lirent/vatrog-vm-introspection-engine
1
0
Fork 0
mirror of https://dev.lirent.ru/Vatrog/vm-introspection-engine.git synced 2026-07-08 23:46:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

Take the kernel cr3 in the read-only win32 constructor

Browse Source 
vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset
profile read-only from the image (find ntoskrnl, resolve
PsInitialSystemProcess, build the profile, derive the System _EPROCESS),
so a read-only context has the full read surface - including
proc_list/proc_modules, not just the cr3-parameterised PE walks.

The read-only bring-up tail is factored out of host_bootstrap into a
shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK
around it, so its behaviour and return codes are unchanged.
This commit is contained in:
Gregory Lirent
2026-06-20 17:02:29 +03:00
parent 02e63f2ff0
commit 3028a4eb11
2 changed files with 52 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/win32.h
+12 -12
View File
@@ -93,18 +93,18 @@ vmie_win32* vmie_win32_open(const char* ram_path, uint64_t low);
vmie_win32* vmie_win32_open_fd(int fd, uint64_t low);
/* Open a READ-ONLY context over the RAM backing file `fd`, for a consumer that
* only reads. Unlike vmie_win32_open_fd this does NOT bootstrap (the magic-
* signature handshake needs RW): the caller supplies the address space by passing
* a cr3 to each read call. Every read API that takes a cr3 works - the section /
* function / import / export / callgraph / hook surfaces, gva_read_text, and the
* generic gva_* and scanner surfaces via vmie_win32_mem(); writes (gva_write) -1
* because the mapping is PROT_READ. proc_list/proc_modules are NOT available here:
* they need the bootstrap-recovered profile, which a read-only context does not
* carry. `fd` is BORROWED (dup()'d internally; the caller's fd stays valid after
* this call AND after vmie_win32_close()); an O_RDONLY fd is accepted. `low` is
* the below-4G split, as in vmie_win32_open_fd. Returns a new context, or NULL on
* dup/fstat/mmap failure. Free with vmie_win32_close(). */
vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low);
* only reads. It takes a caller-supplied `kcr3` (kernel cr3 / System DirectoryTableBase)
* and builds the struct-offset profile read-only from the image (no bootstrap
* handshake - beacon and ACK are not used). The result has the FULL read
* capability: proc_list/proc_modules AND the section / function / import / export
* / callgraph / hook surfaces, gva_read_text, and the generic gva_* and scanner
* surfaces via vmie_win32_mem(). Any write (gva_write) returns -1 because the
* mapping is PROT_READ. `fd` is BORROWED (dup()'d internally; the caller's fd
* stays valid after this call AND after vmie_win32_close()); an O_RDONLY fd is
* accepted. `low` is the below-4G split, as in vmie_win32_open_fd. Returns a new
* context, or NULL if `kcr3` does not resolve a kernel (ntoskrnl not found under
* it) or on dup/fstat/mmap failure. Free with vmie_win32_close(). */
vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3);
/* Unmap, close, and free a context. Safe on NULL. After this, every pointer
* into guest memory obtained through this context is invalid. */