Skip to content

paging ¤

Classes:

Functions:

Attributes:

INVALID_ADDR module-attribute ¤

INVALID_ADDR = 1 << 64

PageTableLevel dataclass ¤

PageTableLevel(
    name: str | None = None,
    entry: int | None = None,
    virt: int | None = None,
    phys: int | None = None,
    idx: int | None = None,
    level: int | None = None,
)

Attributes:

  • name (str | None) –
  • entry (int | None) –
  • virt (int | None) –
  • phys (int | None) –
  • idx (int | None) –
  • level (int | None) –

name class-attribute instance-attribute ¤

name: str | None = None

entry class-attribute instance-attribute ¤

entry: int | None = None

virt class-attribute instance-attribute ¤

virt: int | None = None

phys class-attribute instance-attribute ¤

phys: int | None = None

idx class-attribute instance-attribute ¤

idx: int | None = None

level class-attribute instance-attribute ¤

level: int | None = None

PagewalkResult dataclass ¤

PagewalkResult(
    virt: int | None = None,
    phys: int | None = None,
    entry: int | None = None,
    levels: tuple[PageTableLevel, ...] = (),
)

Attributes:

virt class-attribute instance-attribute ¤

virt: int | None = None

phys class-attribute instance-attribute ¤

phys: int | None = None

entry class-attribute instance-attribute ¤

entry: int | None = None

levels class-attribute instance-attribute ¤

levels: tuple[PageTableLevel, ...] = ()

PageTableScan ¤

PageTableScan(pi: ArchPagingInfo)

Methods:

  • scan –

    this needs to be EXTREMELY optimized as it is used to display context

  • walk –

Attributes:

paging_level instance-attribute ¤

paging_level = paging_level

PAGE_ENTRY_MASK instance-attribute ¤

PAGE_ENTRY_MASK = PAGE_ENTRY_MASK

PAGE_INDEX_LEN instance-attribute ¤

PAGE_INDEX_LEN = PAGE_INDEX_LEN

PAGE_INDEX_MASK instance-attribute ¤

PAGE_INDEX_MASK = PAGE_INDEX_MASK

page_shift instance-attribute ¤

page_shift = page_shift

should_stop_pagewalk instance-attribute ¤

should_stop_pagewalk = should_stop_pagewalk

pagesz instance-attribute ¤

pagesz = page_size

ptrsize instance-attribute ¤

ptrsize = ptrsize

fmt instance-attribute ¤

fmt = '<' + ('Q' if ptrsize == 8 else 'I') * (pagesz // ptrsize)

cache instance-attribute ¤

cache: dict[tuple[int, int], list[tuple[int, int, int]]] = {}

entry_cache instance-attribute ¤

entry_cache: dict[int, tuple[int]] = {}

arch instance-attribute ¤

arch = name

read instance-attribute ¤

read: Callable[[int, int], bytearray] = read_memory

scan ¤

scan(entry: int, is_kernel: bool = False) -> list[Page]

this needs to be EXTREMELY optimized as it is used to display context making as few functions calls or memory reads as possible avoid unnecessary python pointer deferences or repetative computations whenever possible when benchmarked on the same linux kernels with the same read method, on average: - gdb-pt-dump takes ~0.122 for x64 and 0.562 seconds for aarch64 - this implementation takes less than 0.0297 seconds to complete for x64 and 0.0492 seconds for aarch64 → 4x faster for x64 and 10x faster for aarch64

walk ¤

walk(target: int, entry: int) -> PagewalkResult

ArchPagingInfo ¤

Methods:

Attributes:

USERLAND class-attribute instance-attribute ¤

USERLAND = 'userland'

KERNELLAND class-attribute instance-attribute ¤

KERNELLAND = 'kernel [.text]'

KERNELRO class-attribute instance-attribute ¤

KERNELRO = 'kernel [.rodata]'

KERNELBSS class-attribute instance-attribute ¤

KERNELBSS = 'kernel [.bss]'

KERNELDRIVER class-attribute instance-attribute ¤

KERNELDRIVER = 'kernel [.driver .bpf]'

ESPSTACK class-attribute instance-attribute ¤

ESPSTACK = 'espfix'

PHYSMAP class-attribute instance-attribute ¤

PHYSMAP = 'physmap'

VMALLOC class-attribute instance-attribute ¤

VMALLOC = 'vmalloc'

VMEMMAP class-attribute instance-attribute ¤

VMEMMAP = 'vmemmap'

STRUCT_PAGE_SIZE property ¤

STRUCT_PAGE_SIZE: int

STRUCT_PAGE_SHIFT property ¤

STRUCT_PAGE_SHIFT: int

physmap property ¤

physmap: int

vmalloc property ¤

vmalloc: int

vmemmap property ¤

vmemmap: int

slab_virtual property ¤

slab_virtual: int

kbase property ¤

kbase: int | None

page_shift property ¤

page_shift: int

page_size property ¤

page_size: int

paging_level property ¤

paging_level: int

PAGE_ENTRY_MASK property ¤

PAGE_ENTRY_MASK: int

PAGE_INDEX_LEN property ¤

PAGE_INDEX_LEN: int

PAGE_INDEX_MASK property ¤

PAGE_INDEX_MASK: int

ram_phys_start property ¤

ram_phys_start: int

va_bits property ¤

va_bits: int

pagetable_level_names property ¤

pagetable_level_names: tuple[str, ...]

slab_to_virt ¤

slab_to_virt(slab: int) -> int

virt_to_slab ¤

virt_to_slab(virt: int) -> int

adjust ¤

adjust(name: str) -> str

markers ¤

markers() -> tuple[tuple[str | None, int | None], ...]

handle_kernel_pages ¤

handle_kernel_pages(pages: tuple[Page, ...]) -> None

pagewalk ¤

pagewalk(target: int, entry: int | None, virt: bool = True) -> PagewalkResult

pagescan ¤

pagescan(entry: int | None = None) -> list[Page]

pagetablescan ¤

pagetablescan(entry: int) -> PageTableScan | None

switch_to_phymem_mode ¤

switch_to_phymem_mode() -> tuple[str, bool]

bitflags ¤

bitflags(level: PageTableLevel) -> BitFlags

should_stop_pagewalk ¤

should_stop_pagewalk(entry: int) -> bool

x86_64PagingInfo ¤

x86_64PagingInfo()

Bases: ArchPagingInfo

Methods:

Attributes:

P4D_SHIFT instance-attribute ¤

P4D_SHIFT = 39

pagetable_level_names property ¤

pagetable_level_names: tuple[str, ...]

va_bits property ¤

va_bits: int

physmap property ¤

physmap: int

kbase property ¤

kbase: int | None

page_shift property ¤

page_shift: int

vmalloc property ¤

vmalloc: int

vmemmap property ¤

vmemmap: int

slab_virtual property ¤

slab_virtual: int

SLAB_DATA_BASE_ADDR property ¤

SLAB_DATA_BASE_ADDR: int

paging_level property ¤

paging_level: int

USERLAND class-attribute instance-attribute ¤

USERLAND = 'userland'

KERNELLAND class-attribute instance-attribute ¤

KERNELLAND = 'kernel [.text]'

KERNELRO class-attribute instance-attribute ¤

KERNELRO = 'kernel [.rodata]'

KERNELBSS class-attribute instance-attribute ¤

KERNELBSS = 'kernel [.bss]'

KERNELDRIVER class-attribute instance-attribute ¤

KERNELDRIVER = 'kernel [.driver .bpf]'

ESPSTACK class-attribute instance-attribute ¤

ESPSTACK = 'espfix'

PHYSMAP class-attribute instance-attribute ¤

PHYSMAP = 'physmap'

VMALLOC class-attribute instance-attribute ¤

VMALLOC = 'vmalloc'

VMEMMAP class-attribute instance-attribute ¤

VMEMMAP = 'vmemmap'

STRUCT_PAGE_SIZE property ¤

STRUCT_PAGE_SIZE: int

STRUCT_PAGE_SHIFT property ¤

STRUCT_PAGE_SHIFT: int

page_size property ¤

page_size: int

PAGE_ENTRY_MASK property ¤

PAGE_ENTRY_MASK: int

PAGE_INDEX_LEN property ¤

PAGE_INDEX_LEN: int

PAGE_INDEX_MASK property ¤

PAGE_INDEX_MASK: int

ram_phys_start property ¤

ram_phys_start: int

get_vmalloc_vmemmap_bases ¤

get_vmalloc_vmemmap_bases() -> tuple[int | None, int | None]

slab_to_virt ¤

slab_to_virt(slab: int) -> int

virt_to_slab ¤

virt_to_slab(virt: int) -> int

markers ¤

markers() -> tuple[tuple[str | None, int | None], ...]

adjust ¤

adjust(name: str) -> str

handle_kernel_pages ¤

handle_kernel_pages(pages: tuple[Page, ...]) -> None

pagewalk ¤

pagewalk(target: int, entry: int | None, virt: bool = True) -> PagewalkResult

pagescan ¤

pagescan(entry: int | None = None) -> list[Page]

bitflags ¤

bitflags(level: PageTableLevel) -> BitFlags

should_stop_pagewalk ¤

should_stop_pagewalk(entry: int) -> bool

pagetablescan ¤

pagetablescan(entry: int) -> PageTableScan | None

switch_to_phymem_mode ¤

switch_to_phymem_mode() -> tuple[str, bool]

Aarch64PagingInfo ¤

Aarch64PagingInfo()

Bases: ArchPagingInfo

Methods:

Attributes:

VMEMMAP_START instance-attribute ¤

VMEMMAP_START = None

VMEMMAP_SIZE instance-attribute ¤

VMEMMAP_SIZE = None

PAGE_OFFSET instance-attribute ¤

PAGE_OFFSET = None

pagetable_level_names property ¤

pagetable_level_names: tuple[str, ...]

tcr_el1 property ¤

tcr_el1: BitFlags

va_bits property ¤

va_bits: int

va_bits_min property ¤

va_bits_min: int

vmalloc property ¤

vmalloc: int

physmap property ¤

physmap: int

kbase property ¤

kbase: int | None

kversion property ¤

kversion: tuple[int, ...] | None

module_start property ¤

module_start: int | None

vmemmap property ¤

vmemmap: int

pci property ¤

pci: int | None

fixmap property ¤

fixmap: int

ksize property ¤

ksize: int

page_shift_heuristic property ¤

page_shift_heuristic: int

page_shift property ¤

page_shift: int

page_shift_user property ¤

page_shift_user: int

paging_level property ¤

paging_level: int

ram_phys_start property ¤

ram_phys_start: int

USERLAND class-attribute instance-attribute ¤

USERLAND = 'userland'

KERNELLAND class-attribute instance-attribute ¤

KERNELLAND = 'kernel [.text]'

KERNELRO class-attribute instance-attribute ¤

KERNELRO = 'kernel [.rodata]'

KERNELBSS class-attribute instance-attribute ¤

KERNELBSS = 'kernel [.bss]'

KERNELDRIVER class-attribute instance-attribute ¤

KERNELDRIVER = 'kernel [.driver .bpf]'

ESPSTACK class-attribute instance-attribute ¤

ESPSTACK = 'espfix'

PHYSMAP class-attribute instance-attribute ¤

PHYSMAP = 'physmap'

VMALLOC class-attribute instance-attribute ¤

VMALLOC = 'vmalloc'

VMEMMAP class-attribute instance-attribute ¤

VMEMMAP = 'vmemmap'

STRUCT_PAGE_SIZE property ¤

STRUCT_PAGE_SIZE: int

STRUCT_PAGE_SHIFT property ¤

STRUCT_PAGE_SHIFT: int

slab_virtual property ¤

slab_virtual: int

page_size property ¤

page_size: int

PAGE_ENTRY_MASK property ¤

PAGE_ENTRY_MASK: int

PAGE_INDEX_LEN property ¤

PAGE_INDEX_LEN: int

PAGE_INDEX_MASK property ¤

PAGE_INDEX_MASK: int

markers ¤

markers() -> tuple[tuple[str | None, int | None], ...]

adjust ¤

adjust(name: str) -> str

handle_kernel_pages ¤

handle_kernel_pages(pages: tuple[Page, ...]) -> None

pagewalk ¤

pagewalk(target: int, entry: int | None, virt: bool = True) -> PagewalkResult

pagescan ¤

pagescan(entry: int | None = None) -> list[Page]

bitflags ¤

bitflags(level: PageTableLevel) -> BitFlags

should_stop_pagewalk ¤

should_stop_pagewalk(entry: int) -> bool

slab_to_virt ¤

slab_to_virt(slab: int) -> int

virt_to_slab ¤

virt_to_slab(virt: int) -> int

pagetablescan ¤

pagetablescan(entry: int) -> PageTableScan | None

switch_to_phymem_mode ¤

switch_to_phymem_mode() -> tuple[str, bool]

first_kernel_page_start ¤

first_kernel_page_start() -> int