mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-07-08 23:46:36 +03:00
02e63f2ff0
vmie_win32_open_ro_fd maps the RAM backing file PROT_READ (via gpa_from_ro_fd) and does NOT bootstrap; the caller passes a cr3 to each read call. The read surfaces work this way - sections / functions / imports / exports / callgraph / hooks, gva_read_text, and the generic gva_* and scanner surfaces via vmie_win32_mem() - while any write returns -1 because the mapping is read-only. The RW twin vmie_win32_open_fd and host_bootstrap are unchanged.