metasm 1.0.1 → 1.0.2

data/samples/dbg-plugins/heapscan/compiled_heapscan_win.c

@@ -0,0 +1,128 @@
+typedef uintptr_t VALUE;
+static VALUE const_WindowsHeap;
+VALUE rb_ary_new(void);
+VALUE rb_ary_push(VALUE, VALUE);
+extern VALUE *rb_cObject __attribute__((import));
+VALUE rb_const_get(VALUE, VALUE);
+void rb_define_method(VALUE, char*, VALUE(*)(), int);
+VALUE rb_funcall(VALUE recv, unsigned int id, int nargs, ...);
+VALUE rb_intern(char*);
+VALUE rb_iv_get(VALUE, char*);
+VALUE rb_hash_aset(VALUE, VALUE, VALUE);
+VALUE rb_hash_aref(VALUE, VALUE);
+VALUE rb_uint2inum(VALUE);
+VALUE rb_num2ulong(VALUE);
+char *rb_string_value_ptr(VALUE*);
+VALUE rb_gc_enable(void);
+VALUE rb_gc_disable(void);
+
+#include "winheap.h"
+
+#define INT2FIX(i) (((i) << 1) | 1)
+
+static VALUE m_WindowsHeap23scan_heap_segment(VALUE self, VALUE vfirst, VALUE vlen)
+{
+	char *heapcpy;
+	struct _HEAP_ENTRY *he;
+	VALUE chunks;
+	VALUE first = rb_num2ulong(vfirst);
+	VALUE len = vlen >> 1;
+	VALUE off;
+	VALUE page;
+	VALUE sz;
+
+	chunks = rb_iv_get(self, "@chunks");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len));
+	heapcpy = rb_string_value_ptr(&page);
+
+	rb_gc_disable();
+	off = 0;
+	while (off < len) {
+		he = heapcpy + off;
+		if (he->Flags & 1) {
+			sz = (VALUE)he->Size*8;
+			if (sz > he->UnusedBytes)
+				sz -= he->UnusedBytes;
+			else
+				sz = 0;
+			rb_hash_aset(chunks, rb_uint2inum(first+off+sizeof(*he)), INT2FIX(sz));
+		}
+		off += he->Size*8;
+	}
+	rb_gc_enable();
+
+	return 4;
+}
+
+static VALUE m_WindowsHeap23scan_heap_segment_xr(VALUE self, VALUE vfirst, VALUE vlen)
+{
+	char *heapcpy;
+	struct _HEAP_ENTRY *he;
+	VALUE chunks;
+	VALUE first = rb_num2ulong(vfirst);
+	VALUE len = vlen >> 1;
+	VALUE off;
+	VALUE page;
+	VALUE xrchunksto = rb_iv_get(self, "@xrchunksto");
+	VALUE xrchunksfrom = rb_iv_get(self, "@xrchunksfrom");
+
+	chunks = rb_iv_get(self, "@chunks");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len));
+	heapcpy = rb_string_value_ptr(&page);
+
+	rb_gc_disable();
+	off = 0;
+	VALUE *ptr0, base, cklen;
+	while (off < len) {
+		he = heapcpy + off;
+		// address of the chunk
+		base = first + off + sizeof(*he);
+		if ((he->Flags & 1) && 
+		    (((cklen = rb_hash_aref(chunks, rb_uint2inum(base)))|4) != 4)) {
+			cklen /= 2*sizeof(void*);	// /2 == FIX2INT
+			// pointer to the data for the chunk in our copy of the heap from pagecache
+			ptr0 = (VALUE*)(heapcpy + off + sizeof(*he));
+			VALUE tabto = 0;
+			VALUE tabfrom;
+			while (cklen--) {
+				VALUE p = *ptr0++;
+				//if (p == base)	// ignore self-references
+				//	continue;
+				if ((rb_hash_aref(chunks, rb_uint2inum(p))|4) != 4) {
+					if (!tabto) {
+						tabto = rb_ary_new();
+						rb_hash_aset(xrchunksto, rb_uint2inum(base), tabto);
+					}
+					rb_ary_push(tabto, rb_uint2inum(p));
+
+					tabfrom = rb_hash_aref(xrchunksfrom, rb_uint2inum(p));
+					if ((tabfrom|4) == 4) {
+						tabfrom = rb_ary_new();
+						rb_hash_aset(xrchunksfrom, rb_uint2inum(p), tabfrom);
+					}
+					rb_ary_push(tabfrom, rb_uint2inum(base));
+				}
+			}
+		}
+		if (!he->Size)
+			break;
+		off += he->Size*8;
+	}
+	rb_gc_enable();
+
+	return 4;
+}
+
+static void do_init_once(void)
+{
+	const_WindowsHeap = rb_const_get(*rb_cObject, rb_intern("Metasm"));
+	const_WindowsHeap = rb_const_get(const_WindowsHeap, rb_intern("WindowsHeap"));
+	rb_define_method(const_WindowsHeap, "scan_heap_segment", m_WindowsHeap23scan_heap_segment, 2);
+	rb_define_method(const_WindowsHeap, "scan_heap_segment_xr", m_WindowsHeap23scan_heap_segment_xr, 2);
+}
+
+int Init_compiled_heapscan_win __attribute__((export))(void)
+{
+	do_init_once();
+	return 0;
+}

data/samples/dbg-plugins/heapscan/graphheap.rb

@@ -0,0 +1,616 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+module ::Metasm
+module Gui
+class GraphHeapWidget < GraphViewWidget
+	attr_accessor :heap, :addr_struct, :snapped
+	# addr_struct = 0x234 => AllocCStruct
+
+	def set_color_arrow(b1, b2)
+		if b1 == @caret_box or b2 == @caret_box
+			draw_color :arrow_hl
+		else
+			draw_color :arrow_cond
+		end
+	end
+
+	def setup_contextmenu(b, m)
+		addsubmenu(m, '_follow pointer') {
+			next if not lm = b[:line_member][@caret_y]
+			addr = b[:line_struct][@caret_y][lm]
+			next if not @heap.chunks[addr]
+			if lm.kind_of?(::Integer)
+				t = b[:line_struct][@caret_y].struct.type
+			else
+				t = lm.type
+			end
+			if t.pointer? and t.pointed.untypedef.kind_of? C::Union
+				@heap.chunk_struct[addr] ||= t.pointed.untypedef
+			end
+			st = @heap.chunk_struct[addr] || create_struct(addr)
+			ed = @dasm.get_edata_at(addr)
+			@addr_struct[addr] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr)
+			gui_update
+		}
+		addsubmenu(m, '_hide box') {
+			@selected_boxes.each { |sb|
+				@addr_struct.delete sb.id if @addr_struct.length > 1
+			}
+			@curcontext.root_addrs = struct_find_roots(@addr_struct.keys.first)
+			gui_update
+		}
+		super(b, m)
+	end
+
+	def keypress(k)
+		case k
+		when ?u
+			# update display (refresh struct member values)
+			@parent_widget.parent_widget.console.commands['refresh'][]
+			gui_update
+		when ?t
+			# change struct field type
+			if @selected_boxes.length > 1
+				# mass-retype chunks
+				st = @addr_struct[@selected_boxes[0].id].struct
+				inputbox("replacement struct for selected chunks", :text => st.name) { |n|
+					next if not nst = @heap.cp.toplevel.struct[n]
+					@selected_boxes.each { |sb|
+						as = @addr_struct[sb.id]
+						@heap.chunk_struct[sb.id] = nst
+						@addr_struct[sb.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff)
+					}
+					gui_update
+				}
+			elsif b = @caret_box
+				if @caret_y == 0
+					as = @addr_struct[b.id]
+					st = as.struct
+					inputbox("replacement struct for #{st.name}", :text => st.name) { |n|
+						next if not nst = @heap.cp.toplevel.struct[n]
+						@heap.chunk_struct[b.id] = nst
+						@addr_struct[b.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff)
+						gui_update
+					}
+				elsif m = b[:line_member][@caret_y]
+					if m.kind_of?(Integer)
+						# XXX Array, need to find the outer struct
+						mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+						ar = b[:line_struct][@caret_y]
+						st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+						raise '?' if not st
+						st = st.struct
+						m = st.fldlist[mn]
+					else
+						st = b[:line_struct][@caret_y].struct
+					end
+					inputbox("new type for #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn|
+						nil while @heap.cp.readtok
+						@heap.cp.lexer.feed nn
+						if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true)
+							nil while @heap.cp.readtok
+							raise 'bad type'
+						end
+						v.parse_declarator(@heap.cp, @heap.cp.toplevel)
+						nt = v.type
+						nsz = @heap.cp.sizeof(nt)
+						osz = @heap.cp.sizeof(m)
+						if nsz > osz and st.kind_of?(C::Struct)
+							idx = st.members.index(m)
+							# eat next members
+							while nsz > osz
+								break if idx+1 >= st.members.length
+								sz = @heap.cp.sizeof(st.members.delete_at(idx+1))
+								osz += sz
+							end
+						end
+						if nsz < osz and st.kind_of?(C::Struct)
+							idx = st.members.index(m)
+							pos = st.offsetof(@heap.cp, m)
+							# fill gap with bytes
+							idx += 1
+							while nsz < osz
+								st.members[idx, 0] = [C::Variable.new(('unk_%x' % (pos+nsz)), C::BaseType.new(:__int8, :unsigned))]
+								idx += 1
+								nsz += 1
+							end
+						end
+						m.type = nt
+						st.update_member_cache(@heap.cp)
+						gui_update
+					}
+
+				end
+			end
+		when ?n
+			# rename struct field
+			if b = @caret_box
+				if @caret_y == 0
+					st = @addr_struct[b.id].struct
+					inputbox("new name for #{st.name}", :text => st.name) { |nn|
+						raise "struct #{nn} already exists (try 't')" if @heap.cp.toplevel.struct[nn]
+						@heap.cp.toplevel.struct[nn] = @heap.cp.toplevel.struct.delete(st.name)
+						st.name = nn
+						gui_update
+					}
+				elsif m = b[:line_member][@caret_y]
+					if m.kind_of?(Integer)
+						mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+						ar = b[:line_struct][@caret_y]
+						st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+						raise '?' if not st
+						st = st.struct
+						m = st.fldlist[mn]
+					else
+						st = b[:line_struct][@caret_y].struct
+					end
+					inputbox("new name for #{m.name}", :text => m.name) { |nn|
+						m.name = nn
+						st.update_member_cache(@heap.cp)
+						gui_update
+					}
+				end
+			end
+		when ?e
+			# edit struct field value under the cursor
+			if b = @caret_box
+				# TODO b[:struct][line], b.[:member][line] (int for Arrays)
+				st = b[:line_struct][@caret_y]
+				mb = b[:line_member][@caret_y]
+				if st and mb
+					if mb.kind_of?(C::Variable) and mb.type.kind_of?(C::Array) and mb.type.type.kind_of?(C::BaseType) and mb.type.type.name == :char
+						defval = st[mb].to_array.pack('C*').gsub(/\0*$/, '').gsub(/[^\x20-\x7e]/, '.')
+						string = true
+					else
+						defval = st[mb]
+						string = false
+					end
+					inputbox("new value for #{mb.respond_to?(:name) ? mb.name : mb}", :text => defval.to_s) { |nn|
+						if string
+							am = st[mb]
+							(nn.unpack('C*') + [0]).each_with_index { |b_, i| am[i] = b_ }
+						else
+							st[mb] = Expression.parse_string(nn).reduce
+						end
+						gui_update
+					}
+				end
+			end
+		when ?x
+			# show heap xrefs to the hilighted chunk
+			if b = @caret_box
+				list = [['address', 'size']]
+				@heap.xrchunksfrom[b.id].to_a.each { |a|
+					list << [Expression[a], Expression[@heap.chunks[a]]]
+				}
+				if list.length == 1
+					messagebox "no xref to #{Expression[b.id]}"
+				else
+					listwindow("heap xrefs to #{Expression[b.id]}", list) { |i| @parent_widget.focus_addr(i[0], nil, true) }
+				end
+			end
+		when ?I
+			# insert new field in struct
+			if b = @caret_box
+				if m = b[:line_member][@caret_y]
+					if m.kind_of?(Integer)
+						# XXX Array, need to find the outer struct
+						mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+						ar = b[:line_struct][@caret_y]
+						st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+						raise '?' if not st
+						st = st.struct
+						m = st.fldlist[mn]
+					else
+						st = b[:line_struct][@caret_y].struct
+					end
+					inputbox("new type to insert before #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn|
+						nil while @heap.cp.readtok
+						@heap.cp.lexer.feed nn
+						if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true)
+							nil while @heap.cp.readtok
+							raise 'bad type'
+						end
+						v.parse_declarator(@heap.cp, @heap.cp.toplevel)
+						nt = v.type
+						idx = st.members.index(m)
+						pos = st.offsetof(@heap.cp, m)
+						name = oname = v.name || ('unk_%x_new' % pos)
+						cntr = 0
+						while st.members.find { |m_| m_.name == name }
+							name = oname + "_#{cntr+=1}"
+						end
+						st.members[idx, 0] = [C::Variable.new(name, nt)]
+						st.update_member_cache(@heap.cp)
+						gui_update
+					}
+
+				end
+			end
+		when ?S
+			# delete structure field
+			if b = @caret_box
+				if m = b[:line_member][@caret_y]
+					if m.kind_of?(Integer)
+						# XXX Array, need to find the outer struct
+						mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+						ar = b[:line_struct][@caret_y]
+						st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+						raise '?' if not st
+						st = st.struct
+						m = st.fldlist[mn]
+					else
+						st = b[:line_struct][@caret_y].struct
+					end
+					inputbox("delete #{m.name} ?") { |nn|
+						idx = st.members.index(m)
+						st.members.delete_at(idx)
+						st.update_member_cache(@heap.cp)
+						gui_update
+					}
+
+				end
+			end
+		when ?+
+			# append blocks linked from the currently shown blocks to the display
+			@addr_struct.keys.each { |ak|
+				@heap.xrchunksto[ak].to_a.each { |nt|
+					next if @addr_struct[nt]
+					# TODO check if the pointer is a some_struct*
+					st = @heap.chunk_struct[nt] || create_struct(nt)
+					ed = @dasm.get_edata_at(nt)
+					@addr_struct[nt] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr)
+				}
+			}
+			gui_update
+		when ?-
+			# remove graph leaves in an attempt to undo ?+
+			unk = @addr_struct.keys.find_all { |ak|
+				(@heap.xrchunksto[ak].to_a & @addr_struct.keys).empty?
+			}
+			unk.each { |ak| @addr_struct.delete ak if @addr_struct.length > 1 }
+			gui_update
+		else return super(k)
+		end
+		true
+	end
+
+	# create the graph objects in ctx
+	def build_ctx(ctx)
+		# create boxes
+		todo = ctx.root_addrs.dup & @addr_struct.keys
+		todo << @addr_struct.keys.first if todo.empty?
+		done = []
+		while a = todo.shift
+			next if done.include? a
+			done << a
+			ctx.new_box a, :line_text_col => [], :line_address => [], :line_struct => [], :line_member => []
+			todo.concat @heap.xrchunksto[a].to_a & @addr_struct.keys
+		end
+
+		# link boxes
+		if (@heap.xrchunksto[ctx.box.first.id].to_a & @addr_struct.keys).length == ctx.box.length - 1
+			ot = ctx.box[0].id
+			ctx.box[1..-1].each { |b_|
+				ctx.link_boxes(ot, b_.id)
+			}
+		else
+			ctx.box.each { |b|
+				@heap.xrchunksto[b.id].to_a.each { |t|
+					ctx.link_boxes(b.id, t) if @addr_struct[t]
+				}
+			}
+		end
+
+		if snapped
+			@datadiff = {}
+		end
+
+		# calc box dimensions/text
+		ctx.box.each { |b|
+			colstr = []
+			curaddr = b.id
+			curst = @addr_struct[b.id]
+			curmb = nil
+			margin = ''
+			start_addr = curaddr
+			if snapped
+				ghosts = snapped[curaddr]
+			end
+			line = 0
+			render = lambda { |str, col| colstr << [str, col] }
+			nl = lambda {
+				b[:line_address][line] = curaddr
+				b[:line_text_col][line] = colstr
+				b[:line_struct][line] = curst
+				b[:line_member][line] = curmb
+				colstr = []
+				line += 1
+			}
+			render_val = lambda { |v|
+				if v.kind_of?(::Integer)
+					if v > 0x100
+						render['0x%X' % v, :text]
+					elsif v < -0x100
+						render['-0x%X' % -v, :text]
+					else
+						render[v.to_s, :text]
+					end
+				elsif not v
+					render['NULL', :text]
+				else
+					render[v.to_s, :text]
+				end
+			}
+			render_st = nil
+			render_st_ar = lambda { |ast, m|
+				elemt = m.type.untypedef.type.untypedef
+				if elemt.kind_of?(C::BaseType) and elemt.name == :char
+					render[margin, :text]
+					render["#{m.type.type.to_s[1...-1]} #{m.name}[#{m.type.length}] = #{ast[m].to_array.pack('C*').sub(/\0.*$/m, '').inspect}", :text]
+					nl[]
+					curaddr += ast.cp.sizeof(m)
+				else
+					t = m.type.type.to_s[1...-1]
+					tsz = ast.cp.sizeof(m.type.type)
+					fust = curst
+					fumb = curmb
+					curst = ast[m]
+					ast[m].to_array.each_with_index { |v, i|
+						curmb = i
+						render[margin, :text]
+						if elemt.kind_of?(C::Union)
+							if m.type.untypedef.type.kind_of?(C::Union)
+								render[elemt.kind_of?(C::Struct) ? 'struct ' : 'union ', :text]
+								render["#{elemt.name} ", :text] if elemt.name
+							else # typedef
+								render["#{elemt.to_s[1...-1]} ", :text]
+							end
+							render_st[v]
+							render[" #{m.name}[#{i}]", :text]
+						else
+							render["#{t} #{m.name}[#{i}] = ", :text]
+							render_val[v]
+							@datadiff[curaddr] = true if ghosts and ghosts.all? { |g| g[curaddr-start_addr, tsz] == ghosts[0][curaddr-start_addr, tsz] } and ghosts[0][curaddr-start_addr, tsz] != ast.str[curaddr, tsz].to_str
+						end
+						render[';', :text]
+						nl[]
+						curaddr += tsz
+					}
+					curst = fust
+					curmb = fumb
+				end
+			}
+			render_st = lambda { |ast|
+				st_addr = curaddr
+				oldst = curst
+				oldmb = curmb
+				oldmargin = margin
+				render['{', :text]
+				nl[]
+				margin += '    '
+				curst = ast
+				ast.struct.members.each { |m|
+					curmb = m
+					curaddr = st_addr + ast.struct.offsetof(@heap.cp, m)
+
+					if bo = ast.struct.bitoffsetof(@heap.cp, m)
+						# float curaddr to make ghost hilight work on bitfields
+						curaddr += (1+bo[0])/1000.0
+					end
+
+					if m.type.untypedef.kind_of?(C::Array)
+						render_st_ar[ast, m]
+					elsif m.type.untypedef.kind_of?(C::Union)
+						render[margin, :text]
+						if m.type.kind_of?(C::Union)
+							render[m.type.kind_of?(C::Struct) ? 'struct ' : 'union ', :text]
+							render["#{m.type.name} ", :text] if m.type.name
+						else # typedef
+							render["#{m.type.to_s[1...-1]} ", :text]
+						end
+						oca = curaddr
+						render_st[ast[m]]
+						nca = curaddr
+						curaddr = oca
+						render[" #{m.name if m.name};", :text]
+						nl[]
+						curaddr = nca
+					else
+						render[margin, :text]
+						render["#{m.type.to_s[1...-1]} ", :text]
+						render["#{m.name} = ", :text]
+						render_val[ast[m]]
+						tsz = ast.cp.sizeof(m)
+						# TODO bit-level multighosting
+						if ghosts and ghosts.all? { |g| g[curaddr.to_i-start_addr, tsz] == ghosts[0][curaddr.to_i-start_addr, tsz] } and ghosts[0][curaddr.to_i-start_addr, tsz] != ast.str[curaddr.to_i, tsz].to_str
+							if bo
+								ft = C::BaseType.new((bo[0] + bo[1] > 32) ? :__int64 : :__int32)
+								v1 = @heap.cp.decode_c_value(ghosts[0][curaddr.to_i-start_addr, tsz], ft, 0)
+								v2 = @heap.cp.decode_c_value(ast.str[curaddr.to_i, tsz], ft, 0)
+								@datadiff[curaddr] = true if (v1 >> bo[0]) & ((1 << bo[1])-1) != (v2 >> bo[0]) & ((1 << bo[1])-1)
+							else
+								@datadiff[curaddr] = true
+							end
+						end
+						render[';', :text]
+
+						if m.type.kind_of?(C::Pointer) and m.type.type.kind_of?(C::BaseType) and m.type.type.name == :char
+							if s = @dasm.decode_strz(ast[m], 32)
+								render["    // #{s.inspect}", :comment]
+							end
+						end
+						nl[]
+						curaddr += tsz
+						curaddr = curaddr.to_i if bo
+					end
+				}
+				margin = oldmargin
+				curst = oldst
+				curmb = oldmb
+				render[margin, :text]
+				render['}', :text]
+			}
+			ast = @addr_struct[curaddr]
+			render["struct #{ast.struct.name} *#{'0x%X' % curaddr} = ", :text]
+			render_st[ast]
+			render[';', :text]
+			nl[]
+
+			b.w = b[:line_text_col].map { |strc| strc.map { |s, c| s }.join.length }.max.to_i * @font_width + 2
+			b.w += 1 if b.w % 2 == 0
+			b.h = line * @font_height
+		}
+	end
+
+	def struct_find_roots(addr)
+		addr = @addr_struct.keys.find { |a| addr >= a and addr < a+@addr_struct[a].sizeof } if not @addr_struct[addr]
+
+		todo = [addr]
+		done = []
+		roots = []
+		default_root = nil
+		while a = todo.shift
+			if done.include?(a) # cycle
+				default_root ||= a
+				next
+			end
+			done << a
+			newf = @heap.xrchunksfrom[a].to_a & @addr_struct.keys
+			if newf.empty?
+				roots << a
+			else
+				todo.concat newf
+			end
+		end
+		roots << default_root if roots.empty? and default_root
+
+		roots
+	end
+
+	def focus_addr(addr, fu=nil)
+		return if @parent_widget and not addr = @parent_widget.normalize(addr)
+
+		# move window / change curcontext
+		if b = @curcontext.box.find { |b_| b_[:line_address].index(addr) }
+			@caret_box, @caret_x, @caret_y = b, 0, b[:line_address].rindex(addr)
+			@curcontext.view_x += (width/2 / @zoom - width/2)
+			@curcontext.view_y += (height/2 / @zoom - height/2)
+			@zoom = 1.0
+
+			focus_xy(b.x, b.y + @caret_y*@font_height)
+			update_caret
+		elsif addr_struct and (@addr_struct[addr] or @addr_struct.find { |a, s| addr >= a and addr < a+s.sizeof })
+			@curcontext = Graph.new 'testic'
+			@curcontext.root_addrs = struct_find_roots(addr)
+			@want_focus_addr = addr
+			gui_update
+		elsif @heap.chunks[addr]
+			@want_focus_addr = addr
+			do_focus_addr(addr)
+		else
+			return
+		end
+		true
+	end
+
+	def do_focus_addr(addr)
+		st = @heap.chunk_struct[addr] || create_struct(addr)
+
+		ed = @dasm.get_edata_at(addr)
+		@addr_struct = { addr => @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr) }
+		gui_update
+	end
+
+	# create the struct chunk_<addr>, register it in @heap.chunk_struct
+	def create_struct(addr)
+		raise "no chunk here" if not @heap.chunks[addr]
+
+		ptsz = @dasm.cpu.size/8
+
+		# check if this is a c++ object with RTTI info
+		vptr = @dasm.decode_dword(addr)
+		rtti = @dasm.decode_dword(vptr-ptsz)
+		case OS.shortname
+		when 'winos'
+			typeinfo = @dasm.decode_dword(rtti+3*ptsz) if rtti
+			if typeinfo and s = @dasm.decode_strz(typeinfo+3*ptsz)
+				rtti_name = s[/^(.*)@@$/, 1]	# remove trailing @@
+			end
+		when 'linos'
+			typeinfo = @dasm.decode_dword(rtti+ptsz) if rtti
+			if typeinfo and s = @dasm.decode_strz(typeinfo)
+				rtti_name = s[/^[0-9]+(.*)$/, 1]	# remove leading number
+			end
+		end
+
+		if rtti_name and st = @heap.cp.toplevel.struct[rtti_name]
+			return @heap.chunk_struct[addr] = st
+		end
+
+		st = C::Struct.new
+		st.name = rtti_name || "chunk_#{'%x' % addr}"
+		st.members = []
+		li = 0
+		(@heap.chunks[addr] / ptsz).times { |i|
+			n = 'unk_%x' % (ptsz*i)
+			v = @dasm.decode_dword(addr+ptsz*i)
+			if i == 0 and rtti_name
+				t = C::Pointer.new(C::Pointer.new(C::BaseType.new(:void)))
+				n = 'vtable'
+			elsif @heap.chunks[v]
+				t = C::Pointer.new(C::BaseType.new(:void))
+			else
+				t = C::BaseType.new("__int#{ptsz*8}".to_sym, :unsigned)
+			end
+			st.members << C::Variable.new(n, t)
+			li = i+1
+		}
+		(@heap.chunks[addr] % ptsz).times { |i|
+			n = 'unk_%x' % (ptsz*li+i)
+			t = C::BaseType.new(:char, :unsigned)
+			st.members << C::Variable.new(n, t)
+		}
+		@heap.cp.toplevel.struct[st.name] = st
+		@heap.chunk_struct[addr] = st
+	end
+
+	def snap
+		if not snapped
+			@datadiff = {}
+			ocb = @parent_widget.bg_color_callback
+			@parent_widget.bg_color_callback = lambda { |a|
+				if @datadiff[a]
+					'f88'
+				elsif ocb
+					ocb[a]
+				end
+			}
+		end
+		@snapped = {}
+		@addr_struct.each { |a, ast|
+			@snapped[a] = [ast.str[ast.stroff, ast.sizeof].to_str]
+		}
+	end
+
+	def snap_add
+		return snap if not snapped
+		@addr_struct.each { |a, ast|
+			(@snapped[a] ||= []) << ast.str[ast.stroff, ast.sizeof].to_str
+		}
+	end
+
+	def get_cursor_pos
+		[super, addr_struct]
+	end
+
+	def set_cursor_pos(p)
+		s, @addr_struct = p
+		super(s)
+	end
+end
+end
+end