mirror of
https://dev.lirent.ru/Vatrog/vm-introspection-engine.git
synced 2026-06-18 02:06:36 +03:00
lirent
93966c3df2
Name and isolate the Windows engine as one of potentially several. The public surface moves to include/win32.h with an opaque vmie_win32 handle (vmie_win32_open/close/mem); the engine's Windows internals — host bring-up, the struct-offset profile, process/module/PE/text decode — live under src/engine/win32. The generic address-space layer stays in src/engine (gva.c + engine-arch.h, carrying no offset table): gva.c is de-profiled, and CR3 bring-up reaches the hot translator through a cold gva_translate bridge so the zero-copy hot path stays private and inlinable. A memory source is now first-class and public: vmie_mem_open/_open_segs/ _close open a flat dump (or an explicit segment map) as a vmie_mem, with gpa_seg promoted to the public contract. The physical signature scan is exposed source-agnostically: sig_scan_mem returns GPAs for any vmie_mem, sig_scan_sources scans several sources with per-source attribution, and sig_from_bytes builds an exact needle from a byte span. The pure matcher is unchanged; dumps and the live engine image are scanned uniformly, neither needing the other.
27 lines
456 B
C
27 lines
456 B
C
#ifndef CONTRACT_MAGIC0
|
|
#define CONTRACT_MAGIC0 0x3A7C1E94B2D6F058ull
|
|
#endif
|
|
|
|
#ifndef CONTRACT_MAGIC1
|
|
#define CONTRACT_MAGIC1 0x9F41D80E6BC57A23ull
|
|
#endif
|
|
|
|
#ifndef CONTRACT_ACK
|
|
#define CONTRACT_ACK 0xACED5EEDACED5EEDull
|
|
#endif
|
|
|
|
#ifndef VMIE_CONTRACT_H
|
|
#define VMIE_CONTRACT_H
|
|
|
|
#include <stdint.h>
|
|
|
|
#pragma pack(push, 1)
|
|
typedef struct {
|
|
uint64_t magic0;
|
|
uint64_t magic1;
|
|
uint64_t va_self;
|
|
uint64_t ack;
|
|
} contract;
|
|
#pragma pack(pop)
|
|
|
|
#endif |