/* sigphys.c - physical-image signature bridge (OS-agnostic engine bridge). * * Iterates the core segment map (each seg is one mem_view_t over its file span) * and runs the pure matcher. Reaches into vmie_mem (the segment table), so it is * an engine bridge, not a handler - but it names no Windows concept and depends * on no paging/profile, so it lives engine-side, outside src/engine/win32/. The * dump-only scan set is { core/gpa.c, handlers/sigscan.c, this }, no win32. */ #include #include #include "core.h" #include "sigscan.h" #include "scan.h" struct physcb { uint64_t* out; int max, n; }; static int phys_hit(void* u, uint64_t gpa) { struct physcb* c = u; if (c->out && c->n < c->max) c->out[c->n] = gpa; c->n++; return 0; } int sig_scan_mem(vmie_mem* m, const sig_pattern_t* p, uint64_t* out, int max) { if (!p || p->len == 0) return -1; struct physcb c = { out, max, 0 }; for (int i = 0; i < m->nseg; i++) { const gpa_seg* s = &m->seg[i]; const mem_view_t v = { (const uint8_t*)m->pa + s->file_off, (size_t)s->len, s->gpa }; sig_each(v, p, phys_hit, &c); } return c.n; } /* Tagging callback for the multi-source scan: stamps the current source index * onto each hit and writes attributed records up to capacity. */ struct srccb { sig_hit_src* out; int max, n, source; }; static int src_hit(void* u, uint64_t gpa) { struct srccb* c = u; if (c->out && c->n < c->max) { c->out[c->n].source = c->source; c->out[c->n].gpa = gpa; } c->n++; return 0; } int sig_scan_sources(vmie_mem* const* srcs, int nsrc, const sig_pattern_t* p, sig_hit_src* out, int max) { if (!p || p->len == 0) return -1; struct srccb c = { out, max, 0, 0 }; for (int si = 0; si < nsrc; si++) { vmie_mem* m = srcs[si]; c.source = si; for (int i = 0; i < m->nseg; i++) { const gpa_seg* s = &m->seg[i]; const mem_view_t v = { (const uint8_t*)m->pa + s->file_off, (size_t)s->len, s->gpa }; sig_each(v, p, src_hit, &c); } } return c.n; }