mirror of
https://github.com/ufrisk/MemProcFS.git
synced 2026-10-12 02:23:53 +00:00
Version 5.18.11
This commit is contained in:
+2
-2
@@ -3,8 +3,8 @@
|
||||
|
||||
#define VERSION_MAJOR 5
|
||||
#define VERSION_MINOR 18
|
||||
#define VERSION_REVISION 10
|
||||
#define VERSION_BUILD 249
|
||||
#define VERSION_REVISION 11
|
||||
#define VERSION_BUILD 250
|
||||
|
||||
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
|
||||
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
|
||||
|
||||
@@ -238,7 +238,7 @@ VOID VfsDokan_Close(_In_ CHAR chMountPoint)
|
||||
if(wchMountPoint) {
|
||||
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
|
||||
if(!hModuleDokan) {
|
||||
hModuleDokan = LoadLibraryA("dokan2.dll");
|
||||
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
|
||||
}
|
||||
if(hModuleDokan) {
|
||||
pfnDokanUnmount = (BOOL(WINAPI *)(WCHAR))GetProcAddress(hModuleDokan, "DokanUnmount");
|
||||
@@ -343,7 +343,7 @@ VOID VfsDokan_InitializeAndMount(_In_ CHAR chMountPoint)
|
||||
// allocate
|
||||
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
|
||||
if(!hModuleDokan) {
|
||||
hModuleDokan = LoadLibraryA("dokan2.dll");
|
||||
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
|
||||
}
|
||||
if(!hModuleDokan) {
|
||||
printf("MOUNT: Failed. The required DOKANY file system library is not installed. \n");
|
||||
@@ -538,7 +538,7 @@ int wmain(_In_ int argc, _In_ wchar_t* argv[])
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
LoadLibraryA("leechcore.dll");
|
||||
LoadLibraryExA("leechcore.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
|
||||
if(!(szArgs = LocalAlloc(LMEM_ZEROINIT, (argc + 1ULL) * sizeof(LPSTR)))) {
|
||||
printf("MemProcFS: Out of memory!\n");
|
||||
return 1;
|
||||
|
||||
@@ -108,7 +108,7 @@ static int vfs_read(const char *uszPath, char *buffer, size_t size, off_t offset
|
||||
}
|
||||
// 2: read
|
||||
nt = VMMDLL_VfsReadU(g_hVMM, (LPSTR)uszPathCopy, (PBYTE)buffer, size, &readlength, offset);
|
||||
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)readlength : 0;
|
||||
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)readlength : -EIO;
|
||||
}
|
||||
|
||||
static int vfs_truncate(const char *path, off_t size)
|
||||
@@ -129,7 +129,8 @@ static int vfs_write(const char *uszPath, const char *buffer, size_t size, off_t
|
||||
}
|
||||
// 2: write
|
||||
nt = VMMDLL_VfsWriteU(g_hVMM, (LPSTR)uszPathCopy, (PBYTE)buffer, size, &writelength, offset);
|
||||
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)size : 0;
|
||||
if((nt != VMMDLL_STATUS_SUCCESS) && (nt != VMMDLL_STATUS_END_OF_FILE)) { return -EIO; }
|
||||
return (writelength == size) ? (int)writelength : -EIO;
|
||||
}
|
||||
|
||||
static struct fuse_operations vfs_operations = {
|
||||
|
||||
@@ -537,12 +537,14 @@ BOOL ObSet_PushData(_In_opt_ POB_SET pvs, _In_opt_ POB_DATA pDataSrc)
|
||||
*/
|
||||
VOID ObSet_Push_PageAlign(_In_opt_ POB_SET pvs, _In_ QWORD a, _In_ DWORD cb)
|
||||
{
|
||||
QWORD qwA;
|
||||
if(!OB_SET_IS_VALID(pvs)) { return; }
|
||||
QWORD qwA, qwEnd;
|
||||
if(!OB_SET_IS_VALID(pvs) || (a > (QWORD)-1 - cb)) { return; }
|
||||
qwA = a & ~0xfff;
|
||||
if(qwA == 0xfffffffffffff000) { return; }
|
||||
while(qwA < a + cb) {
|
||||
qwEnd = a + cb;
|
||||
while(qwA < qwEnd) {
|
||||
ObSet_Push(pvs, qwA);
|
||||
if(qwA == 0xfffffffffffff000) { break; }
|
||||
qwA += 0x1000;
|
||||
}
|
||||
}
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@
|
||||
|
||||
#define VERSION_MAJOR 5
|
||||
#define VERSION_MINOR 18
|
||||
#define VERSION_REVISION 10
|
||||
#define VERSION_BUILD 249
|
||||
#define VERSION_REVISION 11
|
||||
#define VERSION_BUILD 250
|
||||
|
||||
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
|
||||
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
|
||||
|
||||
+1
-1
@@ -127,7 +127,7 @@ PVFSLISTOB_DIRECTORY VfsList_GetDirectory(_In_ LPSTR uszPath)
|
||||
QWORD i = 0, qwHash;
|
||||
PVFSLISTOB_DIRECTORY pObDir = NULL;
|
||||
VMMDLL_VFS_FILELIST2 VfsFileList;
|
||||
CHAR c, uszPathCopy[3 * MAX_PATH];
|
||||
CHAR c, uszPathCopy[3 * MAX_PATH] = { 0 };
|
||||
// 1: try fetch from cache:
|
||||
qwHash = CharUtil_HashPathFsU(uszPath);
|
||||
if((pObDir = ObCacheMap_GetByKey(g_ctxVfsList.pcm, qwHash))) {
|
||||
|
||||
@@ -73,7 +73,7 @@ static HMODULE VmmlxLoader_LoadLocalModule()
|
||||
if(0 != wcscpy_s(wszSlash + 1, _countof(wszPath) - (wszSlash + 1 - wszPath), L"vmmlx.dll")) {
|
||||
return NULL;
|
||||
}
|
||||
g_VmmlxLoader.hModule = LoadLibraryW(wszPath);
|
||||
g_VmmlxLoader.hModule = LoadLibraryExW(wszPath, NULL, LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR | LOAD_LIBRARY_SEARCH_DEFAULT_DIRS);
|
||||
return g_VmmlxLoader.hModule;
|
||||
}
|
||||
#elif defined(MACOS)
|
||||
|
||||
+5
-3
@@ -537,12 +537,14 @@ BOOL ObSet_PushData(_In_opt_ POB_SET pvs, _In_opt_ POB_DATA pDataSrc)
|
||||
*/
|
||||
VOID ObSet_Push_PageAlign(_In_opt_ POB_SET pvs, _In_ QWORD a, _In_ DWORD cb)
|
||||
{
|
||||
QWORD qwA;
|
||||
if(!OB_SET_IS_VALID(pvs)) { return; }
|
||||
QWORD qwA, qwEnd;
|
||||
if(!OB_SET_IS_VALID(pvs) || (a > (QWORD)-1 - cb)) { return; }
|
||||
qwA = a & ~0xfff;
|
||||
if(qwA == 0xfffffffffffff000) { return; }
|
||||
while(qwA < a + cb) {
|
||||
qwEnd = a + cb;
|
||||
while(qwA < qwEnd) {
|
||||
ObSet_Push(pvs, qwA);
|
||||
if(qwA == 0xfffffffffffff000) { break; }
|
||||
qwA += 0x1000;
|
||||
}
|
||||
}
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@
|
||||
|
||||
#define VERSION_MAJOR 5
|
||||
#define VERSION_MINOR 18
|
||||
#define VERSION_REVISION 10
|
||||
#define VERSION_BUILD 249
|
||||
#define VERSION_REVISION 11
|
||||
#define VERSION_BUILD 250
|
||||
|
||||
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
|
||||
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
|
||||
|
||||
@@ -119,10 +119,13 @@ HANDLE CreateThread(
|
||||
PHANDLE_INTERNAL_THREAD ph;
|
||||
pthread_t thread;
|
||||
int status;
|
||||
status = pthread_create(&thread, NULL, lpStartAddress, lpParameter);
|
||||
if(status) { return NULL; }
|
||||
ph = malloc(sizeof(HANDLE_INTERNAL_THREAD));
|
||||
if(!ph) { return NULL; }
|
||||
status = pthread_create(&thread, NULL, lpStartAddress, lpParameter);
|
||||
if(status) {
|
||||
free(ph);
|
||||
return NULL;
|
||||
}
|
||||
ph->magic = OSCOMPATIBILITY_HANDLE_INTERNAL;
|
||||
ph->type = OSCOMPATIBILITY_HANDLE_TYPE_THREAD;
|
||||
ph->thread = thread;
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@
|
||||
|
||||
#define VERSION_MAJOR 5
|
||||
#define VERSION_MINOR 18
|
||||
#define VERSION_REVISION 10
|
||||
#define VERSION_BUILD 249
|
||||
#define VERSION_REVISION 11
|
||||
#define VERSION_BUILD 250
|
||||
|
||||
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
|
||||
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
|
||||
|
||||
@@ -78,6 +78,7 @@ PyObject* VmmPyc_MemRead_Multi(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _In_ LPSTR s
|
||||
return PyErr_Format(PyExc_RuntimeError, "%s: Illegal argument.", szFN);
|
||||
}
|
||||
cItem = (DWORD)PyList_Size(pyListSrc);
|
||||
if(cItem > 0x01000000) { return PyErr_NoMemory(); }
|
||||
pMultiInfo = LocalAlloc(LMEM_ZEROINIT, cItem * sizeof(struct MultiInfo));
|
||||
hS = VMMDLL_Scatter_Initialize(H, dwPID, (DWORD)flags);
|
||||
pyListResult = PyList_New(0);
|
||||
@@ -303,6 +304,7 @@ PyObject* VmmPyc_MemReadType(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _In_ LPSTR szF
|
||||
flags = PyLong_AsUnsignedLongLong(pyObjArg1);
|
||||
}
|
||||
cItem = (DWORD)PyList_Size(pyObjArg0);
|
||||
if(cItem > (SIZE_T)-1 / sizeof(struct MultiInfo)) { return PyErr_NoMemory(); }
|
||||
pMultiInfo = LocalAlloc(LMEM_ZEROINIT, cItem * sizeof(struct MultiInfo));
|
||||
if(!pMultiInfo) { goto fail; }
|
||||
hS = VMMDLL_Scatter_Initialize(H, dwPID, (DWORD)flags | VMMDLL_FLAG_NO_PREDICTIVE_READ);
|
||||
|
||||
+1
-1
@@ -364,7 +364,7 @@ PyObj_RegHive* VmmPycRegHive_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ PVMM
|
||||
PyObj_RegMemory* VmmPycRegMemory_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ QWORD vaCMHive);
|
||||
PyObj_RegKey* VmmPycRegKey_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszFullPathKey, _In_ BOOL fVerify);
|
||||
PyObj_RegValue* VmmPycRegValue_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszFullPathKeyValue, _In_ BOOL fVerify);
|
||||
_Success_(return != NULL) PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue);
|
||||
PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue);
|
||||
PyObj_Vmm *VmmPycVmm_InitializeInternal2(_In_ PyObj_Vmm *pyVMM, _In_ VMM_HANDLE hVMM);
|
||||
PyObj_Search *VmmPycSearch_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_opt_ DWORD dwPID, _In_ PyObject *args);
|
||||
PyObj_Yara *VmmPycYara_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_opt_ DWORD dwPID, _In_ PyObject *args);
|
||||
|
||||
+24
-13
@@ -7,7 +7,6 @@
|
||||
|
||||
PyObject *g_pPyType_RegKey = NULL;
|
||||
|
||||
_Success_(return != NULL)
|
||||
PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue)
|
||||
{
|
||||
BOOL fResult;
|
||||
@@ -65,22 +64,25 @@ static PyObject*
|
||||
VmmPycRegKey_values(PyObj_RegKey *self, void *closure)
|
||||
{
|
||||
BOOL fResult;
|
||||
DWORD cch, i = 0;
|
||||
DWORD cch, cchMax, i = 0;
|
||||
PyObject *pyList;
|
||||
CHAR usz[2 * MAX_PATH];
|
||||
LPSTR uszValueName;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys(): Not initialized."); }
|
||||
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
|
||||
if(cch >= sizeof(usz) - 1) { return PyList_New(0); }
|
||||
if(!(pyList = PyList_New(0))) { return PyErr_NoMemory(); }
|
||||
strcpy_s(usz, _countof(usz), self->uszPath);
|
||||
cch = (DWORD)strlen(usz);
|
||||
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
|
||||
usz[cch] = '\\';
|
||||
uszValueName = usz + cch + 1;
|
||||
while(TRUE) {
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
cch = MAX_PATH;
|
||||
cch = cchMax;
|
||||
fResult = VMMDLL_WinReg_EnumValueU(self->pyVMM->hVMM, self->uszPath, i++, uszValueName, &cch, NULL, NULL, NULL);
|
||||
Py_END_ALLOW_THREADS;
|
||||
if(!fResult) { break; }
|
||||
if(!cch || (cch > cchMax)) { break; }
|
||||
PyList_Append_DECREF(pyList, (PyObject*)VmmPycRegValue_InitializeInternal(self->pyVMM, usz, FALSE));
|
||||
}
|
||||
return pyList;
|
||||
@@ -91,23 +93,26 @@ static PyObject*
|
||||
VmmPycRegKey_values_dict(PyObj_RegKey *self, void *closure)
|
||||
{
|
||||
BOOL fResult;
|
||||
DWORD cch, i = 0;
|
||||
DWORD cch, cchMax, i = 0;
|
||||
PyObject *pyDict;
|
||||
PyObj_RegValue *pyObjValue;
|
||||
CHAR usz[2 * MAX_PATH];
|
||||
LPSTR uszValueName;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.values_dict(): Not initialized."); }
|
||||
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
|
||||
if(cch >= sizeof(usz) - 1) { return PyDict_New(); }
|
||||
if(!(pyDict = PyDict_New())) { return PyErr_NoMemory(); }
|
||||
strcpy_s(usz, _countof(usz), self->uszPath);
|
||||
cch = (DWORD)strlen(usz);
|
||||
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
|
||||
usz[cch] = '\\';
|
||||
uszValueName = usz + cch + 1;
|
||||
while(TRUE) {
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
cch = MAX_PATH;
|
||||
cch = cchMax;
|
||||
fResult = VMMDLL_WinReg_EnumValueU(self->pyVMM->hVMM, self->uszPath, i++, uszValueName, &cch, NULL, NULL, NULL);
|
||||
Py_END_ALLOW_THREADS;
|
||||
if(!fResult) { break; }
|
||||
if(!cch || (cch > cchMax)) { break; }
|
||||
if((pyObjValue = VmmPycRegValue_InitializeInternal(self->pyVMM, usz, FALSE))) {
|
||||
PyDict_SetItemUnicode_DECREF(pyDict, pyObjValue->pyName, (PyObject*)pyObjValue);
|
||||
}
|
||||
@@ -120,22 +125,25 @@ static PyObject*
|
||||
VmmPycRegKey_subkeys(PyObj_RegKey *self, void *closure)
|
||||
{
|
||||
BOOL fResult;
|
||||
DWORD cch, i = 0;
|
||||
DWORD cch, cchMax, i = 0;
|
||||
PyObject *pyList;
|
||||
CHAR usz[2*MAX_PATH];
|
||||
LPSTR uszKeyName;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys(): Not initialized."); }
|
||||
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
|
||||
if(cch >= sizeof(usz) - 1) { return PyList_New(0); }
|
||||
if(!(pyList = PyList_New(0))) { return PyErr_NoMemory(); }
|
||||
strcpy_s(usz, _countof(usz), self->uszPath);
|
||||
cch = (DWORD)strlen(usz);
|
||||
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
|
||||
usz[cch] = '\\';
|
||||
uszKeyName = usz + cch + 1;
|
||||
while(TRUE) {
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
cch = MAX_PATH;
|
||||
cch = cchMax;
|
||||
fResult = VMMDLL_WinReg_EnumKeyExU(self->pyVMM->hVMM, self->uszPath, i++, uszKeyName, &cch, NULL);
|
||||
Py_END_ALLOW_THREADS;
|
||||
if(!fResult) { break; }
|
||||
if(!cch || (cch > cchMax)) { break; }
|
||||
PyList_Append_DECREF(pyList, (PyObject*)VmmPycRegKey_InitializeInternal(self->pyVMM, usz, FALSE));
|
||||
}
|
||||
return pyList;
|
||||
@@ -146,23 +154,26 @@ static PyObject*
|
||||
VmmPycRegKey_subkeys_dict(PyObj_RegKey *self, void *closure)
|
||||
{
|
||||
BOOL fResult;
|
||||
DWORD cch, i = 0;
|
||||
DWORD cch, cchMax, i = 0;
|
||||
PyObject *pyDict;
|
||||
PyObj_RegKey *pyObjKey;
|
||||
CHAR usz[2*MAX_PATH];
|
||||
LPSTR uszKeyName;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys_dict(): Not initialized."); }
|
||||
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
|
||||
if(cch >= sizeof(usz) - 1) { return PyDict_New(); }
|
||||
if(!(pyDict = PyDict_New())) { return PyErr_NoMemory(); }
|
||||
strcpy_s(usz, _countof(usz), self->uszPath);
|
||||
cch = (DWORD)strlen(usz);
|
||||
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
|
||||
usz[cch] = '\\';
|
||||
uszKeyName = usz + cch + 1;
|
||||
while(TRUE) {
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
cch = MAX_PATH;
|
||||
cch = cchMax;
|
||||
fResult = VMMDLL_WinReg_EnumKeyExU(self->pyVMM->hVMM, self->uszPath, i++, uszKeyName, &cch, NULL);
|
||||
Py_END_ALLOW_THREADS;
|
||||
if(!fResult) { break; }
|
||||
if(!cch || (cch > cchMax)) { break; }
|
||||
if((pyObjKey = VmmPycRegKey_InitializeInternal(self->pyVMM, usz, FALSE))) {
|
||||
PyDict_SetItemUnicode_DECREF(pyDict, pyObjKey->pyName, (PyObject*)pyObjKey);
|
||||
}
|
||||
|
||||
@@ -49,16 +49,14 @@ VmmPycSearch_start(PyObj_Search *self, PyObject *args)
|
||||
HANDLE hThread;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "VmmSearch.start(): Not initialized."); }
|
||||
if(!self->ctxSearch.cSearch) { return PyErr_Format(PyExc_RuntimeError, "VmmSearch.start(): No search criteria."); }
|
||||
if(self->fStarted) { Py_BuildValue("s", NULL); } // None returned on success.
|
||||
if(self->fStarted) { return Py_BuildValue("s", NULL); } // None returned on success.
|
||||
self->fStarted = TRUE;
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
if(!self->fStarted) {
|
||||
self->fStarted = TRUE;
|
||||
hThread = CreateThread(NULL, 0, VmmPycSearch_start_ThreadProc, self, 0, NULL);
|
||||
if(hThread) {
|
||||
CloseHandle(hThread);
|
||||
} else {
|
||||
self->fCompleted = TRUE;
|
||||
}
|
||||
hThread = CreateThread(NULL, 0, VmmPycSearch_start_ThreadProc, self, 0, NULL);
|
||||
if(hThread) {
|
||||
CloseHandle(hThread);
|
||||
} else {
|
||||
self->fCompleted = TRUE;
|
||||
}
|
||||
Py_END_ALLOW_THREADS;
|
||||
return Py_BuildValue("s", NULL); // None returned on success.
|
||||
|
||||
+2
-2
@@ -97,7 +97,7 @@ VmmPycVfs_list(PyObj_Vfs *self, PyObject *args)
|
||||
}
|
||||
if(!result) {
|
||||
Py_DECREF(pyDict);
|
||||
PyErr_Format(PyExc_RuntimeError, "Vfs.list(): Failed.");
|
||||
return PyErr_Format(PyExc_RuntimeError, "Vfs.list(): Failed.");
|
||||
}
|
||||
return pyDict;
|
||||
}
|
||||
@@ -141,7 +141,7 @@ VmmPycVfs_write(PyObj_Vfs *self, PyObject *args)
|
||||
BOOL result;
|
||||
SIZE_T cb;
|
||||
DWORD cbWritten;
|
||||
ULONG64 cbOffset;
|
||||
ULONG64 cbOffset = 0;
|
||||
PBYTE pb;
|
||||
LPSTR uszPathPython = NULL, uszPath;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "Vfs.write(): Not initialized."); }
|
||||
|
||||
+8
-10
@@ -32,7 +32,7 @@ BOOL VmmPycYara_SearchResultCB(_In_ PVOID pvContext, _In_ PVMMYARA_RULE_MATCH pR
|
||||
for(i = 0; i < pRuleMatch->cMeta; i++) {
|
||||
PyDict_SetItemString_DECREF(pyDictMeta, pRuleMatch->Meta[i].szIdentifier, PyUnicode_FromString(pRuleMatch->Meta[i].szString));
|
||||
}
|
||||
PyDict_SetItemString_DECREF(pyDictResult, "meta", pyListTags);
|
||||
PyDict_SetItemString_DECREF(pyDictResult, "meta", pyDictMeta);
|
||||
}
|
||||
if((pyDictMatch = PyDict_New())) {
|
||||
for(i = 0; i < pRuleMatch->cStrings; i++) {
|
||||
@@ -74,16 +74,14 @@ VmmPycYara_start(PyObj_Yara *self, PyObject *args)
|
||||
{
|
||||
HANDLE hThread;
|
||||
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "VmmYara.start(): Not initialized."); }
|
||||
if(self->fStarted) { Py_BuildValue("s", NULL); } // None returned on success.
|
||||
if(self->fStarted) { return Py_BuildValue("s", NULL); } // None returned on success.
|
||||
self->fStarted = TRUE;
|
||||
Py_BEGIN_ALLOW_THREADS;
|
||||
if(!self->fStarted) {
|
||||
self->fStarted = TRUE;
|
||||
hThread = CreateThread(NULL, 0, VmmPycYara_start_ThreadProc, self, 0, NULL);
|
||||
if(hThread) {
|
||||
CloseHandle(hThread);
|
||||
} else {
|
||||
self->fCompleted = TRUE;
|
||||
}
|
||||
hThread = CreateThread(NULL, 0, VmmPycYara_start_ThreadProc, self, 0, NULL);
|
||||
if(hThread) {
|
||||
CloseHandle(hThread);
|
||||
} else {
|
||||
self->fCompleted = TRUE;
|
||||
}
|
||||
Py_END_ALLOW_THREADS;
|
||||
return Py_BuildValue("s", NULL); // None returned on success.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "leechcore_example"
|
||||
version = "5.18.10"
|
||||
version = "5.18.11"
|
||||
edition = "2021"
|
||||
publish = false
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "m_example_plugin"
|
||||
version = "5.18.10"
|
||||
version = "5.18.11"
|
||||
edition = "2021"
|
||||
publish = false
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "memprocfs"
|
||||
version = "5.18.10"
|
||||
version = "5.18.11"
|
||||
edition = "2021"
|
||||
description = "MemProcFS - Physical Memory Analysis Framework"
|
||||
documentation = "https://docs.rs/memprocfs"
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "memprocfs_example"
|
||||
version = "5.18.10"
|
||||
version = "5.18.11"
|
||||
edition = "2021"
|
||||
publish = false
|
||||
|
||||
|
||||
@@ -32,5 +32,5 @@ using System.Runtime.Versioning;
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("5.18.10.249")]
|
||||
[assembly: AssemblyFileVersion("5.18.10.249")]
|
||||
[assembly: AssemblyVersion("5.18.11.250")]
|
||||
[assembly: AssemblyFileVersion("5.18.11.250")]
|
||||
|
||||
@@ -109,7 +109,7 @@
|
||||
<None Include="logo.png" Pack="true" Visible="true" PackagePath="" />
|
||||
</ItemGroup>
|
||||
<PropertyGroup>
|
||||
<Version>5.18.10</Version>
|
||||
<Version>5.18.11</Version>
|
||||
<RepositoryUrl>https://github.com/ufrisk/MemProcFS</RepositoryUrl>
|
||||
<RepositoryType>git</RepositoryType>
|
||||
<PackageLicenseFile>LICENSE</PackageLicenseFile>
|
||||
|
||||
Reference in New Issue
Block a user