|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace Reli\Lib\PhpProcessReader; |
|
4
|
|
|
|
|
5
|
|
|
use Reli\Lib\PhpInternals\ZendTypeReaderCreator; |
|
6
|
|
|
use Reli\Lib\Process\MemoryMap\ProcessMemoryMapCreator; |
|
7
|
|
|
use Reli\Lib\Process\MemoryReader\MemoryReaderInterface; |
|
8
|
|
|
|
|
9
|
|
|
class PhpZendMemoryManagerChunkFinder |
|
10
|
|
|
{ |
|
11
|
|
|
public function __construct( |
|
12
|
|
|
private ProcessMemoryMapCreator $process_memory_map_creator, |
|
13
|
|
|
private ZendTypeReaderCreator $zend_type_reader_creator, |
|
14
|
|
|
) { |
|
15
|
|
|
} |
|
16
|
|
|
public function findAddress( |
|
17
|
|
|
int $pid, |
|
18
|
|
|
string $php_version, |
|
19
|
|
|
MemoryReaderInterface $memory_reader, |
|
20
|
|
|
): int { |
|
21
|
|
|
$zend_type_reader = $this->zend_type_reader_creator->create($php_version); |
|
22
|
|
|
$memory_map = $this->process_memory_map_creator->getProcessMemoryMap($pid); |
|
23
|
|
|
$process_memory_area = $memory_map->findByNameRegex('\[anon:zend_alloc\]'); |
|
24
|
|
|
foreach ($process_memory_area as $area) { |
|
25
|
|
|
$begin = hexdec($area->begin); |
|
26
|
|
|
$end = hexdec($area->end); |
|
27
|
|
|
for ($p = $begin; $p < $end; $p += 0x200000) { |
|
28
|
|
|
$zend_mm_chunk_buffer = $memory_reader->read( |
|
29
|
|
|
$pid, |
|
30
|
|
|
$p, |
|
|
|
|
|
|
31
|
|
|
$zend_type_reader->sizeOf('zend_mm_chunk'), |
|
32
|
|
|
); |
|
33
|
|
|
$zend_mm_chunk = $zend_type_reader->readAs('zend_mm_chunk', $zend_mm_chunk_buffer); |
|
34
|
|
|
$heap_address = \FFI::cast('long', $zend_mm_chunk->casted->heap)->cdata; |
|
35
|
|
|
[$offset,] = $zend_type_reader->getOffsetAndSizeOfMember('zend_mm_chunk', 'heap_slot'); |
|
36
|
|
|
if ( |
|
37
|
|
|
$heap_address === $p + $offset |
|
38
|
|
|
and $zend_mm_chunk->casted->num === 0 |
|
39
|
|
|
and $zend_mm_chunk->casted->heap_slot->size > 0 |
|
40
|
|
|
) { |
|
41
|
|
|
return $p; |
|
|
|
|
|
|
42
|
|
|
} |
|
43
|
|
|
} |
|
44
|
|
|
} |
|
45
|
|
|
return hexdec($process_memory_area[0]->begin); |
|
|
|
|
|
|
46
|
|
|
} |
|
47
|
|
|
} |