mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-07-09 01:46:38 +03:00
Add a read-only win32 context over a file descriptor
vmie_win32_open_ro_fd maps the RAM backing file PROT_READ (via gpa_from_ro_fd) and does NOT bootstrap; the caller passes a cr3 to each read call. The read surfaces work this way - sections / functions / imports / exports / callgraph / hooks, gva_read_text, and the generic gva_* and scanner surfaces via vmie_win32_mem() - while any write returns -1 because the mapping is read-only. The RW twin vmie_win32_open_fd and host_bootstrap are unchanged.
This commit is contained in:
@@ -34,6 +34,21 @@ vmie_win32* vmie_win32_open_fd(int fd, uint64_t low) {
|
||||
return v;
|
||||
}
|
||||
|
||||
/* Read-only context: no bootstrap, the cr3 is supplied per read call. The mem is
|
||||
* mapped PROT_READ (gpa_from_ro_fd), so every write through it returns -1. */
|
||||
__attribute__((cold))
|
||||
vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) {
|
||||
vmie_win32* v = calloc(1, sizeof *v);
|
||||
if (!v) {
|
||||
return NULL;
|
||||
}
|
||||
if (gpa_from_ro_fd(&v->mem, fd, low)) {
|
||||
free(v);
|
||||
return NULL;
|
||||
}
|
||||
return v;
|
||||
}
|
||||
|
||||
__attribute__((cold))
|
||||
void vmie_win32_close(vmie_win32* v) {
|
||||
if (!v) {
|
||||
|
||||
Reference in New Issue
Block a user