vatrog-vm-introspection-engine/src/engine/sigphys.c

/* sigphys.c - physical-image signature bridge (OS-agnostic engine bridge).
 *
 * Iterates the core segment map (each seg is one mem_view_t over its file span)
 * and runs the pure matcher. Reaches into vmie_mem (the segment table), so it is
 * an engine bridge, not a handler - but it names no Windows concept and depends
 * on no paging/profile, so it lives engine-side, outside src/engine/win32/. The
 * dump-only scan set is { core/gpa.c, handlers/sigscan.c, this }, no win32. */
#include <stdint.h>
#include <stddef.h>
#include "core.h"
#include "sigscan.h"
#include "scan.h"

struct physcb { uint64_t* out; int max, n; };
static int phys_hit(void* u, uint64_t gpa) {
    struct physcb* c = u;
    if (c->out && c->n < c->max) c->out[c->n] = gpa;
    c->n++;
    return 0;
}

int sig_scan_mem(vmie_mem* m, const sig_pattern_t* p, uint64_t* out, int max) {
    if (!p || p->len == 0) return -1;
    struct physcb c = { out, max, 0 };

    for (int i = 0; i < m->nseg; i++) {
        const gpa_seg* s = &m->seg[i];
        const mem_view_t v = { (const uint8_t*)m->pa + s->file_off, (size_t)s->len, s->gpa };
        sig_each(v, p, phys_hit, &c);
    }
    return c.n;
}

/* Tagging callback for the multi-source scan: stamps the current source index
 * onto each hit and writes attributed records up to capacity. */
struct srccb { sig_hit_src* out; int max, n, source; };
static int src_hit(void* u, uint64_t gpa) {
    struct srccb* c = u;
    if (c->out && c->n < c->max) {
        c->out[c->n].source = c->source;
        c->out[c->n].gpa    = gpa;
    }
    c->n++;
    return 0;
}

int sig_scan_sources(vmie_mem* const* srcs, int nsrc, const sig_pattern_t* p,
                     sig_hit_src* out, int max) {
    if (!p || p->len == 0) return -1;
    struct srccb c = { out, max, 0, 0 };

    for (int si = 0; si < nsrc; si++) {
        vmie_mem* m = srcs[si];
        c.source = si;
        for (int i = 0; i < m->nseg; i++) {
            const gpa_seg* s = &m->seg[i];
            const mem_view_t v = { (const uint8_t*)m->pa + s->file_off, (size_t)s->len, s->gpa };
            sig_each(v, p, src_hit, &c);
        }
    }
    return c.n;
}