\n",
      "\t\"system\" , # (CWString)\n",
      "\t\"%\u00000\u00008\u0000X\u0000%\u00000\u00008\u0000X\u0000%\u00000\u00008\u0000X\u0000%\u0000X\" , # (CWString)\n",
      "\t\"%\u0000s\u0000_\u0000%\u00000\u00008\u0000X\" , # (CWString)\n",
      "\t\"n\u0000t\u0000d\u0000l\u0000l\u0000.\u0000d\u0000l\u0000l\" , # (CWString)\n",
      "\t\"o\u0000u\u0000t\u0000p\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"z\u0000l\u0000c\u0000l\u0000i\u0000e\u0000n\u0000t\u0000.\u0000e\u0000x\u0000e\" , # (CWString)\n",
      "\t\"*%u.%u.%u.%u*\" , # (CWString)\n",
      "\t\"winsta0\" , # (CWString)\n",
      "\t\"default\" , # (CWString)\n",
      "\t\"gdiplus.dll\" , # (CWString)\n",
      "\t\"ole32.dll\" , # (CWString)\n",
      "\t\"gdi32.dll\" , # (CWString)\n",
      "\t\"DISPLAY\" , # (CWString)\n",
      "\t\"GdiplusStartup\" , # (CWString)\n",
      "\t\"GdiplusShutdown\" , # (CWString)\n",
      "\t\"GdipCreateBitmapFromHBITMAP\" , # (CWString)\n",
      "\t\"GdipDisposeImage\" , # (CWString)\n",
      "\t\"GdipGetImageEncodersSize\" , # (CWString)\n",
      "\t\"GdipGetImageEncoders\" , # (CWString)\n",
      "\t\"GdipSaveImageToStream\" , # (CWString)\n",
      "\t\"CreateStreamOnHGlobal\" , # (CWString)\n",
      "\t\"CreateDCA\" , # (CWString)\n",
      "\t\"CreateCompatibleDC\" , # (CWString)\n",
      "\t\"GetDeviceCaps\" , # (CWString)\n",
      "\t\"CreateCompatibleBitmap\" , # (CWString)\n",
      "\t\"SelectObject\" , # (CWString)\n",
      "\t\"BitBlt\" , # (CWString)\n",
      "\t\"DeleteObject\" , # (CWString)\n",
      "\t\"DeleteDC\" , # (CWString)\n",
      "\t\"reboot\" , # (CWString)\n",
      "\t\"shutdown\" , # (CWString)\n",
      "\t\"resetgrab\" , # (CWString)\n",
      "\t\"upcfg\" , # (CWString)\n",
      "\t\"kbot\" , # (CWString)\n",
      "\t\"rename_bot\" , # (CWString)\n",
      "\t\"getcerts\" , # (CWString)\n",
      "\t\"getmff\" , # (CWString)\n",
      "\t\"delmff\" , # (CWString)\n",
      "\t\"sethomepage\" , # (CWString)\n",
      "\t\"bc_add\" , # (CWString)\n",
      "\t\"bc_del\" , # (CWString)\n",
      "\t\"block_url\" , # (CWString)\n",
      "\t\"unblock_url\" , # (CWString)\n",
      "\t\"block_fake\" , # (CWString)\n",
      "\t\"unblock_fake\" , # (CWString)\n",
      "\t\"kos\" , # (CWString)\n",
      "\t\"rexeci\" , # (CWString)\n",
      "\t\"rexec\" , # (CWString)\n",
      "\t\"lexeci\" , # (CWString)\n",
      "\t\"lexec\" , # (CWString)\n",
      "\t\"application/x-www-form-urlencoded\" , # (CWString)\n",
      "\t\"Content-Type: %s\n",
      "ZCID: %s\" , # (CWString)\n",
      "\t\"https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome\" , # (CWString)\n",
      "\t\"CustomerServiceMenuEntryPoint?custAction=75\" , # (CWString)\n",
      "\t\"Q%u: %s\n",
      "A%u: %s\n",
      "\" , # (CWString)\n",
      "\t\"d\u0000r\u0000i\u0000v\u0000e\u0000r\u0000s\u0000\\\u0000e\u0000t\u0000c\u0000\\\u0000h\u0000o\u0000s\u0000t\u0000s\" , # (CWString)\n",
      "\t\"Accept-Encoding:\n",
      "\" , # (CWString)\n",
      "\t\"%\u00000\u00008\u0000X\u0000.\u0000u\u0000f\" , # (CWString)\n",
      "\t\"*\u0000.\u0000u\u0000f\" , # (CWString)\n",
      "\t\"getfile\" , # (CWString)\n",
      "\t\"addsf\" , # (CWString)\n",
      "\t\"delsf\" , # (CWString)\n",
      "\t\"s\u0000o\u0000f\u0000t\u0000w\u0000a\u0000r\u0000e\u0000\\\u0000m\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000\\\u0000w\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\\\u0000c\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000v\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000\\\u0000e\u0000x\u0000p\u0000l\u0000o\u0000r\u0000e\u0000r\u0000\\\u0000c\u0000o\u0000m\u0000d\u0000l\u0000g\u00003\u00002\" , # (CWString)\n",
      "\t\"f\u0000i\u0000l\u0000e\u0000s\u0000e\u0000a\u0000r\u0000c\u0000h\u0000\\\u0000%\u00000\u00006\u0000X\u0000_\u0000%\u0000s\" , # (CWString)\n",
      "\t],\n",
      "}]\n"
     ]
    }
   ],
   "source": [
    "!haystack-show ../test/dumps/vol/zeus.vmem.856.dump test.structures.zeus.records.array_of_wcharp 0xc31e90  "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Well, that more or less works.\n",
    "\n",
    "\n",
    "Ultimately, you might want to clean the cache ( REMOVES ALL ANALYSIS FILES )"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}