ufrisk/MemProcFS
1
0
Fork 0
mirror of https://github.com/ufrisk/MemProcFS.git synced 2026-10-12 02:23:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 5.16.11

Browse Source
This commit is contained in:
Ulf Frisk
2026-01-19 19:52:53 +01:00
parent 51c8e08430
commit 1f3a67f4d8
13 changed files with 35 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
m_vmemd/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 16
#define VERSION_REVISION 10
#define VERSION_BUILD 224
#define VERSION_REVISION 11
#define VERSION_BUILD 225
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
memprocfs/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 16
#define VERSION_REVISION 10
#define VERSION_BUILD 224
#define VERSION_REVISION 11
#define VERSION_BUILD 225
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 16
#define VERSION_REVISION 10
#define VERSION_BUILD 224
#define VERSION_REVISION 11
#define VERSION_BUILD 225
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/vmm.c
+5 -2
View File
@@ -2548,14 +2548,17 @@ BOOL VmmScatter_Read(_In_ PVMMOB_SCATTER hS, _In_ QWORD va, _In_ DWORD cb, _Out_
_Success_(return)
BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_ PVMM_PROCESS pProcess)
{
DWORD i, cbBuffer, cbBufferAlloc, oBufferAllocMEM = 0;
SIZE_T cPagesToAlloc, cbBuffer, cbBufferAlloc, oBufferAllocMEM = 0;
DWORD i;
PMEM_SCATTER pMEM;
PPMEM_SCATTER ppMEMs;
PVMM_SCATTER_RANGE pRange;
// validate
if(!hS->cPageTotal || (hS->cPageTotal != ObMap_Size(hS->pmMEMs))) { return FALSE; }
// alloc (if required)
cbBuffer = (hS->cPageTotal - hS->cPageAlloc) * 0x1000;
cPagesToAlloc = (hS->cPageTotal - hS->cPageAlloc);
if((cPagesToAlloc > 0x000f0000) && (sizeof(SIZE_T) < 8)) { return FALSE; }
cbBuffer = cPagesToAlloc * 0x1000;
if(!hS->fExecute) {
cbBufferAlloc = cbBuffer + hS->cPageTotal * sizeof(PMEM_SCATTER);
if(!(hS->pbBuffer = LocalAlloc(LMEM_ZEROINIT, cbBufferAlloc))) { return FALSE; }
vmm/vmmdll_scatter.c
+5 -2
View File
@@ -420,14 +420,17 @@ BOOL VMMDLL_Scatter_Read(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_ DWOR
_Success_(return)
BOOL VMMDLL_Scatter_ExecuteReadInternal(_In_ PSCATTER_CONTEXT ctx)
{
DWORD i, cbBuffer, cbBufferAlloc, oBufferAllocMEM = 0;
SIZE_T cPagesToAlloc, cbBuffer, cbBufferAlloc, oBufferAllocMEM = 0;
DWORD i;
PMEM_SCATTER pMEM;
PPMEM_SCATTER ppMEMs;
PSCATTER_RANGE pRange;
// validate
if(!ctx->cPageTotal || (ctx->cPageTotal != ObMap_Size(ctx->pmMEMs))) { return FALSE; }
// alloc (if required)
cbBuffer = (ctx->cPageTotal - ctx->cPageAlloc) * 0x1000;
cPagesToAlloc = (ctx->cPageTotal - ctx->cPageAlloc);
if((cPagesToAlloc > 0x000f0000) && (sizeof(SIZE_T) < 8)) { return FALSE; }
cbBuffer = cPagesToAlloc * 0x1000;
if(!ctx->fExecute) {
cbBufferAlloc = cbBuffer + ctx->cPageTotal * sizeof(PMEM_SCATTER);
if(!(ctx->pbBuffer = LocalAlloc(LMEM_ZEROINIT, cbBufferAlloc))) { return FALSE; }
vmm/vmmwininit.c
+10 -3
View File
@@ -48,9 +48,16 @@ VOID VmmWinInit_TryInitializeThreading(_In_ VMM_HANDLE H)
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_ETHREAD", "Win32StartAddress", &pti->oWin32StartAddress) &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_ETHREAD", "ThreadListEntry", &pti->oThreadListEntry) &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_ETHREAD", "Cid", &pti->oCid) &&
PDB_GetTypeSize(H, PDB_HANDLE_KERNEL, "_ETHREAD", &cbEThread) &&
(PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Rip", &pti->oTrapRip) || PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Eip", &pti->oTrapRip)) &&
(PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Rsp", &pti->oTrapRsp) || PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "HardwareEsp", &pti->oTrapRsp));
PDB_GetTypeSize(H, PDB_HANDLE_KERNEL, "_ETHREAD", &cbEThread);
if(H->vmm.f32) {
f = f &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Eip", &pti->oTrapRip) &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "HardwareEsp", &pti->oTrapRsp);
} else {
f = f &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Rip", &pti->oTrapRip) &&
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTRAP_FRAME", "Rsp", &pti->oTrapRsp);
}
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTHREAD", "Process", &pti->oProcessOpt); // optional - does not exist in xp.
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_KTHREAD", "Running", &pti->oRunningOpt); // optional - does not exist in vista/xp.
PDB_GetTypeChildOffsetShort(H, PDB_HANDLE_KERNEL, "_ETHREAD", "ClientSecurity", &pti->oClientSecurityOpt); // optional - does not exist in xp.
vmmpyc/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 16
#define VERSION_REVISION 10
#define VERSION_BUILD 224
#define VERSION_REVISION 11
#define VERSION_BUILD 225
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmmrust/leechcore_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "leechcore_example"
version = "5.16.10"
version = "5.16.11"
edition = "2021"
publish = false
vmmrust/m_example_plugin/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "m_example_plugin"
version = "5.16.10"
version = "5.16.11"
edition = "2021"
publish = false
vmmrust/memprocfs/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs"
version = "5.16.10"
version = "5.16.11"
edition = "2021"
description = "MemProcFS - Physical Memory Analysis Framework"
documentation = "https://docs.rs/memprocfs"
vmmrust/memprocfs_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs_example"
version = "5.16.10"
version = "5.16.11"
edition = "2021"
publish = false
vmmsharp/vmmsharp/Properties/AssemblyInfo.cs
+2 -2
View File
@@ -32,5 +32,5 @@ using System.Runtime.Versioning;
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("5.16.10.224")]
[assembly: AssemblyFileVersion("5.16.10.224")]
[assembly: AssemblyVersion("5.16.11.225")]
[assembly: AssemblyFileVersion("5.16.11.225")]
vmmsharp/vmmsharp/vmmsharp.csproj
+1 -1
View File
@@ -109,7 +109,7 @@
<None Include="logo.png" Pack="true" Visible="true" PackagePath="" />
</ItemGroup>
<PropertyGroup>
<Version>5.16.10</Version>
<Version>5.16.11</Version>
<RepositoryUrl>https://github.com/ufrisk/MemProcFS</RepositoryUrl>
<RepositoryType>git</RepositoryType>
<PackageLicenseFile>LICENSE</PackageLicenseFile>