mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-06-18 02:06:36 +03:00
Rename project w32ms -> vmi-engine
Library vmie (libvmie.a), CLI vmie_cli, guest agent vmie-startup.exe, symbol prefix VMIE_ (header guards, the LTO build option). No behavior change.
This commit is contained in:
+16
-16
@@ -1,14 +1,14 @@
|
|||||||
cmake_minimum_required(VERSION 3.18) # find_program(... REQUIRED)
|
cmake_minimum_required(VERSION 3.18) # find_program(... REQUIRED)
|
||||||
project(w32ms C)
|
project(vmi-engine C)
|
||||||
|
|
||||||
set(CMAKE_C_STANDARD 17) # generation B uses no C23 feature
|
set(CMAKE_C_STANDARD 17) # generation B uses no C23 feature
|
||||||
set(CMAKE_C_STANDARD_REQUIRED ON)
|
set(CMAKE_C_STANDARD_REQUIRED ON)
|
||||||
set(CMAKE_C_EXTENSIONS ON) # deliberate: strnlen (POSIX) + void* arithmetic (GNU)
|
set(CMAKE_C_EXTENSIONS ON) # deliberate: strnlen (POSIX) + void* arithmetic (GNU)
|
||||||
|
|
||||||
option(W32MS_LTO "Enable LTO" OFF) # build-only; shipped default is -O2, no LTO
|
option(VMIE_LTO "Enable LTO" OFF) # build-only; shipped default is -O2, no LTO
|
||||||
|
|
||||||
# ---- host: VMI core as a static library ---------------------------------
|
# ---- host: VMI core as a static library ---------------------------------
|
||||||
add_library(w32ms STATIC
|
add_library(vmie STATIC
|
||||||
src/gpa.c
|
src/gpa.c
|
||||||
src/gva.c
|
src/gva.c
|
||||||
src/host.c
|
src/host.c
|
||||||
@@ -17,30 +17,30 @@ add_library(w32ms STATIC
|
|||||||
src/text.c
|
src/text.c
|
||||||
src/scan.c
|
src/scan.c
|
||||||
src/sigscan.c)
|
src/sigscan.c)
|
||||||
target_include_directories(w32ms
|
target_include_directories(vmie
|
||||||
PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include # public API: include/*.h
|
PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include # public API: include/*.h
|
||||||
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src) # private: src/include/*.h via "include/..."
|
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src) # private: src/include/*.h via "include/..."
|
||||||
target_compile_options(w32ms PRIVATE -O2 -Wall -Wextra)
|
target_compile_options(vmie PRIVATE -O2 -Wall -Wextra)
|
||||||
if(W32MS_LTO)
|
if(VMIE_LTO)
|
||||||
target_compile_options(w32ms PRIVATE -flto)
|
target_compile_options(vmie PRIVATE -flto)
|
||||||
target_link_options(w32ms PRIVATE -flto)
|
target_link_options(vmie PRIVATE -flto)
|
||||||
endif()
|
endif()
|
||||||
|
|
||||||
# ---- host: CLI demonstrator over the library ----------------------------
|
# ---- host: CLI demonstrator over the library ----------------------------
|
||||||
add_executable(w32ms_cli src/cli.c)
|
add_executable(vmie_cli src/cli.c)
|
||||||
target_link_libraries(w32ms_cli PRIVATE w32ms)
|
target_link_libraries(vmie_cli PRIVATE vmie)
|
||||||
target_compile_options(w32ms_cli PRIVATE -Wall -Wextra)
|
target_compile_options(vmie_cli PRIVATE -Wall -Wextra)
|
||||||
|
|
||||||
# ---- guest: cross-compile to Windows x86-64 via mingw-w64 ---------------
|
# ---- guest: cross-compile to Windows x86-64 via mingw-w64 ---------------
|
||||||
find_program(MINGW_CC NAMES x86_64-w64-mingw32-gcc REQUIRED)
|
find_program(MINGW_CC NAMES x86_64-w64-mingw32-gcc REQUIRED)
|
||||||
set(W32MS_GUEST ${CMAKE_CURRENT_BINARY_DIR}/w32ms_guest.exe)
|
set(VMIE_STARTUP ${CMAKE_CURRENT_BINARY_DIR}/vmie-startup.exe)
|
||||||
add_custom_command(
|
add_custom_command(
|
||||||
OUTPUT ${W32MS_GUEST}
|
OUTPUT ${VMIE_STARTUP}
|
||||||
COMMAND ${MINGW_CC} -O2 -Wall -Wextra -static -s
|
COMMAND ${MINGW_CC} -O2 -Wall -Wextra -static -s
|
||||||
-I${CMAKE_CURRENT_SOURCE_DIR}/src
|
-I${CMAKE_CURRENT_SOURCE_DIR}/src
|
||||||
-o ${W32MS_GUEST} ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
|
-o ${VMIE_STARTUP} ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
|
||||||
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
|
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
|
||||||
${CMAKE_CURRENT_SOURCE_DIR}/src/include/contract.h
|
${CMAKE_CURRENT_SOURCE_DIR}/src/include/contract.h
|
||||||
COMMENT "Cross-compiling w32ms_guest.exe (mingw-w64, x86-64)"
|
COMMENT "Cross-compiling vmie-startup.exe (mingw-w64, x86-64)"
|
||||||
VERBATIM)
|
VERBATIM)
|
||||||
add_custom_target(w32ms_guest ALL DEPENDS ${W32MS_GUEST})
|
add_custom_target(vmie-startup ALL DEPENDS ${VMIE_STARTUP})
|
||||||
|
|||||||
+3
-3
@@ -16,8 +16,8 @@
|
|||||||
* pointer past the call that received it, unless explicitly stated.
|
* pointer past the call that received it, unless explicitly stated.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#ifndef W32MS_INCLUDE_H
|
#ifndef VMIE_INCLUDE_H
|
||||||
#define W32MS_INCLUDE_H
|
#define VMIE_INCLUDE_H
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
#include <stddef.h>
|
#include <stddef.h>
|
||||||
|
|
||||||
@@ -169,4 +169,4 @@ int proc_modules(gva_ctx* ctx, const process* pr, pmodule* dst, size_t nmax);
|
|||||||
int gva_regions(gva_ctx* ctx, uintptr_t cr3, uint64_t lo, uint64_t hi,
|
int gva_regions(gva_ctx* ctx, uintptr_t cr3, uint64_t lo, uint64_t hi,
|
||||||
uint32_t prot_any, vregion* out, int nmax);
|
uint32_t prot_any, vregion* out, int nmax);
|
||||||
|
|
||||||
#endif /* W32MS_INCLUDE_H */
|
#endif /* VMIE_INCLUDE_H */
|
||||||
+3
-3
@@ -6,8 +6,8 @@
|
|||||||
* pointer chains; the gva_sig_* bridges build mem_view_t windows out of guest
|
* pointer chains; the gva_sig_* bridges build mem_view_t windows out of guest
|
||||||
* memory and feed them to the signature matcher.
|
* memory and feed them to the signature matcher.
|
||||||
*/
|
*/
|
||||||
#ifndef W32MS_SCAN_H
|
#ifndef VMIE_SCAN_H
|
||||||
#define W32MS_SCAN_H
|
#define VMIE_SCAN_H
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
#include <stddef.h>
|
#include <stddef.h>
|
||||||
#include "include.h" /* gva_ctx, process (vregion - internal) */
|
#include "include.h" /* gva_ctx, process (vregion - internal) */
|
||||||
@@ -60,4 +60,4 @@ int gva_pe_section(gva_ctx* ctx, uintptr_t cr3, uint64_t module_base,
|
|||||||
const char* name, uint8_t* buf, size_t bufcap, mem_view_t* out);
|
const char* name, uint8_t* buf, size_t bufcap, mem_view_t* out);
|
||||||
int gva_sig_phys (gva_ctx* ctx, const sig_pattern_t* p, uint64_t* out, int max);
|
int gva_sig_phys (gva_ctx* ctx, const sig_pattern_t* p, uint64_t* out, int max);
|
||||||
|
|
||||||
#endif /* W32MS_SCAN_H */
|
#endif /* VMIE_SCAN_H */
|
||||||
|
|||||||
+3
-3
@@ -10,8 +10,8 @@
|
|||||||
* guest memory, build views from the gva layer (see scan.h: gva_sig_scan,
|
* guest memory, build views from the gva layer (see scan.h: gva_sig_scan,
|
||||||
* gva_pe_section, gva_sig_phys) and feed them here.
|
* gva_pe_section, gva_sig_phys) and feed them here.
|
||||||
*/
|
*/
|
||||||
#ifndef W32MS_SIGSCAN_H
|
#ifndef VMIE_SIGSCAN_H
|
||||||
#define W32MS_SIGSCAN_H
|
#define VMIE_SIGSCAN_H
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
#include <stddef.h>
|
#include <stddef.h>
|
||||||
#include <stdbool.h>
|
#include <stdbool.h>
|
||||||
@@ -102,4 +102,4 @@ bool pe_find_section(mem_view_t v, uint64_t module_base, const char* name,
|
|||||||
bool pe_section(mem_view_t v, uint64_t module_base, const char* name,
|
bool pe_section(mem_view_t v, uint64_t module_base, const char* name,
|
||||||
mem_view_t* out);
|
mem_view_t* out);
|
||||||
|
|
||||||
#endif /* W32MS_SIGSCAN_H */
|
#endif /* VMIE_SIGSCAN_H */
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
/* cli.c - thin demonstrator over the public w32ms API.
|
/* cli.c - thin demonstrator over the public vmi-engine API.
|
||||||
*
|
*
|
||||||
* Opens a guest RAM backing file, brings up the VMI context, lists processes,
|
* Opens a guest RAM backing file, brings up the VMI context, lists processes,
|
||||||
* and for the first user process dumps its loaded modules and mapped regions.
|
* and for the first user process dumps its loaded modules and mapped regions.
|
||||||
@@ -88,7 +88,7 @@ static void dump_regions(gva_ctx* ctx, const process* pr) {
|
|||||||
int main(int argc, char** argv) {
|
int main(int argc, char** argv) {
|
||||||
if (argc < 3) {
|
if (argc < 3) {
|
||||||
fprintf(stderr, "usage: %s <ram-file> <low> [nmax]\n",
|
fprintf(stderr, "usage: %s <ram-file> <low> [nmax]\n",
|
||||||
argc > 0 ? argv[0] : "w32ms_cli");
|
argc > 0 ? argv[0] : "vmie_cli");
|
||||||
return 2;
|
return 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -10,8 +10,8 @@
|
|||||||
#define CONTRACT_ACK 0xACED5EEDACED5EEDull
|
#define CONTRACT_ACK 0xACED5EEDACED5EEDull
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#ifndef W32MS_CONTRACT_H
|
#ifndef VMIE_CONTRACT_H
|
||||||
#define W32MS_CONTRACT_H
|
#define VMIE_CONTRACT_H
|
||||||
|
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
#ifndef W32MS_MEMORY_H
|
#ifndef VMIE_MEMORY_H
|
||||||
#define W32MS_MEMORY_H
|
#define VMIE_MEMORY_H
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
#include <stddef.h>
|
#include <stddef.h>
|
||||||
struct gva_ctx; /* forward: completed below; lets profile.h name it */
|
struct gva_ctx; /* forward: completed below; lets profile.h name it */
|
||||||
@@ -98,4 +98,4 @@ typedef int (*gva_sweep_cb)(void* user, const uint8_t* data, size_t len,
|
|||||||
int gva_sweep(gva_ctx* ctx, uintptr_t cr3, uint64_t lo, uint64_t hi,
|
int gva_sweep(gva_ctx* ctx, uintptr_t cr3, uint64_t lo, uint64_t hi,
|
||||||
uint32_t prot_any, size_t overlap, gva_sweep_cb cb, void* user);
|
uint32_t prot_any, size_t overlap, gva_sweep_cb cb, void* user);
|
||||||
|
|
||||||
#endif /* W32MS_MEMORY_H */
|
#endif /* VMIE_MEMORY_H */
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
#ifndef W32MS_PROFILE_H
|
#ifndef VMIE_PROFILE_H
|
||||||
#define W32MS_PROFILE_H
|
#define VMIE_PROFILE_H
|
||||||
|
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user