Version 5.18.11

This commit is contained in:
Ulf Frisk
2026-09-14 23:19:49 +02:00
parent 1172b5b2eb
commit b5c5182efd
24 changed files with 595 additions and 494 deletions
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 10
#define VERSION_BUILD 249
#define VERSION_REVISION 11
#define VERSION_BUILD 250
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
+3 -3
View File
@@ -238,7 +238,7 @@ VOID VfsDokan_Close(_In_ CHAR chMountPoint)
if(wchMountPoint) {
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
if(!hModuleDokan) {
hModuleDokan = LoadLibraryA("dokan2.dll");
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
}
if(hModuleDokan) {
pfnDokanUnmount = (BOOL(WINAPI *)(WCHAR))GetProcAddress(hModuleDokan, "DokanUnmount");
@@ -343,7 +343,7 @@ VOID VfsDokan_InitializeAndMount(_In_ CHAR chMountPoint)
// allocate
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
if(!hModuleDokan) {
hModuleDokan = LoadLibraryA("dokan2.dll");
hModuleDokan = LoadLibraryExA("dokan2.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
}
if(!hModuleDokan) {
printf("MOUNT: Failed. The required DOKANY file system library is not installed. \n");
@@ -538,7 +538,7 @@ int wmain(_In_ int argc, _In_ wchar_t* argv[])
return 1;
}
}
LoadLibraryA("leechcore.dll");
LoadLibraryExA("leechcore.dll", NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
if(!(szArgs = LocalAlloc(LMEM_ZEROINIT, (argc + 1ULL) * sizeof(LPSTR)))) {
printf("MemProcFS: Out of memory!\n");
return 1;
+3 -2
View File
@@ -108,7 +108,7 @@ static int vfs_read(const char *uszPath, char *buffer, size_t size, off_t offset
}
// 2: read
nt = VMMDLL_VfsReadU(g_hVMM, (LPSTR)uszPathCopy, (PBYTE)buffer, size, &readlength, offset);
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)readlength : 0;
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)readlength : -EIO;
}
static int vfs_truncate(const char *path, off_t size)
@@ -129,7 +129,8 @@ static int vfs_write(const char *uszPath, const char *buffer, size_t size, off_t
}
// 2: write
nt = VMMDLL_VfsWriteU(g_hVMM, (LPSTR)uszPathCopy, (PBYTE)buffer, size, &writelength, offset);
return ((nt == VMMDLL_STATUS_SUCCESS) || (nt == VMMDLL_STATUS_END_OF_FILE)) ? (int)size : 0;
if((nt != VMMDLL_STATUS_SUCCESS) && (nt != VMMDLL_STATUS_END_OF_FILE)) { return -EIO; }
return (writelength == size) ? (int)writelength : -EIO;
}
static struct fuse_operations vfs_operations = {
+5 -3
View File
@@ -537,12 +537,14 @@ BOOL ObSet_PushData(_In_opt_ POB_SET pvs, _In_opt_ POB_DATA pDataSrc)
*/
VOID ObSet_Push_PageAlign(_In_opt_ POB_SET pvs, _In_ QWORD a, _In_ DWORD cb)
{
QWORD qwA;
if(!OB_SET_IS_VALID(pvs)) { return; }
QWORD qwA, qwEnd;
if(!OB_SET_IS_VALID(pvs) || (a > (QWORD)-1 - cb)) { return; }
qwA = a & ~0xfff;
if(qwA == 0xfffffffffffff000) { return; }
while(qwA < a + cb) {
qwEnd = a + cb;
while(qwA < qwEnd) {
ObSet_Push(pvs, qwA);
if(qwA == 0xfffffffffffff000) { break; }
qwA += 0x1000;
}
}
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 10
#define VERSION_BUILD 249
#define VERSION_REVISION 11
#define VERSION_BUILD 250
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
+1 -1
View File
@@ -127,7 +127,7 @@ PVFSLISTOB_DIRECTORY VfsList_GetDirectory(_In_ LPSTR uszPath)
QWORD i = 0, qwHash;
PVFSLISTOB_DIRECTORY pObDir = NULL;
VMMDLL_VFS_FILELIST2 VfsFileList;
CHAR c, uszPathCopy[3 * MAX_PATH];
CHAR c, uszPathCopy[3 * MAX_PATH] = { 0 };
// 1: try fetch from cache:
qwHash = CharUtil_HashPathFsU(uszPath);
if((pObDir = ObCacheMap_GetByKey(g_ctxVfsList.pcm, qwHash))) {
+1 -1
View File
@@ -73,7 +73,7 @@ static HMODULE VmmlxLoader_LoadLocalModule()
if(0 != wcscpy_s(wszSlash + 1, _countof(wszPath) - (wszSlash + 1 - wszPath), L"vmmlx.dll")) {
return NULL;
}
g_VmmlxLoader.hModule = LoadLibraryW(wszPath);
g_VmmlxLoader.hModule = LoadLibraryExW(wszPath, NULL, LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR | LOAD_LIBRARY_SEARCH_DEFAULT_DIRS);
return g_VmmlxLoader.hModule;
}
#elif defined(MACOS)
+5 -3
View File
@@ -537,12 +537,14 @@ BOOL ObSet_PushData(_In_opt_ POB_SET pvs, _In_opt_ POB_DATA pDataSrc)
*/
VOID ObSet_Push_PageAlign(_In_opt_ POB_SET pvs, _In_ QWORD a, _In_ DWORD cb)
{
QWORD qwA;
if(!OB_SET_IS_VALID(pvs)) { return; }
QWORD qwA, qwEnd;
if(!OB_SET_IS_VALID(pvs) || (a > (QWORD)-1 - cb)) { return; }
qwA = a & ~0xfff;
if(qwA == 0xfffffffffffff000) { return; }
while(qwA < a + cb) {
qwEnd = a + cb;
while(qwA < qwEnd) {
ObSet_Push(pvs, qwA);
if(qwA == 0xfffffffffffff000) { break; }
qwA += 0x1000;
}
}
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 10
#define VERSION_BUILD 249
#define VERSION_REVISION 11
#define VERSION_BUILD 250
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
+5 -2
View File
@@ -119,10 +119,13 @@ HANDLE CreateThread(
PHANDLE_INTERNAL_THREAD ph;
pthread_t thread;
int status;
status = pthread_create(&thread, NULL, lpStartAddress, lpParameter);
if(status) { return NULL; }
ph = malloc(sizeof(HANDLE_INTERNAL_THREAD));
if(!ph) { return NULL; }
status = pthread_create(&thread, NULL, lpStartAddress, lpParameter);
if(status) {
free(ph);
return NULL;
}
ph->magic = OSCOMPATIBILITY_HANDLE_INTERNAL;
ph->type = OSCOMPATIBILITY_HANDLE_TYPE_THREAD;
ph->thread = thread;
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 10
#define VERSION_BUILD 249
#define VERSION_REVISION 11
#define VERSION_BUILD 250
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
+2
View File
@@ -78,6 +78,7 @@ PyObject* VmmPyc_MemRead_Multi(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _In_ LPSTR s
return PyErr_Format(PyExc_RuntimeError, "%s: Illegal argument.", szFN);
}
cItem = (DWORD)PyList_Size(pyListSrc);
if(cItem > 0x01000000) { return PyErr_NoMemory(); }
pMultiInfo = LocalAlloc(LMEM_ZEROINIT, cItem * sizeof(struct MultiInfo));
hS = VMMDLL_Scatter_Initialize(H, dwPID, (DWORD)flags);
pyListResult = PyList_New(0);
@@ -303,6 +304,7 @@ PyObject* VmmPyc_MemReadType(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _In_ LPSTR szF
flags = PyLong_AsUnsignedLongLong(pyObjArg1);
}
cItem = (DWORD)PyList_Size(pyObjArg0);
if(cItem > (SIZE_T)-1 / sizeof(struct MultiInfo)) { return PyErr_NoMemory(); }
pMultiInfo = LocalAlloc(LMEM_ZEROINIT, cItem * sizeof(struct MultiInfo));
if(!pMultiInfo) { goto fail; }
hS = VMMDLL_Scatter_Initialize(H, dwPID, (DWORD)flags | VMMDLL_FLAG_NO_PREDICTIVE_READ);
+1 -1
View File
@@ -364,7 +364,7 @@ PyObj_RegHive* VmmPycRegHive_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ PVMM
PyObj_RegMemory* VmmPycRegMemory_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ QWORD vaCMHive);
PyObj_RegKey* VmmPycRegKey_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszFullPathKey, _In_ BOOL fVerify);
PyObj_RegValue* VmmPycRegValue_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszFullPathKeyValue, _In_ BOOL fVerify);
_Success_(return != NULL) PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue);
PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue);
PyObj_Vmm *VmmPycVmm_InitializeInternal2(_In_ PyObj_Vmm *pyVMM, _In_ VMM_HANDLE hVMM);
PyObj_Search *VmmPycSearch_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_opt_ DWORD dwPID, _In_ PyObject *args);
PyObj_Yara *VmmPycYara_InitializeInternal(_In_ PyObj_Vmm *pyVMM, _In_opt_ DWORD dwPID, _In_ PyObject *args);
+24 -13
View File
@@ -7,7 +7,6 @@
PyObject *g_pPyType_RegKey = NULL;
_Success_(return != NULL)
PyObject* VmmPycReg_NameOriginal(_In_ PyObj_Vmm *pyVMM, _In_ LPSTR uszPath, _In_ BOOL fValue)
{
BOOL fResult;
@@ -65,22 +64,25 @@ static PyObject*
VmmPycRegKey_values(PyObj_RegKey *self, void *closure)
{
BOOL fResult;
DWORD cch, i = 0;
DWORD cch, cchMax, i = 0;
PyObject *pyList;
CHAR usz[2 * MAX_PATH];
LPSTR uszValueName;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys(): Not initialized."); }
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
if(cch >= sizeof(usz) - 1) { return PyList_New(0); }
if(!(pyList = PyList_New(0))) { return PyErr_NoMemory(); }
strcpy_s(usz, _countof(usz), self->uszPath);
cch = (DWORD)strlen(usz);
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
usz[cch] = '\\';
uszValueName = usz + cch + 1;
while(TRUE) {
Py_BEGIN_ALLOW_THREADS;
cch = MAX_PATH;
cch = cchMax;
fResult = VMMDLL_WinReg_EnumValueU(self->pyVMM->hVMM, self->uszPath, i++, uszValueName, &cch, NULL, NULL, NULL);
Py_END_ALLOW_THREADS;
if(!fResult) { break; }
if(!cch || (cch > cchMax)) { break; }
PyList_Append_DECREF(pyList, (PyObject*)VmmPycRegValue_InitializeInternal(self->pyVMM, usz, FALSE));
}
return pyList;
@@ -91,23 +93,26 @@ static PyObject*
VmmPycRegKey_values_dict(PyObj_RegKey *self, void *closure)
{
BOOL fResult;
DWORD cch, i = 0;
DWORD cch, cchMax, i = 0;
PyObject *pyDict;
PyObj_RegValue *pyObjValue;
CHAR usz[2 * MAX_PATH];
LPSTR uszValueName;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.values_dict(): Not initialized."); }
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
if(cch >= sizeof(usz) - 1) { return PyDict_New(); }
if(!(pyDict = PyDict_New())) { return PyErr_NoMemory(); }
strcpy_s(usz, _countof(usz), self->uszPath);
cch = (DWORD)strlen(usz);
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
usz[cch] = '\\';
uszValueName = usz + cch + 1;
while(TRUE) {
Py_BEGIN_ALLOW_THREADS;
cch = MAX_PATH;
cch = cchMax;
fResult = VMMDLL_WinReg_EnumValueU(self->pyVMM->hVMM, self->uszPath, i++, uszValueName, &cch, NULL, NULL, NULL);
Py_END_ALLOW_THREADS;
if(!fResult) { break; }
if(!cch || (cch > cchMax)) { break; }
if((pyObjValue = VmmPycRegValue_InitializeInternal(self->pyVMM, usz, FALSE))) {
PyDict_SetItemUnicode_DECREF(pyDict, pyObjValue->pyName, (PyObject*)pyObjValue);
}
@@ -120,22 +125,25 @@ static PyObject*
VmmPycRegKey_subkeys(PyObj_RegKey *self, void *closure)
{
BOOL fResult;
DWORD cch, i = 0;
DWORD cch, cchMax, i = 0;
PyObject *pyList;
CHAR usz[2*MAX_PATH];
LPSTR uszKeyName;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys(): Not initialized."); }
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
if(cch >= sizeof(usz) - 1) { return PyList_New(0); }
if(!(pyList = PyList_New(0))) { return PyErr_NoMemory(); }
strcpy_s(usz, _countof(usz), self->uszPath);
cch = (DWORD)strlen(usz);
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
usz[cch] = '\\';
uszKeyName = usz + cch + 1;
while(TRUE) {
Py_BEGIN_ALLOW_THREADS;
cch = MAX_PATH;
cch = cchMax;
fResult = VMMDLL_WinReg_EnumKeyExU(self->pyVMM->hVMM, self->uszPath, i++, uszKeyName, &cch, NULL);
Py_END_ALLOW_THREADS;
if(!fResult) { break; }
if(!cch || (cch > cchMax)) { break; }
PyList_Append_DECREF(pyList, (PyObject*)VmmPycRegKey_InitializeInternal(self->pyVMM, usz, FALSE));
}
return pyList;
@@ -146,23 +154,26 @@ static PyObject*
VmmPycRegKey_subkeys_dict(PyObj_RegKey *self, void *closure)
{
BOOL fResult;
DWORD cch, i = 0;
DWORD cch, cchMax, i = 0;
PyObject *pyDict;
PyObj_RegKey *pyObjKey;
CHAR usz[2*MAX_PATH];
LPSTR uszKeyName;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "RegKey.subkeys_dict(): Not initialized."); }
cch = (DWORD)strnlen(self->uszPath, sizeof(self->uszPath));
if(cch >= sizeof(usz) - 1) { return PyDict_New(); }
if(!(pyDict = PyDict_New())) { return PyErr_NoMemory(); }
strcpy_s(usz, _countof(usz), self->uszPath);
cch = (DWORD)strlen(usz);
cchMax = min(MAX_PATH, (DWORD)sizeof(usz) - cch - 1);
usz[cch] = '\\';
uszKeyName = usz + cch + 1;
while(TRUE) {
Py_BEGIN_ALLOW_THREADS;
cch = MAX_PATH;
cch = cchMax;
fResult = VMMDLL_WinReg_EnumKeyExU(self->pyVMM->hVMM, self->uszPath, i++, uszKeyName, &cch, NULL);
Py_END_ALLOW_THREADS;
if(!fResult) { break; }
if(!cch || (cch > cchMax)) { break; }
if((pyObjKey = VmmPycRegKey_InitializeInternal(self->pyVMM, usz, FALSE))) {
PyDict_SetItemUnicode_DECREF(pyDict, pyObjKey->pyName, (PyObject*)pyObjKey);
}
+7 -9
View File
@@ -49,16 +49,14 @@ VmmPycSearch_start(PyObj_Search *self, PyObject *args)
HANDLE hThread;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "VmmSearch.start(): Not initialized."); }
if(!self->ctxSearch.cSearch) { return PyErr_Format(PyExc_RuntimeError, "VmmSearch.start(): No search criteria."); }
if(self->fStarted) { Py_BuildValue("s", NULL); } // None returned on success.
if(self->fStarted) { return Py_BuildValue("s", NULL); } // None returned on success.
self->fStarted = TRUE;
Py_BEGIN_ALLOW_THREADS;
if(!self->fStarted) {
self->fStarted = TRUE;
hThread = CreateThread(NULL, 0, VmmPycSearch_start_ThreadProc, self, 0, NULL);
if(hThread) {
CloseHandle(hThread);
} else {
self->fCompleted = TRUE;
}
hThread = CreateThread(NULL, 0, VmmPycSearch_start_ThreadProc, self, 0, NULL);
if(hThread) {
CloseHandle(hThread);
} else {
self->fCompleted = TRUE;
}
Py_END_ALLOW_THREADS;
return Py_BuildValue("s", NULL); // None returned on success.
+2 -2
View File
@@ -97,7 +97,7 @@ VmmPycVfs_list(PyObj_Vfs *self, PyObject *args)
}
if(!result) {
Py_DECREF(pyDict);
PyErr_Format(PyExc_RuntimeError, "Vfs.list(): Failed.");
return PyErr_Format(PyExc_RuntimeError, "Vfs.list(): Failed.");
}
return pyDict;
}
@@ -141,7 +141,7 @@ VmmPycVfs_write(PyObj_Vfs *self, PyObject *args)
BOOL result;
SIZE_T cb;
DWORD cbWritten;
ULONG64 cbOffset;
ULONG64 cbOffset = 0;
PBYTE pb;
LPSTR uszPathPython = NULL, uszPath;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "Vfs.write(): Not initialized."); }
+8 -10
View File
@@ -32,7 +32,7 @@ BOOL VmmPycYara_SearchResultCB(_In_ PVOID pvContext, _In_ PVMMYARA_RULE_MATCH pR
for(i = 0; i < pRuleMatch->cMeta; i++) {
PyDict_SetItemString_DECREF(pyDictMeta, pRuleMatch->Meta[i].szIdentifier, PyUnicode_FromString(pRuleMatch->Meta[i].szString));
}
PyDict_SetItemString_DECREF(pyDictResult, "meta", pyListTags);
PyDict_SetItemString_DECREF(pyDictResult, "meta", pyDictMeta);
}
if((pyDictMatch = PyDict_New())) {
for(i = 0; i < pRuleMatch->cStrings; i++) {
@@ -74,16 +74,14 @@ VmmPycYara_start(PyObj_Yara *self, PyObject *args)
{
HANDLE hThread;
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "VmmYara.start(): Not initialized."); }
if(self->fStarted) { Py_BuildValue("s", NULL); } // None returned on success.
if(self->fStarted) { return Py_BuildValue("s", NULL); } // None returned on success.
self->fStarted = TRUE;
Py_BEGIN_ALLOW_THREADS;
if(!self->fStarted) {
self->fStarted = TRUE;
hThread = CreateThread(NULL, 0, VmmPycYara_start_ThreadProc, self, 0, NULL);
if(hThread) {
CloseHandle(hThread);
} else {
self->fCompleted = TRUE;
}
hThread = CreateThread(NULL, 0, VmmPycYara_start_ThreadProc, self, 0, NULL);
if(hThread) {
CloseHandle(hThread);
} else {
self->fCompleted = TRUE;
}
Py_END_ALLOW_THREADS;
return Py_BuildValue("s", NULL); // None returned on success.
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "leechcore_example"
version = "5.18.10"
version = "5.18.11"
edition = "2021"
publish = false
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "m_example_plugin"
version = "5.18.10"
version = "5.18.11"
edition = "2021"
publish = false
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs"
version = "5.18.10"
version = "5.18.11"
edition = "2021"
description = "MemProcFS - Physical Memory Analysis Framework"
documentation = "https://docs.rs/memprocfs"
File diff suppressed because it is too large Load Diff
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs_example"
version = "5.18.10"
version = "5.18.11"
edition = "2021"
publish = false
+2 -2
View File
@@ -32,5 +32,5 @@ using System.Runtime.Versioning;
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("5.18.10.249")]
[assembly: AssemblyFileVersion("5.18.10.249")]
[assembly: AssemblyVersion("5.18.11.250")]
[assembly: AssemblyFileVersion("5.18.11.250")]
+1 -1
View File
@@ -109,7 +109,7 @@
<None Include="logo.png" Pack="true" Visible="true" PackagePath="" />
</ItemGroup>
<PropertyGroup>
<Version>5.18.10</Version>
<Version>5.18.11</Version>
<RepositoryUrl>https://github.com/ufrisk/MemProcFS</RepositoryUrl>
<RepositoryType>git</RepositoryType>
<PackageLicenseFile>LICENSE</PackageLicenseFile>