#!/usr/bin/env python3
# gr_walk2.py - deeper walk: from the window memdesc records, follow the
# kernel pointers 2-3 levels and search for page-array records
# {vmap_cpu, flags, PA, 0x1000} (2+ consecutive) to recover the page lists.
import sys, struct
sys.path.insert(0, "/tmp")
import guest_pin_stream as gps

PAT_SIZE = struct.pack("<Q", 0x20000)
PAT_FLAGS = struct.pack("<Q", 0x03008000)

def is_pa(v):
    return 0x100000000 <= v < 0x180000000

def page_array_at(kc, va, n=0x400):
    """Return [(off, [PA,...])] for runs of {ptr,flags,PA,0x1000} records."""
    d = kc.read(va, n)
    if not d:
        return []
    out = []
    i = 0
    while i + 32 <= len(d):
        p, fl, pa, z = struct.unpack_from("<4Q", d, i)
        if z == 0x1000 and is_pa(pa) and gps.is_kern_ptr(p):
            run = [pa]
            j = i + 32
            while j + 32 <= len(d):
                p2, fl2, pa2, z2 = struct.unpack_from("<4Q", d, j)
                if z2 == 0x1000 and is_pa(pa2):
                    run.append(pa2)
                    j += 32
                else:
                    break
            if len(run) >= 2:
                out.append((i, run))
            i = j
        else:
            i += 8
    return out

def main():
    kc = gps.Kcore()
    if not kc.load():
        print("# kcore load failed"); return 1
    pov = kc.page_offset_base
    # find memdesc records (fast direct-map scan)
    found = []
    CH = 1 << 20
    pa = 0x100000000
    while pa < 0x180000000 and len(found) < 12:
        d = kc.read(pov + pa, CH)
        if d:
            st = 0
            while True:
                i = d.find(PAT_SIZE, st)
                if i < 0:
                    break
                st = i + 1
                if i + 16 <= len(d) and d[i+8:i+16] == PAT_FLAGS:
                    found.append((pa + i, d[i:i+0x40]))
        pa += CH
    print("# memdesc records: %d" % len(found))
    for (gpa, rec) in found:
        size, flags = struct.unpack_from("<QQ", rec, 0)
        wpa = struct.unpack_from("<Q", rec, 0x10)[0]
        print("rec@0x%x size=0x%x pa=0x%x" % (gpa, size, wpa))
        kptrs = [struct.unpack_from("<Q", rec, o)[0] for o in range(0x18, 0x40, 8)]
        for kp in kptrs:
            if not gps.is_kern_ptr(kp):
                continue
            # level 1: read the target, look for page arrays directly
            for arr in page_array_at(kc, kp):
                print("   L1 kptr 0x%x: page-array run at +0x%x: %s" %
                      (kp, arr[0], ["0x%x" % x for x in arr[1][:12]]))
            # level 2: follow pointers in the target
            d = kc.read(kp, 0x100)
            if not d:
                continue
            for o in range(0, 0x100, 8):
                p2 = struct.unpack_from("<Q", d, o)[0]
                if not gps.is_kern_ptr(p2):
                    continue
                for arr in page_array_at(kc, p2):
                    print("   L2 0x%x -> 0x%x: page-array at +0x%x: %s" %
                          (kp, p2, arr[0], ["0x%x" % x for x in arr[1][:12]]))
    return 0

if __name__ == "__main__":
    sys.exit(main())