lirent 3028a4eb11 Take the kernel cr3 in the read-only win32 constructor
vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset
profile read-only from the image (find ntoskrnl, resolve
PsInitialSystemProcess, build the profile, derive the System _EPROCESS),
so a read-only context has the full read surface - including
proc_list/proc_modules, not just the cr3-parameterised PE walks.

The read-only bring-up tail is factored out of host_bootstrap into a
shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK
around it, so its behaviour and return codes are unchanged.
2026-06-20 17:02:29 +03:00
2026-06-17 15:23:19 +03:00
S
Description
No description provided
MIT 394 KiB
Languages
C 97.5%
CMake 2.5%