# Path: haystack/cli.py
# SEARCH_DESC = 'Search for instance of a record_type in the allocated memory of a process. '
# SHOW_DESC = 'Cast the bytes at this address into a record_type. '
# WATCH_DESC = 'Cast the bytes at this address into a record_type and refresh regularly. '
# DUMP_DESC = 'Extract the process dump from the OS memory dump in haystack format. '
# DUMPTYPE_BASE = 'haystack'
# DUMPTYPE_VOLATILITY = 'volatility'
# DUMPTYPE_REKALL = 'rekall'
# DUMPTYPE_LIVE = 'live'
# DUMPTYPE_MINIDUMP = 'minidump'
# DUMPTYPE_FRIDA = 'frida'
# SUPPORTED_DUMP_URI = {}
# DUMPTYPE_BASE_DESC = 'The process dump is a folder produced by a haystack-dump script.'
# DUMPTYPE_VOL_DESC = 'The process dump is a volatility OS dump. The PID is the targeted process.'
# DUMPTYPE_REKALL_DESC = 'The process dump is a rekall OS dump. The PID is the targeted process.'
# DUMPTYPE_LIVE_DESC = 'The PID must be a running process.'
# DUMPTYPE_MINIDUMP_DESC = 'The process dump is a Minidump (MDMP) process dump.'
# def url(u):
# def make_memory_handler(opts):
# def get_output(memory_handler, results, rtype):
# def dump_process(opts):
# def search_cmdline(args):
# def show_cmdline(args):
# def check_varname_for_type(memory_handler, varname, struct_type):
# def get_varname_value(varname, instance):
# def watch(args):
# def base_argparser(program_name, description):
# def search_argparser(search_parser):
# def show_argparser(show_parser):
# def watch_argparser(watch_parser):
# def dump_argparser(dump_parser):
# def output_argparser(rootparser):
# def set_logging_level(opts):
# def live_watch():
# def volatility_dump():
# def rekall_dump():
# def search():
# def show():
# class HaystackError(Exception):
# 
# Path: haystack/argparse_utils.py
# def readable(f):
# def writeable(f):
# def int16(s):
# 
# Path: haystack/outputters/text.py
# class RecursiveTextOutputter(Outputter):
#     def parse(self, obj, prefix='', depth=10, addr_was=None):
#     def _attrToString(self, attr, field, attrtype, prefix, addr, depth=-1):
# 
# Path: haystack/mappings/folder.py
# MMAP_HACK_ACTIVE = True
# MAX_MAPPING_SIZE_FOR_MMAP = 1024 * 1024 * 20
# class LazyLoadingException(Exception):
# class MemoryDumpLoader(interfaces.IMemoryLoader):
# class ProcessMemoryDumpLoader(MemoryDumpLoader):
# class LazyProcessMemoryDumpLoader(ProcessMemoryDumpLoader):
# class VeryLazyProcessMemoryDumpLoader(LazyProcessMemoryDumpLoader):
# class FolderLoader(interfaces.IMemoryLoader):
#     def __init__(self, filename):
#     def __init__(self, dumpname, bits=None, os_name=None):
#     def make_memory_handler(self):
#     def _is_valid(self):
#     def _load_mappings(self):
#     def _is_valid(self):
#     def _test_dir(self):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_mappings(self):
#     def _load_metadata(self):
#     def _load_memory_mappings(self):
#     def __init__(self, dumpname, maps_to_load=None, bits=None, os_name=None):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_memory_mappings(self):
# def load(dumpname, bits=None, os_name=None):
#     def __init__(self, opts):
#     def make_memory_handler(self):


import argparse
import logging
import struct
import sys
from haystack import cli
from haystack import argparse_utils
from haystack.outputters import text
from haystack.mappings import folder
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import print_function



# from haystack.outputters import python

"""
Search for HEAP.
"""

log = logging.getLogger('cliwin')


def find_heap():
    argv = sys.argv[1:]
    parser = cli.base_argparser('haystack-find-heap', "Find heaps in a dumpfile")
    parser.add_argument('--verbose', '-v', action='store_true', help='Verbose')
    parser.add_argument('--mappings', '-m', action='store_true', help='Show mappings')
    # only if address is present
    group = parser.add_argument_group('For a specific HEAP')
    group.add_argument('address', nargs='?', type=argparse_utils.int16, default=None, help='Load Heap from address (hex)')
    group.add_argument('--heap', '-p', action='store_true', help='Show the heap content')
    group.add_argument('--frontend', '-f', action='store_true', help='Show the frontend heap content')

    opts = parser.parse_args(argv)

# Path: haystack/cli.py
# SEARCH_DESC = 'Search for instance of a record_type in the allocated memory of a process. '
# SHOW_DESC = 'Cast the bytes at this address into a record_type. '
# WATCH_DESC = 'Cast the bytes at this address into a record_type and refresh regularly. '
# DUMP_DESC = 'Extract the process dump from the OS memory dump in haystack format. '
# DUMPTYPE_BASE = 'haystack'
# DUMPTYPE_VOLATILITY = 'volatility'
# DUMPTYPE_REKALL = 'rekall'
# DUMPTYPE_LIVE = 'live'
# DUMPTYPE_MINIDUMP = 'minidump'
# DUMPTYPE_FRIDA = 'frida'
# SUPPORTED_DUMP_URI = {}
# DUMPTYPE_BASE_DESC = 'The process dump is a folder produced by a haystack-dump script.'
# DUMPTYPE_VOL_DESC = 'The process dump is a volatility OS dump. The PID is the targeted process.'
# DUMPTYPE_REKALL_DESC = 'The process dump is a rekall OS dump. The PID is the targeted process.'
# DUMPTYPE_LIVE_DESC = 'The PID must be a running process.'
# DUMPTYPE_MINIDUMP_DESC = 'The process dump is a Minidump (MDMP) process dump.'
# def url(u):
# def make_memory_handler(opts):
# def get_output(memory_handler, results, rtype):
# def dump_process(opts):
# def search_cmdline(args):
# def show_cmdline(args):
# def check_varname_for_type(memory_handler, varname, struct_type):
# def get_varname_value(varname, instance):
# def watch(args):
# def base_argparser(program_name, description):
# def search_argparser(search_parser):
# def show_argparser(show_parser):
# def watch_argparser(watch_parser):
# def dump_argparser(dump_parser):
# def output_argparser(rootparser):
# def set_logging_level(opts):
# def live_watch():
# def volatility_dump():
# def rekall_dump():
# def search():
# def show():
# class HaystackError(Exception):
# 
# Path: haystack/argparse_utils.py
# def readable(f):
# def writeable(f):
# def int16(s):
# 
# Path: haystack/outputters/text.py
# class RecursiveTextOutputter(Outputter):
#     def parse(self, obj, prefix='', depth=10, addr_was=None):
#     def _attrToString(self, attr, field, attrtype, prefix, addr, depth=-1):
# 
# Path: haystack/mappings/folder.py
# MMAP_HACK_ACTIVE = True
# MAX_MAPPING_SIZE_FOR_MMAP = 1024 * 1024 * 20
# class LazyLoadingException(Exception):
# class MemoryDumpLoader(interfaces.IMemoryLoader):
# class ProcessMemoryDumpLoader(MemoryDumpLoader):
# class LazyProcessMemoryDumpLoader(ProcessMemoryDumpLoader):
# class VeryLazyProcessMemoryDumpLoader(LazyProcessMemoryDumpLoader):
# class FolderLoader(interfaces.IMemoryLoader):
#     def __init__(self, filename):
#     def __init__(self, dumpname, bits=None, os_name=None):
#     def make_memory_handler(self):
#     def _is_valid(self):
#     def _load_mappings(self):
#     def _is_valid(self):
#     def _test_dir(self):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_mappings(self):
#     def _load_metadata(self):
#     def _load_memory_mappings(self):
#     def __init__(self, dumpname, maps_to_load=None, bits=None, os_name=None):
#     def _protected_open_file(self, mmap_fname, mmap_pathname):
#     def _load_memory_mappings(self):
# def load(dumpname, bits=None, os_name=None):
#     def __init__(self, opts):
#     def make_memory_handler(self):


# Path: haystack/cliwin.py
import argparse
import logging
import struct
import sys
from haystack import cli
from haystack import argparse_utils
from haystack.outputters import text
from haystack.mappings import folder

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import print_function



# from haystack.outputters import python

"""
Search for HEAP.
"""

log = logging.getLogger('cliwin')


def find_heap():
    argv = sys.argv[1:]
    parser = cli.base_argparser('haystack-find-heap', "Find heaps in a dumpfile")
    parser.add_argument('--verbose', '-v', action='store_true', help='Verbose')
    parser.add_argument('--mappings', '-m', action='store_true', help='Show mappings')
    # only if address is present
    group = parser.add_argument_group('For a specific HEAP')
    group.add_argument('address', nargs='?', type=argparse_utils.int16, default=None, help='Load Heap from address (hex)')
    group.add_argument('--heap', '-p', action='store_true', help='Show the heap content')
    group.add_argument('--frontend', '-f', action='store_true', help='Show the frontend heap content')

    opts = parser.parse_args(argv)

    cli.set_logging_level(opts)