<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hi all,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I'm writing a plugin to get the memory pages which are executed by a process. My idea is to work at the level of the translation blocks. In particular , the struct TranslationBlock has a field named "page_addr" which
stores the addresses of the memory pages that the current block refers to. By registering the callback "<span>PANDA_CB_BEFORE_BLOCK_EXEC</span>" it is possible to get the currently executed translation block. So, at the moment, my callback is something similar:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">// Some global variables<br>
</p>
<p style="margin-top:0;margin-bottom:0">std::list<target_ulong> page_list;</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>OsiProc *proc = NULL;<br>
<br>
.... // Here we have init and uninit, etc.<br>
</div>
<br>
<p></p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>int before_block_callback(CPUState *env, TranslationBlock *tb)<br>
{<br>
proc = get_current_process(env);<br>
if (proc == NULL)<br>
return false;<br>
if (strcmp(proc->name, proc_to_track) == 0 && !panda_in_kernel(env))<br>
{<br>
target_ulong page1 = tb->page_addr[0];<br>
target_ulong page2 = tb->page_addr[1];<br>
bool found1 = (std::find(page_list.begin(), page_list.end(), page1) != page_list.end());<br>
bool found2 = (std::find(page_list.begin(), page_list.end(), page2) != page_list.end());<br>
if (!found1) <br>
page_list.push_back(page1);<br>
if (!found2) <br>
page_list.push_back(page2);<br>
<br>
}<br>
free_osiproc(proc);<br>
return 0;<br>
}<br>
<br>
<div align="left">My idea was adding a further filter to check if the executed memory page matches with a module or not. Is this approach the correct one?<br>
<br>
Thank you<br>
Best regards,<br>
elmanto<br>
</div>
<br>
</div>
<br>
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
</div>
</body>
</html>