BE memory extension for viewing data obtained by an external program

Download from http://www.nyangau.org/beexec/beexec.zip.

What it does

BEEXEC is a 'memory extension' helper module which provides Andys Binary Folding Editor with the capability to view data which is obtained from an external program or script.

When you invoke BEEXEC, you specify a command and a range of addresses.

Initially, the BEEXEC helper has an empty cache.

If BE does a memory fetch for an address within the range of addresses, the command is run.

The command must attempt to obtain the data from the address requested. It can also obtain any surrounding data which is conveniently accessible. The starting address of the data should be written to the standard output of the program, and the data itself should be written to a temporary file, whose name is passed to it.

The data returned is kept by BEEXEC in its cache, and used to satisfy future memory fetches wherever a cache hit occurs. This is why it can be advantageous for the command to return surrounding data. Its a sort of speculative caching.

BEEXEC also remembers which addresses it was unable to obtain data for, and avoids trying to re-obtain the same data.

If BEEXEC did not have this feature, the program would need executing once for every new byte requested, which is clearly a horrific overhead.

The command can be an executable program or script. It should not attempt to do any user interaction, other than writing the output data file, and writing the base address to stdout. Whilst the command is running BE still is in control of the screen and keyboard.

Pressing R in BE causes the cached data to be discarded.

Usage

  be exec!length,command@base

The exec! prefix is a cue that the binary data is to be provided on demand to BE via BEEXEC.

Anything after the prefix are arguments to be passed to BEEXEC, and in this case it is length, command and base address.

BEEXEC will attempt to use the command to satisfy data fetches for addresses in the range base <= address < base+length.

The command is invoked using the C system call, with the desired address address as its first parameter (in 0x preceeded hex), and the temporary filename to use as its second parameter. The command should write the returned data to the named file, and the address of the first byte returned (in decimal, or 0x preceeded hex) to its standard output.


This documentation is written and maintained by the author, Andy Key
andy.z.key@googlemail.com