Skip to content

ClassLayout

Peter Van Eeckhoutte edited this page May 2, 2026 · 3 revisions

This document is a working copy - it describes the desired structure of classes in mona.py:

+------------------------------+
| MnConfig                     |
+------------------------------+
Separate config-file manager.
Creates, loads, migrates, reads, writes and persists mona.ini settings.


+------------------------------+
| MnLog                        |
+------------------------------+
Separate logging/output-file manager.
Creates and writes log files. MnDebugger can use it, but should not own
all logging logic directly.


+------------------------------+
| MnCommand                    |
+------------------------------+
Represents one mona command invocation.
Parses arguments, stores command metadata, options and execution context.
Executed by MnDebugger.


+------------------------------+
| MnDebugger                   |
+------------------------------+
Raw debugger/session interface.
Memory read/write, debugger command execution, output, conversions,
formatting, parsing helpers, etc.

        uses
          |
          +---- MnConfig
          +---- MnLog
          +---- MnCommand

        inspects / controls
          |
+------------------------------+
| MnProcess                    |
+------------------------------+
Represents the process being debugged.
Owns process-level memory layout, entities, threads, pointers,
and higher-level runtime structures.

  |
  +-- raw memory pages
  |
  |   +--------------------------+
  |   | MnPage                   |
  |   +--------------------------+
  |   Raw memory page/range.
  |   Exposes start, end, size, ACL/protection, state, type, etc.
  |
  +-- process pointers
  |
  |   +--------------------------+
  |   | MnPointer                |
  |   +--------------------------+
  |   Represents pointers discovered inside the process.
  |
  +-- double-linked list helper
  |
  |   +--------------------------+
  |   | MnListEntry              |
  |   +--------------------------+
  |   Generic LIST_ENTRY-style helper.
  |   Used inside PEB, loader lists, heap lists, etc.
  |
  +-- threads
  |
  |   +--------------------------+
  |   | MnThread                 |
  |   +--------------------------+
  |   Represents a thread in the debugged process.
  |
  |      |
  |      +-- has
  |          +----------------------+
  |          | MnTeb                |
  |          +----------------------+
  |          Thread Environment Block.
  |
  |             |
  |             +-- has
  |                 +------------------+
  |                 | MnStack          |
  |                 +------------------+
  |                 Stack belonging to the thread.
  |
  +-- process environment
      |
      +--------------------------+
      | MnPeb                    |
      +--------------------------+
      Process Environment Block.
      One per process. Owns process-wide runtime lists.

          |
          +-- modules
          |
          |   +----------------------+
          |   | MnModule             |
          |   +----------------------+
          |   Loaded module / image.
          |   Internally backed by one or more MnPage ranges.
          |
          +-- heaps
              |
              +----------------------+
              | MnHeap               |
              +----------------------+
              Generic heap base class.
              May split into MnNTHeap and MnSegmentHeap.

                  |
                  +-- subclasses
                      |
                      +------------------+       +----------------------+
                      | MnNTHeap         |       | MnSegmentHeap        |
                      +------------------+       +----------------------+
                      Classic NT heap.           Segment Heap model.


+------------------------------+
| MnNTHeap                     |
+------------------------------+
Specialization of MnHeap for NT heaps.

  |
  +-- has segments
  |
  |   +------------------+
  |   | MnSegment        |
  |   +------------------+
  |   NT heap segment.
  |
  |       |
  |       +-- has
  |           +--------------+
  |           | MnChunk      |
  |           +--------------+
  |           Standard heap chunk.
  |
  |       +-- may contain
  |           +----------------------+
  |           | MnLFHSubSegment      |
  |           +----------------------+
  |           Specialized MnChunk (LFH subsegment).
  |
  +-- has
  |
  |   +--------------------------+
  |   | MnVirtualAllocdBlock     |
  |   +--------------------------+
  |   VirtualAlloc-backed allocations.
  |
  +-- has
      |
      +--------------------------+
      | MnLFH                    |
      +--------------------------+
      Low Fragmentation Heap controller/state.

          |
          +-- has
              |
              +----------------------+
              | MnLFHSubSegment      |
              +----------------------+
              LFH subsegment.
              (Also exists as a specialized MnChunk inside segments)


+------------------------------+
| MnSegmentHeap                |
+------------------------------+
Specialization of MnHeap for Segment Heaps.

  |
  +-- has segments
  |
  |   +------------------+
  |   | MnSegment        |
  |   +------------------+
  |   Segment Heap segment (owned by MnSegmentHeap).
  |
  |       |
  |       +-- has
  |           +----------------------+
  |           | MnBackEndBlock       |
  |           +----------------------+
  |           Backend allocation block.
  |
  +-- has
      |
      +--------------------------+
      | LargeBlocks              |
      +--------------------------+
      Large allocations.
      Possible future class: MnLargeBlock.

Clone this wiki locally