lirent 3028a4eb11 Take the kernel cr3 in the read-only win32 constructor ...

vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset
profile read-only from the image (find ntoskrnl, resolve
PsInitialSystemProcess, build the profile, derive the System _EPROCESS),
so a read-only context has the full read surface - including
proc_list/proc_modules, not just the cr3-parameterised PE walks.

The read-only bring-up tail is factored out of host_bootstrap into a
shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK
around it, so its behaviour and return codes are unchanged.

2026-06-20 17:02:29 +03:00

..

codeanalysis.h

Add function-level code diff over caller-supplied views

2026-06-16 20:21:36 +03:00

memmodel.h

Construct the memory source from a file descriptor

2026-06-20 11:20:33 +03:00

pmap.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

scan.h

Add code-structure analysis: call graph, jump tables, basic blocks, constant xref

2026-06-16 19:52:25 +03:00

siggen.h

Add function inventory (.pdata), signature generation, and export/PDB symbols

2026-06-16 19:27:42 +03:00

sigscan.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

snapdiff.h

Add process-scoped scanning algorithms: multi-pattern, code-xref, pointer-map, dissection, snapshot diff

2026-06-16 17:38:10 +03:00

win32.h

Take the kernel cr3 in the read-only win32 constructor

2026-06-20 17:02:29 +03:00

x86dec.h

Add code-structure analysis: call graph, jump tables, basic blocks, constant xref

2026-06-16 19:52:25 +03:00