Windows guest VMI core: host library, CLI, guest agent

Static library over a flat RW mmap of guest RAM: GPA/GVA paging walks,
beacon-driven bootstrap, dynamic struct-offset profiling, process and
module enumeration, a region map, and value/pointer/signature scanners on
a shared windowed sweep. Public API in include/; internals under src/.

Thin CLI demonstrator over the public API. Guest agent cross-compiled to
Windows x86-64 via mingw-w64. CMake: static library + CLI + guest target,
C17.
This commit is contained in:
2026-06-14 21:47:56 +03:00
commit 1ec70b7ede
18 changed files with 2390 additions and 0 deletions
+51
View File
@@ -0,0 +1,51 @@
#include <stdint.h>
#include <stddef.h>
#include "include/memory.h"
#include "../include/include.h"
static void utf8_emit(uint32_t cp, char* dst, size_t size, size_t* need) {
uint8_t b[4]; size_t k;
if (cp < 0x80) { b[0]=(uint8_t)cp; k=1; }
else if (cp < 0x800) { b[0]=0xC0|(uint8_t)(cp>>6); b[1]=0x80|(cp&0x3F); k=2; }
else if (cp < 0x10000) { b[0]=0xE0|(uint8_t)(cp>>12); b[1]=0x80|((cp>>6)&0x3F); b[2]=0x80|(cp&0x3F); k=3; }
else { b[0]=0xF0|(uint8_t)(cp>>18); b[1]=0x80|((cp>>12)&0x3F); b[2]=0x80|((cp>>6)&0x3F); b[3]=0x80|(cp&0x3F); k=4; }
if (dst && *need + k < size) {
for (size_t j = 0; j < k; j++) dst[*need + j] = (char)b[j];
}
*need += k;
}
size_t gva_read_text(gva_ctx* ctx, uintptr_t cr3, uintptr_t va, size_t nmemb, char* dst, size_t size) {
size_t need = 0;
uint16_t stage[256];
uint32_t hi = 0;
nmemb &= ~(size_t)1;
while (nmemb) {
size_t chunk = nmemb < sizeof stage ? nmemb : sizeof stage;
if (gva_read(ctx, cr3, va, stage, chunk)) {
break;
}
const size_t units = chunk / 2;
for (size_t i = 0; i < units; i++) {
uint32_t u = stage[i];
if (hi) {
if (u >= 0xDC00 && u <= 0xDFFF) {
utf8_emit(0x10000u + ((hi - 0xD800u) << 10) + (u - 0xDC00u), dst, size, &need);
hi = 0;
continue;
}
utf8_emit(0xFFFD, dst, size, &need);
hi = 0;
}
if (u >= 0xD800 && u <= 0xDBFF) hi = u;
else if (u >= 0xDC00 && u <= 0xDFFF) utf8_emit(0xFFFD, dst, size, &need);
else utf8_emit(u, dst, size, &need);
}
va += chunk;
nmemb -= chunk;
}
if (hi) utf8_emit(0xFFFD, dst, size, &need);
if (dst && size) dst[need < size ? need : size - 1] = 0;
return need;
}