mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-06-18 00:56:37 +03:00
lirent
50ed32b7dc
code_diff compares two views of the same code in one coordinate space - an on-disk image section against the live in-memory section, or one .text across two snapshots - and reports the functions whose body changed. For each function extent it func_hash()es the slice of each view and flags a mismatch: a patch, an inline hook, or an unpacked/JIT-rewritten body. A thin handler over func_hash + mem_sub, with no file I/O of its own - the caller owns reading the on-disk image. The relocation limit (absolute-address immediates) is documented; two snapshots at the same base diff exactly. Closes the non-starred reversing series.