mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-06-20 10:36:38 +03:00
Windows guest VMI core: host library, CLI, guest agent
Static library over a flat RW mmap of guest RAM: GPA/GVA paging walks, beacon-driven bootstrap, dynamic struct-offset profiling, process and module enumeration, a region map, and value/pointer/signature scanners on a shared windowed sweep. Public API in include/; internals under src/. Thin CLI demonstrator over the public API. Guest agent cross-compiled to Windows x86-64 via mingw-w64. CMake: static library + CLI + guest target, C17.
This commit is contained in:
+51
@@ -0,0 +1,51 @@
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
#include "include/memory.h"
|
||||
#include "../include/include.h"
|
||||
|
||||
static void utf8_emit(uint32_t cp, char* dst, size_t size, size_t* need) {
|
||||
uint8_t b[4]; size_t k;
|
||||
if (cp < 0x80) { b[0]=(uint8_t)cp; k=1; }
|
||||
else if (cp < 0x800) { b[0]=0xC0|(uint8_t)(cp>>6); b[1]=0x80|(cp&0x3F); k=2; }
|
||||
else if (cp < 0x10000) { b[0]=0xE0|(uint8_t)(cp>>12); b[1]=0x80|((cp>>6)&0x3F); b[2]=0x80|(cp&0x3F); k=3; }
|
||||
else { b[0]=0xF0|(uint8_t)(cp>>18); b[1]=0x80|((cp>>12)&0x3F); b[2]=0x80|((cp>>6)&0x3F); b[3]=0x80|(cp&0x3F); k=4; }
|
||||
if (dst && *need + k < size) {
|
||||
for (size_t j = 0; j < k; j++) dst[*need + j] = (char)b[j];
|
||||
}
|
||||
*need += k;
|
||||
}
|
||||
|
||||
size_t gva_read_text(gva_ctx* ctx, uintptr_t cr3, uintptr_t va, size_t nmemb, char* dst, size_t size) {
|
||||
size_t need = 0;
|
||||
uint16_t stage[256];
|
||||
uint32_t hi = 0;
|
||||
nmemb &= ~(size_t)1;
|
||||
|
||||
while (nmemb) {
|
||||
size_t chunk = nmemb < sizeof stage ? nmemb : sizeof stage;
|
||||
if (gva_read(ctx, cr3, va, stage, chunk)) {
|
||||
break;
|
||||
}
|
||||
const size_t units = chunk / 2;
|
||||
for (size_t i = 0; i < units; i++) {
|
||||
uint32_t u = stage[i];
|
||||
if (hi) {
|
||||
if (u >= 0xDC00 && u <= 0xDFFF) {
|
||||
utf8_emit(0x10000u + ((hi - 0xD800u) << 10) + (u - 0xDC00u), dst, size, &need);
|
||||
hi = 0;
|
||||
continue;
|
||||
}
|
||||
utf8_emit(0xFFFD, dst, size, &need);
|
||||
hi = 0;
|
||||
}
|
||||
if (u >= 0xD800 && u <= 0xDBFF) hi = u;
|
||||
else if (u >= 0xDC00 && u <= 0xDFFF) utf8_emit(0xFFFD, dst, size, &need);
|
||||
else utf8_emit(u, dst, size, &need);
|
||||
}
|
||||
va += chunk;
|
||||
nmemb -= chunk;
|
||||
}
|
||||
if (hi) utf8_emit(0xFFFD, dst, size, &need);
|
||||
if (dst && size) dst[need < size ? need : size - 1] = 0;
|
||||
return need;
|
||||
}
|
||||
Reference in New Issue
Block a user