summaryrefslogtreecommitdiff
path: root/rust/examples/minidump/README.md
diff options
context:
space:
mode:
authorCindy Xiao <git@cxiao.net>2023-02-11 11:25:38 -0800
committerKyle Martin <krm504@nyu.edu>2023-02-20 10:45:04 -0500
commit56996b0617c499178b463eb27973e7b12a056ffc (patch)
tree9035cee98b515fa2946d5d115a9eac3768f9d8bc /rust/examples/minidump/README.md
parent9993345001464331697167349803235498218652 (diff)
Rust API : Add minidump example
Squashed commit message history: Initial commit chore: Add files from cargo new, Binary Ninja Rust API template chore: Add README feat: Add basic plugin registration code feat: Add command to print memory information from minidump I can't believe this actually worked the first time feat: Set up registration of Minidump BinaryView type Also set architecture based on contents of MinidumpSystemInfo stream in the minidump. feat: Perform basic segment mapping from MinidumpMemoryList, MinidumpMemory64List feat: Read and apply memory segment protection info from MinidumpMemoryInfoList feat: Log action to add segments at info level docs: Update readme with build instructions, screenshot style: Minor cleanup of types refactor: Remove use of unwrap when parsing raw BaseRVA docs: Add doc comments to view module feat: More logging in print_memory_information command, remove unwrap refactor: Add struct for representing memory protection flags fix: Correct information about difference between MinidumpMemoryList, MinidumpMemory64List MinidumpMemory64List is always used for "full dumps", i.e. dumps which include the full process memory. It does not have to do with 64-bit segments specifically. docs: Clarify Windows-only support for now in README fix: First try to find full dump memory in MinidumpMemory64List before looking for partial dump memory in MinidumpMemoryList docs: Update README with examples of how to generate minidumps feat: Parse module information in MinidumpModuleList, and add modules as sections docs: Add information about unsupported features docs: Update README with screenshots, explanation of memory map docs: Update TODOs in BinaryViewBase impl Rust Minidump example : Clippy appeasements; remove network dependency
Diffstat (limited to 'rust/examples/minidump/README.md')
-rw-r--r--rust/examples/minidump/README.md65
1 files changed, 65 insertions, 0 deletions
diff --git a/rust/examples/minidump/README.md b/rust/examples/minidump/README.md
new file mode 100644
index 00000000..3c54ca8e
--- /dev/null
+++ b/rust/examples/minidump/README.md
@@ -0,0 +1,65 @@
+# Binary Ninja Minidump Loader
+
+A Minidump memory dump loader plugin for Binary Ninja.
+
+![Screenshot of Binary Ninja using the "Minidump" Binary View, with a minidump loaded and the virtual addresses of the memory segments of the minidump showing in the Memory Map window](images/loaded-minidump-screenshot-border.png)
+
+This plugin adds a new _Minidump_ binary view type. When a binary with the magic number `MDMP` is opened, this plugin will automatically try to load in the binary as a minidump, and create a new _Minidump_ binary view to view the contents.
+
+The architecture is determined automatically from the platform information embedded in the minidump.
+
+![Screenshot showing the Minidump binary view type in the dropdown list of available binary views for an open binary](images/minidump-binary-view-type-screenshot-border.png)
+
+The loaded minidump's memory regions and modules can be navigated via the _Memory Map_ window. In the _Minidump_ binary view, the meanings of "Segments" and "Sections" in the Memory Map window are modified to mean the following:
+
+- The memory regions in the minidump are loaded as _Segments_. The _Data Offset_ and _Data Length_ fields of each segment are the corresponding addresses in the minidump file where the data for that memory region is located.
+- The modules in the minidump are loaded as _Sections_, with the name of each section being the path to the module.
+
+![Screenshot showing the Memory Map window with the loaded minidump's memory segments and modules (i.e. "sections")](images/minidump-segments-sections-screenshot-border.png)
+
+## Supported Minidump Types
+
+This plugin currently only supports loading minidump files generated by the Windows [`MiniDumpWriteDump` API](https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump).
+
+This includes dumps generated from:
+
+- The [`.dump` command](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/-dump--create-dump-file-) in WinDbg.
+- The `.dump` command in Binary Ninja's debugger for Windows targets (which uses the same debugging engine as WinDbg).
+
+For both of the above, it's recommended to generate a full dump:
+
+```
+.dump /ma dumpfile.dmp
+```
+
+- The [`minidump` command](https://help.x64dbg.com/en/latest/commands/memory-operations/minidump.html) in x64dbg.
+
+```
+minidump dumpfile.dmp
+```
+
+- Right clicking on a listed process and then clicking "Create dump file" / "Create full dump" from Windows Task Manager, Process Hacker, Sysinternals Process Explorer, etc...
+
+## Unsupported Features (for now)
+
+- Loading Minidump files from platforms or APIs other than Windows' `MinidumpWriteDump`, such as those generated by [Google Breakpad](https://chromium.googlesource.com/breakpad/breakpad/).
+- Loading and applyng debug information from the minidump file. In Windows minidump files, `MinidumpModuleList` streams contain information about the PDB file which contains the debug information for the module; this isn't currently read or applied, however.
+- Integration with Binary Ninja's built-in debugger. Minidump files can contain information about threads, register values, and stack frames, and it would be nice in the future for minidump files to be loadable back into the debugger in order to resume a debugging session. This isn't currently done, however.
+
+## Building and Installing
+
+This plugin currently needs to be built from source, then copied into your user plugin folder.
+
+```
+cargo build --release
+cp target/release/libminidump_bn.so ~/.binaryninja/plugins/
+```
+
+The code in this plugin targets the `dev` branch of the [Binary Ninja Rust API](https://github.com/Vector35/binaryninja-api/tree/dev/rust).
+
+To update the Binary Ninja Rust API dependency:
+
+```
+cargo update -p binaryninja
+cargo build --release
+``` \ No newline at end of file