# Path: haystack/search/api.py
# class HaystackError(Exception):
# def search_record(memory_handler, record_type, search_constraints=None, extended_search=False):
# def search_record_hint(memory_handler, record_type, hint, search_constraints=None, extended_search=False):
# def output_to_string(memory_handler, results):
# def output_to_python(memory_handler, results):
# def output_to_json(memory_handler, results):
# def output_to_pickle(memory_handler, results):
# def load_record(memory_handler, struct_type, memory_address, load_constraints=None):
# def validate_record(memory_handler, instance, record_constraints=None, max_depth=10):
# 
# Path: haystack/search/searcher.py
# class RecordSearcher(object):
# class RecordLoader(RecordSearcher):
# class AnyOffsetRecordSearcher(RecordSearcher):
#     def __init__(self, memory_handler, my_constraints=None, target_mappings=None, update_cb=None):
#     def search(self, struct_type, max_res=10, max_depth=10):
#     def _search_in(self, mem_map, struct_type, nb=10, depth=99):
#     def _load_at(self, mem_map, address, struct_type, depth=99):
#     def load(self, struct_type, memory_address):
#     def __init__(self, memory_handler, my_constraints=None, target_mappings=None, update_cb=None):
#     def _search_in(self, mem_map, struct_type, nb=10, depth=99, align=None):
# 
# Path: haystack/mappings/folder.py
# MMAP_HACK_ACTIVE = True
# MAX_MAPPING_SIZE_FOR_MMAP = 1024 * 1024 * 20
# class LazyLoadingException(Exception):
# class MemoryDumpLoader(interfaces.IMemoryLoader):
# class ProcessMemoryDumpLoader(MemoryDumpLoader):
# class LazyProcessMemoryDumpLoader(ProcessMemoryDumpLoader):
# class VeryLazyProcessMemoryDumpLoader(LazyProcessMemoryDumpLoader):
# class FolderLoader(interfaces.IMemoryLoader):
#     def __init__(self, filename):
#     def __init__(self, dumpname, bits=None, os_name=None):
#     def make_memory_handler(self):
#     def _is_valid(self):
#     def _load_mappings(self):
#     def _is_valid(self):
#     def _test_dir(self):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_mappings(self):
#     def _load_metadata(self):
#     def _load_memory_mappings(self):
#     def __init__(self, dumpname, maps_to_load=None, bits=None, os_name=None):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_memory_mappings(self):
# def load(dumpname, bits=None, os_name=None):
#     def __init__(self, opts):
#     def make_memory_handler(self):


import logging
import unittest
from haystack.search import api
from haystack.search import searcher
from haystack.mappings import folder
        walkers = finder.list_heap_walkers()
        heaps = [walker.get_heap_mapping() for walker in walkers]
        my_heap = [x for x in heaps if x.start == self.known_heaps[0][0]][0]
        heap_mapping = self.memory_handler.get_mapping_for_address(self.known_heaps[0][0])
        # we want the 32 bits heap record type on 32 bits heap mappings
        heapwalker = finder.get_heap_walker(heap_mapping)
        ## Thats a 64 bits heap heapwalker = finder.get_heap_walker(heaps[0])


        my_loader = searcher.RecordLoader(self.memory_handler)
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0])
        res_p = api.output_to_python(self.memory_handler, [res])
        instance, validated = res_p[0]
        # no constraints loaded, subsegmentcode pointer went to is_valid
        self.assertFalse(validated)

        # now lets just use the win7heap constraints
        my_loader = searcher.RecordLoader(self.memory_handler, heapwalker._heap_module_constraints)
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0])
        res_p = api.output_to_python(self.memory_handler, [res])
        instance, validated = res_p[0]
        # no constraints loaded, subsegmentcode pointer went to is_valid
        self.assertTrue(validated)
        self.assertIsInstance(instance, object)
        self.assertEqual(instance.Signature, 0xeeffeeff)
        self.assertEqual(instance.VirtualMemoryThreshold, 0xfe00)
        self.assertEqual(instance.FrontEndHeapType, 0)

        # try a misalign read
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0] + 1)

# Path: haystack/search/api.py
# class HaystackError(Exception):
# def search_record(memory_handler, record_type, search_constraints=None, extended_search=False):
# def search_record_hint(memory_handler, record_type, hint, search_constraints=None, extended_search=False):
# def output_to_string(memory_handler, results):
# def output_to_python(memory_handler, results):
# def output_to_json(memory_handler, results):
# def output_to_pickle(memory_handler, results):
# def load_record(memory_handler, struct_type, memory_address, load_constraints=None):
# def validate_record(memory_handler, instance, record_constraints=None, max_depth=10):
# 
# Path: haystack/search/searcher.py
# class RecordSearcher(object):
# class RecordLoader(RecordSearcher):
# class AnyOffsetRecordSearcher(RecordSearcher):
#     def __init__(self, memory_handler, my_constraints=None, target_mappings=None, update_cb=None):
#     def search(self, struct_type, max_res=10, max_depth=10):
#     def _search_in(self, mem_map, struct_type, nb=10, depth=99):
#     def _load_at(self, mem_map, address, struct_type, depth=99):
#     def load(self, struct_type, memory_address):
#     def __init__(self, memory_handler, my_constraints=None, target_mappings=None, update_cb=None):
#     def _search_in(self, mem_map, struct_type, nb=10, depth=99, align=None):
# 
# Path: haystack/mappings/folder.py
# MMAP_HACK_ACTIVE = True
# MAX_MAPPING_SIZE_FOR_MMAP = 1024 * 1024 * 20
# class LazyLoadingException(Exception):
# class MemoryDumpLoader(interfaces.IMemoryLoader):
# class ProcessMemoryDumpLoader(MemoryDumpLoader):
# class LazyProcessMemoryDumpLoader(ProcessMemoryDumpLoader):
# class VeryLazyProcessMemoryDumpLoader(LazyProcessMemoryDumpLoader):
# class FolderLoader(interfaces.IMemoryLoader):
#     def __init__(self, filename):
#     def __init__(self, dumpname, bits=None, os_name=None):
#     def make_memory_handler(self):
#     def _is_valid(self):
#     def _load_mappings(self):
#     def _is_valid(self):
#     def _test_dir(self):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_mappings(self):
#     def _load_metadata(self):
#     def _load_memory_mappings(self):
#     def __init__(self, dumpname, maps_to_load=None, bits=None, os_name=None):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_memory_mappings(self):
# def load(dumpname, bits=None, os_name=None):
#     def __init__(self, opts):
#     def make_memory_handler(self):


# Path: test/haystack/search/test_searcher.py
import logging
import unittest
from haystack.search import api
from haystack.search import searcher
from haystack.mappings import folder

        walkers = finder.list_heap_walkers()
        heaps = [walker.get_heap_mapping() for walker in walkers]
        my_heap = [x for x in heaps if x.start == self.known_heaps[0][0]][0]
        heap_mapping = self.memory_handler.get_mapping_for_address(self.known_heaps[0][0])
        # we want the 32 bits heap record type on 32 bits heap mappings
        heapwalker = finder.get_heap_walker(heap_mapping)
        ## Thats a 64 bits heap heapwalker = finder.get_heap_walker(heaps[0])


        my_loader = searcher.RecordLoader(self.memory_handler)
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0])
        res_p = api.output_to_python(self.memory_handler, [res])
        instance, validated = res_p[0]
        # no constraints loaded, subsegmentcode pointer went to is_valid
        self.assertFalse(validated)

        # now lets just use the win7heap constraints
        my_loader = searcher.RecordLoader(self.memory_handler, heapwalker._heap_module_constraints)
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0])
        res_p = api.output_to_python(self.memory_handler, [res])
        instance, validated = res_p[0]
        # no constraints loaded, subsegmentcode pointer went to is_valid
        self.assertTrue(validated)
        self.assertIsInstance(instance, object)
        self.assertEqual(instance.Signature, 0xeeffeeff)
        self.assertEqual(instance.VirtualMemoryThreshold, 0xfe00)
        self.assertEqual(instance.FrontEndHeapType, 0)

        # try a misalign read
        res = my_loader.load(heapwalker._heap_module.HEAP, self.known_heaps[0][0] + 1)

        res_p = api.output_to_python(self.memory_handler, [res])