Take the kernel cr3 in the read-only win32 constructor

vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset
profile read-only from the image (find ntoskrnl, resolve
PsInitialSystemProcess, build the profile, derive the System _EPROCESS),
so a read-only context has the full read surface - including
proc_list/proc_modules, not just the cr3-parameterised PE walks.

The read-only bring-up tail is factored out of host_bootstrap into a
shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK
around it, so its behaviour and return codes are unchanged.

include/win32.h

@@ -93,18 +93,18 @@ vmie_win32* vmie_win32_open(const char* ram_path, uint64_t low);
 vmie_win32* vmie_win32_open_fd(int fd, uint64_t low);
 
 /* Open a READ-ONLY context over the RAM backing file `fd`, for a consumer that
- * only reads. Unlike vmie_win32_open_fd this does NOT bootstrap (the magic-
+ * only reads. It takes a caller-supplied `kcr3` (kernel cr3 / System DirectoryTableBase)
- * signature handshake needs RW): the caller supplies the address space by passing
+ * and builds the struct-offset profile read-only from the image (no bootstrap
- * a cr3 to each read call. Every read API that takes a cr3 works - the section /
+ * handshake - beacon and ACK are not used). The result has the FULL read
- * function / import / export / callgraph / hook surfaces, gva_read_text, and the
+ * capability: proc_list/proc_modules AND the section / function / import / export
- * generic gva_* and scanner surfaces via vmie_win32_mem(); writes (gva_write) -1
+ * / callgraph / hook surfaces, gva_read_text, and the generic gva_* and scanner
- * because the mapping is PROT_READ. proc_list/proc_modules are NOT available here:
+ * surfaces via vmie_win32_mem(). Any write (gva_write) returns -1 because the
- * they need the bootstrap-recovered profile, which a read-only context does not
+ * mapping is PROT_READ. `fd` is BORROWED (dup()'d internally; the caller's fd
- * carry. `fd` is BORROWED (dup()'d internally; the caller's fd stays valid after
+ * stays valid after this call AND after vmie_win32_close()); an O_RDONLY fd is
- * this call AND after vmie_win32_close()); an O_RDONLY fd is accepted. `low` is
+ * accepted. `low` is the below-4G split, as in vmie_win32_open_fd. Returns a new
- * the below-4G split, as in vmie_win32_open_fd. Returns a new context, or NULL on
+ * context, or NULL if `kcr3` does not resolve a kernel (ntoskrnl not found under
- * dup/fstat/mmap failure. Free with vmie_win32_close(). */
+ * it) or on dup/fstat/mmap failure. Free with vmie_win32_close(). */
-vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low);
+vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3);
 
 /* Unmap, close, and free a context. Safe on NULL. After this, every pointer
  * into guest memory obtained through this context is invalid. */

src/engine/win32/host.c

@@ -6,6 +6,9 @@
 
 #define MZ           0x5A4Du
 
+__attribute__((cold))
+static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3);
+
 /* ---- lifecycle (cold) ---------------------------------------------------- */
 
 __attribute__((cold))
@@ -34,10 +37,12 @@ vmie_win32* vmie_win32_open_fd(int fd, uint64_t low) {
     return v;
 }
 
-/* Read-only context: no bootstrap, the cr3 is supplied per read call. The mem is
+/* Read-only consumer context: maps the backing file PROT_READ and builds the
- * mapped PROT_READ (gpa_from_ro_fd), so every write through it returns -1. */
+ * struct-offset profile from the image under the caller-supplied kcr3 (no
+ * beacon, no cr3 recovery, no ACK write). All read APIs work, incl.
+ * proc_list/proc_modules; writes return -1. */
 __attribute__((cold))
-vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) {
+vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3) {
     vmie_win32* v = calloc(1, sizeof *v);
     if (!v) {
         return NULL;
@@ -46,6 +51,10 @@ vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) {
         free(v);
         return NULL;
     }
+    if (host_profile_from_cr3(v, (uintptr_t)kcr3)) {
+        vmie_win32_close(v);
+        return NULL;
+    }
     return v;
 }
 
@@ -181,6 +190,31 @@ static uint32_t ko_export_rva(vmie_mem* m, uintptr_t cr3, uint64_t kbase, const
     return 0;
 }
 
+__attribute__((cold))
+static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3) {
+    vmie_mem* m = &v->mem;
+    uint8_t  guid[16];
+    uint32_t age, rva;
+    uint64_t sys_ep, dtb;
+
+    if (find_ntoskrnl(m, cr3, &v->kbase, guid, &age)) {
+        return -3;
+    }
+    rva = ko_export_rva(m, cr3, v->kbase, "PsInitialSystemProcess");
+    if (!rva || gva_read(m, cr3, v->kbase + rva, &sys_ep, 8)) {
+        return -4;
+    }
+    if (profile_build(v, cr3, sys_ep, guid, age)) {
+        return -5;
+    }
+    if (gva_read(m, cr3, sys_ep + v->prof.ep_dtb, &dtb, 8)) {
+        return -6;
+    }
+    v->kcr3    = dtb & PFN_MASK;
+    v->sysproc = sys_ep;
+    return 0;
+}
+
 static void beacon_ack(vmie_mem* m, uint64_t anchor_pa) {
     uint64_t ack = CONTRACT_MAGIC_R;
     gpa_write(m, anchor_pa + offsetof(contract, ack), &ack, 8);
@@ -195,10 +229,6 @@ int host_bootstrap(vmie_win32* v) {
     vmie_mem* m = &v->mem;
     uint64_t anchor_pa, va_self;
     uintptr_t cr3boot;
-    uint32_t rva;
-    uint8_t guid[16];
-    uint32_t age;
-    uint64_t sys_ep;
 
     if (beacon_find(m, &anchor_pa, &va_self)) {
         return -1;
@@ -208,26 +238,11 @@ int host_bootstrap(vmie_win32* v) {
         return -2;
     }
 
-    if (find_ntoskrnl(m, cr3boot, &v->kbase, guid, &age)) {
+    const int rc = host_profile_from_cr3(v, cr3boot);
-        return -3;
+    if (rc) {
+        return rc;
     }
 
-    rva = ko_export_rva(m, cr3boot, v->kbase, "PsInitialSystemProcess");
-    if (!rva || gva_read(m, cr3boot, v->kbase + rva, &sys_ep, 8)) {
-        return -4;
-    }
-
-    if (profile_build(v, cr3boot, sys_ep, guid, age)) {
-        return -5;
-    }
-
-    uint64_t dtb;
-    if (gva_read(m, cr3boot, sys_ep + v->prof.ep_dtb, &dtb, 8)) {
-        return -6;
-    }
-    v->kcr3    = dtb & PFN_MASK;
-    v->sysproc = sys_ep;
-
     beacon_ack(m, anchor_pa);
     return 0;
 }