windbg javascript脚本--将内存内容保存到文件

//将内存内容写入到文件
//by 鸟哥 1833183060
//使用示例：!mem2file 0x000002b57556b858,0xbb
"use strict";
let console={}
console.log=host.diagnostics.debugLog
let handle=0;
let log2file=function(e){
    //host.diagnostics.debugLog(e+'
')
    try{
        writeFile(e);
    }catch(ex){
        logln("error:"+ex.toString());
    }
}
let logln=function(e){
    host.diagnostics.debugLog(e+'
')
    
}
let path = "D:\mywork\github\windbg\vlx\mem.txt";
var file=null;
//读写文件 https://github.com/microsoft/WinDbg-Samples/blob/master/FileSystem/FileSystemSample.js
//https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/dbgmodel-namespace-file-system
function initLogFile(){
    if(host.namespace.Debugger.Utility.FileSystem.FileExists(path)){
        file = host.namespace.Debugger.Utility.FileSystem.OpenFile(path);
    }else{
        file = host.namespace.Debugger.Utility.FileSystem.CreateFile(path,"CreateNew");
    }
}
//注意每次打开文件后文件指针会指向文件头部。每次close后，文件内容才会真正写入到文件。也就是说 在命令行执行 dx @$scriptContents.closeFile() 后，内容才会写入到文件中。
function writeFile(d)
{
    initLogFile();
    let textWriter = host.namespace.Debugger.Utility.FileSystem.CreateTextWriter(file);
    textWriter.WriteLine(d);
    closeFile();
    
}
function closeFile(){
    if(file!=null){
        file.Close();
    }
}

function hex2str(hex){
    return hex.toString(16);
}
function 补全前置0(num, length) {  
    return (Array(length).join('0') + num).slice(-length);  
}
function printObj(obj){
    let str = "";
    for(let i in obj){
        let property=obj[i];
        str+=""+补全前置0(property.toString(16),2)+" ";
    }
    return str;
}

function mem2file(addr,size){
    if(typeof addr=='undefined'){
        let regs=host.currentThread.Registers.User
        addr=regs.rdx;
        size=regs.r8;
    }else{

    }
    let r=host.memory.readMemoryValues(addr,size);
    let content=printObj(r);
    
    host.diagnostics.debugLog("
"+content+"
")
    writeFile(content);
}
function test(adr){
    host.diagnostics.debugLog(typeof adr)
    host.diagnostics.debugLog("
"+adr.toString(16)+"
");
    host.diagnostics.debugLog("
"+adr+"
");
    host.diagnostics.debugLog('test1
');
}
// __CodeExtension:
//
// Provides an extension on Debugger.Utility.Code
//
class __CodeExtension
{
    TraceDataFlow(address)
    {
        
    }
}
// __InstructionExtension:
//
// Provides an extension on an instruction
//
class __InstructionExtension
{
    get SourceDataFlow()
    {
        return null;
    }
}
function invokeScript()
{    
    let control=host.namespace.Debugger.Utility.Control;
    let regs=host.currentThread.Registers.User;
    let currentprocess=host.currentProcess;

    logln('Press "g" to run the target.');
}
function initializeScript(){
    
    return [//new host.apiVersionSupport(1, 2),
        /*new host.namespacePropertyParent(__CodeExtension, "Debugger.Models.Utility", "Debugger.Models.Utility.Code", "Code"),
            new host.namedModelParent(__InstructionExtension, "Debugger.Models.Utility.Code.Instruction"),*/
        new host.functionAlias(test, "test"),
        new host.functionAlias(mem2file, "mem2file")
    ];
}

输出的文件截图