lirent/vatrog-vm-introspection-engine
1
0
Fork 0
mirror of https://dev.lirent.ru/Vatrog/vm-introspection-engine.git synced 2026-06-18 02:06:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

Split the library into CORE / ENGINE / HANDLERS layers

Browse Source 
CORE (src/core): vmie_mem — guest-physical substrate with a data-driven
segment map (replaces the hardcoded 4 GiB PCI-hole topology). ENGINE
(src/engine): x86-64 paging + Windows bring-up; produces the generic memory
model. HANDLERS (src/handlers): the signature/value/pointer scanners, which
now consume an OS-agnostic contract.

Keystone: gva_ctx is split into vmie_mem (core) + vmie (engine); the generic
access functions take vmie_mem* + cr3 and no longer compile in the Windows
offset table. New public contract include/memmodel.h (vmie_mem, mem_view_t,
vregion, task, range, the gva_* access); win32 surface in include/vmie.h.
Leak relocations: the PE parser, UTF-16 decode and CR3-recovery heuristics
move engine-side; the matcher stays a pure, source-agnostic handler, and the
pointer scanner takes a generic range[] instead of reaching into the process
enumerator.
This commit is contained in:
Gregory Lirent
2026-06-15 02:57:46 +03:00
parent 7c0995a4f2
commit b3441dd6f6
24 changed files with 1014 additions and 766 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+17 -15
View File
@@ -9,17 +9,19 @@ option(VMIE_LTO "Enable LTO" OFF) # build-only; shipped default is -O2, no
# ---- host: VMI core as a static library ---------------------------------
add_library(vmie STATIC
src/gpa.c
src/gva.c
src/host.c
src/proc.c
src/profile.c
src/text.c
src/scan.c
src/sigscan.c)
src/core/gpa.c
src/engine/gva.c
src/engine/host.c
src/engine/pe.c
src/engine/proc.c
src/engine/profile.c
src/engine/text.c
src/handlers/scan.c
src/handlers/sigscan.c)
target_include_directories(vmie
PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include # public API: include/*.h
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src) # private: src/include/*.h via "include/..."
PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include # public API: include/*.h
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/core/include # private: core.h
${CMAKE_CURRENT_SOURCE_DIR}/src/engine/include) # private: engine.h, contract.h
target_compile_options(vmie PRIVATE -O2 -Wall -Wextra)
if(VMIE_LTO)
target_compile_options(vmie PRIVATE -flto)
@@ -28,7 +30,7 @@ endif()
# ---- host: CLI demonstrator over the library ----------------------------
add_executable(vmie_cli src/cli.c)
target_link_libraries(vmie_cli PRIVATE vmie)
target_link_libraries(vmie_cli PRIVATE vmie) # public include/ comes via vmie (PUBLIC)
target_compile_options(vmie_cli PRIVATE -Wall -Wextra)
# ---- guest: cross-compile to Windows x86-64 via mingw-w64 ---------------
@@ -37,10 +39,10 @@ set(VMIE_STARTUP ${CMAKE_CURRENT_BINARY_DIR}/vmie-startup.exe)
add_custom_command(
OUTPUT ${VMIE_STARTUP}
COMMAND ${MINGW_CC} -O2 -Wall -Wextra -static -s
-I${CMAKE_CURRENT_SOURCE_DIR}/src
-o ${VMIE_STARTUP} ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/src/guest.c
${CMAKE_CURRENT_SOURCE_DIR}/src/include/contract.h
-I${CMAKE_CURRENT_SOURCE_DIR}/src/engine/include
-o ${VMIE_STARTUP} ${CMAKE_CURRENT_SOURCE_DIR}/src/engine/guest.c
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/src/engine/guest.c
${CMAKE_CURRENT_SOURCE_DIR}/src/engine/include/contract.h
COMMENT "Cross-compiling vmie-startup.exe (mingw-w64, x86-64)"
VERBATIM)
add_custom_target(vmie-startup ALL DEPENDS ${VMIE_STARTUP})