Add support for root-address flag when reading from saved sample

Arcitectus · Oct 17, 2023 · 9c172c3 · 9c172c3
1 parent 09dacec
commit 9c172c3
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/implement/read-memory-64-bit/Program.cs b/implement/read-memory-64-bit/Program.cs
@@ -124,6 +124,22 @@ static int Main(string[] args)
                     return (memoryReader, uiRootCandidatesAddresses);
                 }
 
+                (IMemoryReader, IImmutableList<ulong>) GetMemoryReaderAndWithSpecifiedRootFromProcessSampleFile(byte[] processSampleFile, ulong rootAddress)
+                {
+                    var processSampleId = Pine.CommonConversion.StringBase16FromByteArray(
+                        Pine.CommonConversion.HashSHA256(processSampleFile));
+
+                    Console.WriteLine($"Reading from process sample {processSampleId}.");
+
+                    var processSampleUnpacked = ProcessSample.ProcessSampleFromZipArchive(processSampleFile);
+
+                    var memoryReader = new MemoryReaderFromProcessSample(processSampleUnpacked.memoryRegions);
+
+                    Console.WriteLine($"Reading UIRoot from specified address: {rootAddress}");
+
+                    return (memoryReader, ImmutableList<ulong>.Empty.Add(rootAddress));
+                }
+
                 (IMemoryReader, IImmutableList<ulong>) GetMemoryReaderAndRootAddresses()
                 {
                     if (processId.HasValue)
@@ -141,6 +157,11 @@ static int Main(string[] args)
                         throw new Exception("Where should I read from?");
                     }
 
+                    if (0 < rootAddressArgument?.Length)
+                    {
+                        return GetMemoryReaderAndWithSpecifiedRootFromProcessSampleFile(System.IO.File.ReadAllBytes(sourceFileArgument), ParseULong(rootAddressArgument));
+                    }
+
                     return GetMemoryReaderAndRootAddressesFromProcessSampleFile(System.IO.File.ReadAllBytes(sourceFileArgument));
                 }