Source Code for Module rekall.addrspace_test

  1  import logging 
  2  import unittest 
  3   
  4  from rekall import addrspace 
  5  from rekall import testlib 
  6  from rekall import session 
  7   
  8   
  9 -class CustomRunsAddressSpace(addrspace.RunBasedAddressSpace): 
 10 -    def __init__(self, runs=None, data=None, **kwargs): 
 11          super(CustomRunsAddressSpace, self).__init__(**kwargs) 
 12          self.base = addrspace.BufferAddressSpace(data=data, 
 13                                                   session=self.session) 
 14          for i in runs: 
 15              self.add_run(*i) 
 16   
 17   
 18 -class RunBasedTest(testlib.RekallBaseUnitTestCase): 
 19      """Test the RunBasedAddressSpace implementation.""" 
 20   
 21 -    def setUp(self): 
 22          self.session = session.Session() 
 23          self.test_as = CustomRunsAddressSpace( 
 24              session=self.session, 
 25              #        Voff, Poff, length 
 26              runs=[(1000, 0, 10),    # This contains data. 
 27                    (1020, 40, 10), 
 28                    (1030, 50, 10),   # Contiguous runs. 
 29                    (1050, 0, 2), 
 30                    (1052, 5, 2)], 
 31              data="0123456789") 
 32   
 33 -    def testRunsRead(self): 
 34          # Read from an address without data 
 35          self.assertEqual(self.test_as.read(0, 20), "\x00" * 20) 
 36   
 37          # Address translation. 
 38          self.assertEqual(self.test_as.vtop(0), None) 
 39          self.assertEqual(self.test_as.vtop(1005), 5) 
 40   
 41          # Read spanning two runs 
 42          self.assertEqual(self.test_as.read(1050, 4), "0156") 
 43   
 44          # Read in the middle of a run 
 45          self.assertEqual(self.test_as.read(1005, 10), 
 46                           "56789" + "\x00" * 5) 
 47          # Read past the end 
 48          self.assertEqual(self.test_as.read(2000, 10), 
 49                           "\x00" * 10) 
 50   
 51 -    def testDiscontiguousRunsGetRanges(self): 
 52          """Test the range merging.""" 
 53          runs = [] 
 54          # The pure mapping is not merged. 
 55          for run in self.test_as.get_mappings(): 
 56              self.assertTrue(isinstance(run, addrspace.Run)) 
 57              self.assertEqual(run.address_space, self.test_as.base) 
 58              runs.append([run.start, run.end, run.file_offset]) 
 59   
 60          self.assertEqual(runs, 
 61                           [[1000, 1010, 0], 
 62                            [1020, 1030, 40], 
 63                            [1030, 1040, 50], 
 64                            [1050, 1052, 0], 
 65                            [1052, 1054, 5]]) 
 66   
 67          runs = [] 
 68          for run in self.test_as.merge_base_ranges(): 
 69              runs.append([run.start, run.end, run.file_offset]) 
 70   
 71          # merge_base_ranges is supposed to merge contiguous runs but still 
 72          # maintain contiguous ranges in the base address space. 
 73          self.assertEqual(runs, 
 74                           [[1000, 1010, 0], 
 75                            [1020, 1040, 40], 
 76                            [1050, 1052, 0], 
 77                            [1052, 1054, 5]]) 
 78   
 79          runs = [] 
 80          for run in self.test_as.get_address_ranges(): 
 81              # No valid physical mapping given here. 
 82              self.assertTrue(run.file_offset is None) 
 83              self.assertTrue(run.address_space is None) 
 84              runs.append([run.start, run.end]) 
 85   
 86          # get_address_ranges is supposed to merge contiguous runs in the virtual 
 87          # AS. 
 88          self.assertEqual(runs, 
 89                           [[1000, 1010], 
 90                            [1020, 1040], 
 91                            [1050, 1054]]) 
 92   
 93   
 94          # Check that get_address_ranges honors the start and end parameters. 
 95          run = None 
 96          for run in self.test_as.get_address_ranges(start=1022, end=1024): 
 97              self.assertEqual(run.start, 1022) 
 98              self.assertEqual(run.end, 1024) 
 99   
100              # get_address_ranges does not have a file_offset member. 
101              self.assertEqual(run.file_offset, None) 
102   
103          self.assertTrue(run) 
104   
105   
106          # Check that merge_base_ranges honors the start and end parameters. 
107          run = None 
108          for run in self.test_as.merge_base_ranges(start=1022, end=1024): 
109              self.assertEqual(run.start, 1022) 
110              self.assertEqual(run.end, 1024) 
111   
112              # The file_offset must be properly adjusted too. 
113              self.assertEqual(run.file_offset, 40 + 2) 
114   
115          self.assertTrue(run) 
116   
117          # Check that get_mappings honors the start parameter. 
118          run = None 
119          for run in self.test_as.get_mappings(start=1022): 
120              # get_mappings does not clip ranges so we may get a range which 
121              # starts below the specified limit. 
122              self.assertEqual(run.start, 1020) 
123              self.assertEqual(run.end, 1030) 
124   
125              # The file_offset is unchanged. 
126              self.assertEqual(run.file_offset, 40) 
127              break 
128   
129          self.assertTrue(run) 
130   
131          # Check that get_mappings honors the end parameter. 
132          run = None 
133          for run in self.test_as.get_mappings(end=1022): 
134              pass 
135   
136          # Check the last run. Note get_mappings may not clip the last run so it 
137          # may extend past the end but should never start past the specified end 
138          # point. 
139          self.assertEqual(run.start, 1020) 
140          self.assertEqual(run.end, 1030) 
141   
142   
143  if __name__ == "__main__": 
144      logging.basicConfig(level=logging.DEBUG) 
145      unittest.main() 
146