(self, location, length)
| 889 | return False |
| 890 | |
| 891 | def IsProbableExecutableRegion(self, location, length): |
| 892 | opcode_bytes = 0 |
| 893 | sixty_four = self.Is64() |
| 894 | for i in range(length): |
| 895 | loc = location + i |
| 896 | byte = ctypes.c_uint8.from_buffer(self.minidump, loc).value |
| 897 | if (byte == 0x8b or # mov |
| 898 | byte == 0x89 or # mov reg-reg |
| 899 | (byte & 0xf0) == 0x50 or # push/pop |
| 900 | (sixty_four and (byte & 0xf0) == 0x40) or # rex prefix |
| 901 | byte == 0xc3 or # return |
| 902 | byte == 0x74 or # jeq |
| 903 | byte == 0x84 or # jeq far |
| 904 | byte == 0x75 or # jne |
| 905 | byte == 0x85 or # jne far |
| 906 | byte == 0xe8 or # call |
| 907 | byte == 0xe9 or # jmp far |
| 908 | byte == 0xeb): # jmp near |
| 909 | opcode_bytes += 1 |
| 910 | opcode_percent = (opcode_bytes * 100) / length |
| 911 | threshold = 20 |
| 912 | if opcode_percent > threshold + 2: |
| 913 | return True |
| 914 | if opcode_percent > threshold - 2: |
| 915 | return None # Maybe |
| 916 | return False |
| 917 | |
| 918 | def FindRegion(self, addr): |
| 919 | answer = [-1, -1] |
no test coverage detected