Scan Memory Sanpshot
DeepBits Memory Dump API
The DeepBits Memory Dump API provides a set of endpoints to analyze and identify thread in your memory dump file.
Currently, we supported the memory dumps generated using this open-source project.
You can check the API spec by the memory dump api specification doc.
Demo Code
import requests
import hashlib
import os
import time
# Update these two
API_KEY = ''
FILE_TO_UPLOAD = '' # sample.lime
API_BASE = 'https://api.deepbits.com/api/v1'
default_headers = {"x-api-key": API_KEY}
def upload_file(file_path, api_key):
with open(file_path, "rb") as f:
file_contents = f.read()
print(f"Get upload URL for {os.path.basename(file_path)}...")
file_name = os.path.basename(file_path)
upload_url_response = requests.post(
f"{API_BASE}/mdump/upload_url",
json={"fileName": file_name},
headers=default_headers
)
print(upload_url_response)
if (upload_url_response.json()['meta']['code'] == 403):
print("API key is invalid")
raise Exception("API key is invalid")
put_url = upload_url_response.json()['data']['uploadUrl']
headers = {
"Content-Type": "application/octet-stream",
"x-api-key": api_key,
}
print(f"Upload {os.path.basename(file_path)} to S3...")
response = requests.put(
put_url,
data=file_contents,
headers=headers
)
print(f"Trigger upload_success...")
upload_success_response = requests.put(
f"{API_BASE}/mdump/upload_success",
json={
"path": upload_url_response.json()['data']['path'],
"hash": hashlib.sha256(file_contents).hexdigest(),
"fileName": os.path.basename(file_path),
"tags": ["tag1", "tag2"]
},
headers=default_headers
)
print(f"Upload Success Response: {upload_success_response.json()}\n")
return upload_success_response.json()
def get_detail(detail_id):
response = requests.get(
f"{API_BASE}/mdump/detail/{detail_id}",
headers=default_headers,
)
return response.json()
# upload file
upload_res = upload_file(FILE_TO_UPLOAD, API_KEY)
detail_id = upload_res['data']['_id']
# check scan status
detail_res = get_detail(detail_id)
print('sample detail')
print(detail_res)
print("Demo run successfully without error, get API docs on https://docs.deepbits.com/reference/scanmemorydumpid")
Notes
This guide will show you how to generate your API KEY.
Updated 9 months ago