ufrisk/MemProcFS
1
0
Fork 0
mirror of https://github.com/ufrisk/MemProcFS.git synced 2026-10-12 02:23:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 5.4

Browse Source
This commit is contained in:
ufrisk
2023-02-26 12:17:52 +01:00
parent 842f73c8df
commit d08e667af3
104 changed files with 7972 additions and 628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3
View File
@@ -17,3 +17,6 @@ info.db
/files/x86/lib
/files/x86/vmm_example.exe
/vmmsharp/obj
/vmmrust/memprocfs/target
/vmmrust/memprocfs_example/target
/vmmrust/m_example_plugin/target
MemProcFS.sln
+39
View File
@@ -103,6 +103,39 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
README.md = README.md
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "vmmrust", "vmmrust", "{CA129E44-E6CB-4730-8CE0-B45894B01177}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "m_example_plugin", "m_example_plugin", "{0CA8FB8A-9763-4130-ADBD-C67EFF4897C7}"
ProjectSection(SolutionItems) = preProject
vmmrust\m_example_plugin\Cargo.toml = vmmrust\m_example_plugin\Cargo.toml
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "memprocfs", "memprocfs", "{626E4023-93CC-4D9B-A557-905FF349777F}"
ProjectSection(SolutionItems) = preProject
vmmrust\memprocfs\Cargo.toml = vmmrust\memprocfs\Cargo.toml
vmmrust\memprocfs\README.md = vmmrust\memprocfs\README.md
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "memprocfs_example", "memprocfs_example", "{30C76595-D55E-452F-A9C6-EFC23ADC36DF}"
ProjectSection(SolutionItems) = preProject
vmmrust\memprocfs_example\Cargo.toml = vmmrust\memprocfs_example\Cargo.toml
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{F634AD49-3F87-4AF4-AA2B-6F0F3560C210}"
ProjectSection(SolutionItems) = preProject
vmmrust\memprocfs_example\src\main.rs = vmmrust\memprocfs_example\src\main.rs
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{F36BD36B-329E-4A24-8522-FB31442439E6}"
ProjectSection(SolutionItems) = preProject
vmmrust\memprocfs\src\lib_memprocfs.rs = vmmrust\memprocfs\src\lib_memprocfs.rs
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{FDE47FDC-7D70-41DB-A2E9-3CC2D0B16FF0}"
ProjectSection(SolutionItems) = preProject
vmmrust\m_example_plugin\src\lib.rs = vmmrust\m_example_plugin\src\lib.rs
EndProjectSection
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|ARM64 = Debug|ARM64
@@ -197,6 +230,12 @@ Global
{F64725D0-147F-43D1-95AE-FDE1E8C1EDCD} = {1390A2F3-1ECE-4A66-8B60-6FDCB599BE63}
{D65E9BD1-4BB8-4418-BC41-82884843D377} = {F64725D0-147F-43D1-95AE-FDE1E8C1EDCD}
{A8744524-49F8-4CAA-BD85-7C1EACA1164F} = {F64725D0-147F-43D1-95AE-FDE1E8C1EDCD}
{0CA8FB8A-9763-4130-ADBD-C67EFF4897C7} = {CA129E44-E6CB-4730-8CE0-B45894B01177}
{626E4023-93CC-4D9B-A557-905FF349777F} = {CA129E44-E6CB-4730-8CE0-B45894B01177}
{30C76595-D55E-452F-A9C6-EFC23ADC36DF} = {CA129E44-E6CB-4730-8CE0-B45894B01177}
{F634AD49-3F87-4AF4-AA2B-6F0F3560C210} = {30C76595-D55E-452F-A9C6-EFC23ADC36DF}
{F36BD36B-329E-4A24-8522-FB31442439E6} = {626E4023-93CC-4D9B-A557-905FF349777F}
{FDE47FDC-7D70-41DB-A2E9-3CC2D0B16FF0} = {0CA8FB8A-9763-4130-ADBD-C67EFF4897C7}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {CE6C3AA7-477A-4329-B4E3-5F219ACF4063}
includes/lib32/leechcore.lib
BIN
View File
Binary file not shown.
includes/lib32/vmm.lib
BIN
View File
Binary file not shown.
includes/lib64/leechcore.lib
BIN
View File
Binary file not shown.
includes/lib64/vmm.lib
BIN
View File
Binary file not shown.
includes/libarm64/leechcore.lib
BIN
View File
Binary file not shown.
includes/libarm64/vmm.lib
BIN
View File
Binary file not shown.
includes/vmmdll.h
+31 -11
View File
@@ -7,17 +7,11 @@
// Windows may access both UTF-8 *U and Wide-Char *W versions of functions
// while Linux may only access UTF-8 versions. Some functionality may also
// be degraded or unavailable on Linux.
//
// v5 API
// ======
// v5 of the API support multiple concurrent parallel analysis tasks.
// To accomodate this significant changes have been done to the API which is
// largely incompatible (but very similar) to the earlier API versions.
//
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
// Header Version: 5.3
// Header Version: 5.4
//
#include "leechcore.h"
@@ -485,7 +479,7 @@ BOOL VMMDLL_InitializePlugins(_In_ VMM_HANDLE hVMM);
#define VMMDLL_PLUGIN_CONTEXT_MAGIC 0xc0ffee663df9301c
#define VMMDLL_PLUGIN_CONTEXT_VERSION 5
#define VMMDLL_PLUGIN_REGINFO_MAGIC 0xc0ffee663df9301d
#define VMMDLL_PLUGIN_REGINFO_VERSION 15
#define VMMDLL_PLUGIN_REGINFO_VERSION 16
#define VMMDLL_PLUGIN_FORENSIC_JSONDATA_VERSION 0xc0ee0002
#define VMMDLL_PLUGIN_NOTIFY_VERBOSITYCHANGE 0x01
@@ -503,6 +497,8 @@ typedef struct tdVMMDLL_CSV_HANDLE *VMMDLL_CSV_HANDLE;
#define VMMDLL_MID_MAIN ((VMMDLL_MODULE_ID)0x80000001)
#define VMMDLL_MID_PYTHON ((VMMDLL_MODULE_ID)0x80000002)
#define VMMDLL_MID_DEBUG ((VMMDLL_MODULE_ID)0x80000003)
#define VMMDLL_MID_RUST ((VMMDLL_MODULE_ID)0x80000004)
typedef struct tdVMMDLL_PLUGIN_CONTEXT {
ULONG64 magic;
@@ -554,7 +550,8 @@ typedef struct tdVMMDLL_PLUGIN_REGINFO {
VMMDLL_SYSTEM_TP tpSystem;
HMODULE hDLL;
BOOL(*pfnPluginManager_Register)(_In_ VMM_HANDLE H, struct tdVMMDLL_PLUGIN_REGINFO *pPluginRegInfo);
DWORD _Reserved[32];
LPSTR uszPathVmmDLL;
DWORD _Reserved[30];
// python plugin information - not for general use
struct {
BOOL fPythonStandalone;
@@ -901,7 +898,7 @@ BOOL VMMDLL_Scatter_PrepareEx(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_
* -- return
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb);
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_reads_(cb) PBYTE pb, _In_ DWORD cb);
/*
* Retrieve and Write memory previously populated.
@@ -1001,6 +998,7 @@ typedef enum tdVMMDLL_PTE_TP {
VMMDLL_PTE_TP_DEMANDZERO = 4,
VMMDLL_PTE_TP_COMPRESSED = 5,
VMMDLL_PTE_TP_PAGEFILE = 6,
VMMDLL_PTE_TP_FILE = 7,
} VMMDLL_PTE_TP, *PVMMDLL_PTE_TP;
typedef struct tdVMMDLL_MAP_PTEENTRY {
@@ -1831,6 +1829,9 @@ BOOL VMMDLL_MemSearch(
#define VMMDLL_MAP_PFN_VERSION 1
#define VMMDLL_PFN_FLAG_NORMAL 0
#define VMMDLL_PFN_FLAG_EXTENDED 1
static LPCSTR VMMDLL_PFN_TYPE_TEXT[] = { "Zero", "Free", "Standby", "Modifiy", "ModNoWr", "Bad", "Active", "Transit" };
static LPCSTR VMMDLL_PFN_TYPEEXTENDED_TEXT[] = { "-", "Unused", "ProcPriv", "PageTable", "LargePage", "DriverLock", "Shareable", "File" };
@@ -1919,12 +1920,31 @@ typedef struct tdVMMDLL_MAP_PFN {
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Map_GetPfn(
_In_ VMM_HANDLE hVMM,
_In_ DWORD pPfns[],
_In_reads_(cPfns) DWORD pPfns[],
_In_ DWORD cPfns,
_Out_writes_bytes_opt_(*pcbPfnMap) PVMMDLL_MAP_PFN pPfnMap,
_Inout_ PDWORD pcbPfnMap
);
/*
* Retrieve PFN information:
* CALLER FREE: VMMDLL_MemFree(*ppPfnMap)
* -- hVMM
* -- pPfns = PFNs to retrieve.
* -- cPfns = number of PFNs to retrieve.
* -- ppPfnMap = ptr to receive result on success. must be free'd with VMMDLL_MemFree().
* -- flags = optional flags as specified by VMMDLL_PFN_FLAG_*
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Map_GetPfnEx(
_In_ VMM_HANDLE hVMM,
_In_reads_(cPfns) DWORD pPfns[],
_In_ DWORD cPfns,
_Out_ PVMMDLL_MAP_PFN *ppPfnMap,
_In_ DWORD flags
);
//-----------------------------------------------------------------------------
m_vmemd/version.h
+3 -3
View File
@@ -2,9 +2,9 @@
#define STRINGIZE(s) STRINGIZE2(s)
#define VERSION_MAJOR 5
#define VERSION_MINOR 3
#define VERSION_REVISION 1
#define VERSION_BUILD 100
#define VERSION_MINOR 4
#define VERSION_REVISION 0
#define VERSION_BUILD 102
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
memprocfs/version.h
+3 -3
View File
@@ -2,9 +2,9 @@
#define STRINGIZE(s) STRINGIZE2(s)
#define VERSION_MAJOR 5
#define VERSION_MINOR 3
#define VERSION_REVISION 1
#define VERSION_BUILD 100
#define VERSION_MINOR 4
#define VERSION_REVISION 0
#define VERSION_BUILD 102
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/Makefile
+33 -16
View File
@@ -8,34 +8,51 @@
CC=gcc
CFLAGS += -std=c11 -I. -I../includes -D LINUX -D _GNU_SOURCE -D SQLITE_THREADSAFE=2 -D SQLITE_CORE -shared -fPIC -l:leechcore.so -fvisibility=hidden -L. -lm -pthread `pkg-config liblz4 openssl --libs --cflags`
# DEBUG FLAGS BELOW
# export ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_invalid_pointer_pairs=2
# CFLAGS += -g -O0 -Wextra -Wno-unused-parameter -Wno-cast-function-type
# CFLAGS += -fsanitize=address -fsanitize=leak -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=bounds-strict -fsanitize=float-divide-by-zero -fsanitize=float-cast-overflow
# CFLAGS += -fsanitize=pointer-compare -fsanitize=pointer-subtract -fanalyzer
#export ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_invalid_pointer_pairs=2
#CFLAGS += -g -O0 -Wextra -Wno-unused-parameter -Wno-cast-function-type
#CFLAGS += -fsanitize=address -fsanitize=leak -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=bounds-strict -fsanitize=float-divide-by-zero -fsanitize=float-cast-overflow
#CFLAGS += -fsanitize=pointer-compare -fsanitize=pointer-subtract -fanalyzer
# DEBUG FLAGS ABOVE
CFLAGS += -fPIE -fPIC -pie -fstack-protector -D_FORTIFY_SOURCE=2 -O1 -Wl,-z,noexecstack
CFLAGS += -Wall -Wno-format-truncation -Wno-enum-compare -Wno-pointer-sign -Wno-multichar -Wno-unused-variable -Wno-unused-value
CFLAGS += -Wno-pointer-to-int-cast -Wno-int-to-pointer-cast
LDFLAGS += -Wl,-rpath,'$$ORIGIN' -g -ldl -shared
DEPS = vmmdll.h
OBJ = oscompatibility.o charutil.o util.o pe.o vmmdll.o vmmdll_core.o vmmdll_scatter.o \
vmm.o mm_x64.o mm_x86.o mm_x86pae.o mm_pfn.o mm_vad.o mm_win.o fc.o \
OBJ = oscompatibility.o charutil.o util.o pe.o vmmdll.o vmmdll_core.o \
vmmdll_scatter.o vmm.o fc.o \
mm/mm_x64.o mm/mm_x86.o mm/mm_x86pae.o mm/mm_pfn.o mm/mm_vad.o \
mm/mm_win.o \
pluginmanager.o pdb.o infodb.o sqlite/sqlite3.o \
ob/ob_cachemap.o ob/ob_compressed.o ob/ob_container.o ob/ob_core.o \
ob/ob_counter.o ob/ob_map.o ob/ob_memfile.o ob/ob_set.o ob/ob_strmap.o \
statistics.o sysquery.o vmmevil.o vmmheap.o vmmlog.o vmmnet.o \
vmmproc.o vmmvm.o vmmwininit.o vmmwin.o vmmwinobj.o vmmwinpool.o \
vmmwinreg.o vmmwinsvc.o vmmwork.o \
m_vfsfc.o m_vfsproc.o m_vfsroot.o m_conf.o m_winreg.o \
m_fc_csv.o m_fc_handle.o m_fc_json.o m_fc_module.o m_fc_ntfs.o \
m_fc_proc.o m_fc_registry.o m_fc_sys.o m_fc_thread.o m_fc_timeline.o \
m_file_handles_vads.o m_file_modules.o m_findevil.o \
m_misc_bitlocker.o m_misc_procinfo.o m_misc_web.o m_misc_view.o \
m_phys2virt.o m_proc_handle.o m_proc_heap.o m_proc_ldrmodules.o \
m_proc_memmap.o m_proc_minidump.o m_proc_thread.o m_proc_token.o \
m_search.o m_sys.o m_sys_driver.o m_sys_mem.o m_sys_net.o m_sys_obj.o \
m_sys_pool.c m_sys_proc.o m_sys_svc.o m_sys_task.o m_sys_user.o \
m_virt2phys.o m_vm.o
modules/m_vfsroot.o modules/m_vfsproc.o modules/m_vfsfc.o \
modules/m_conf.o modules/m_vm.o modules/m_winreg.o \
modules/m_fc_csv.o modules/m_fc_handle.o modules/m_fc_json.o \
modules/m_fc_module.o modules/m_fc_ntfs.o modules/m_fc_proc.o \
modules/m_fc_registry.o modules/m_fc_sys.o modules/m_fc_thread.o \
modules/m_fc_timeline.o \
modules/m_misc_bitlocker.o modules/m_misc_procinfo.o \
modules/m_misc_view.o modules/m_misc_web.o \
modules/m_sys.o modules/m_sys_driver.o modules/m_sys_mem.o \
modules/m_sys_net.o modules/m_sys_obj.o modules/m_sys_pool.c \
modules/m_sys_proc.o modules/m_sys_svc.o modules/m_sys_syscall.o \
modules/m_sys_task.o modules/m_sys_user.o \
modules/m_findevil.o modules/m_phys2virt.o modules/m_search.o \
modules/m_virt2phys.o \
modules/m_proc_file_handles_vads.o modules/m_proc_file_modules.o \
modules/m_proc_handle.o modules/m_proc_heap.o \
modules/m_proc_ldrmodules.o modules/m_proc_memmap.o \
modules/m_proc_minidump.o modules/m_proc_thread.o \
modules/m_proc_token.o
%.o: %.c $(DEPS)
$(CC) -c -o $@ $< $(CFLAGS)
vmm/fc.c
+1 -1
View File
@@ -1039,7 +1039,7 @@ VOID FcInitialize_ThreadProc(_In_ VMM_HANDLE H, _In_ QWORD qwNotUsed)
H->fc->db.fSingleThread = FALSE;
H->fc->fInitFinish = TRUE;
if(H->fAbort) { goto fail; }
PluginManager_Notify(H, VMMDLL_PLUGIN_NOTIFY_FORENSIC_INIT, NULL, 100);
PluginManager_Notify(H, VMMDLL_PLUGIN_NOTIFY_FORENSIC_INIT, NULL, 0);
PluginManager_Notify(H, VMMDLL_PLUGIN_NOTIFY_FORENSIC_INIT_COMPLETE, NULL, 0);
Statistics_CallEnd(H, STATISTICS_ID_FORENSIC_FcInitialize, tmStart);
fResult = TRUE;
vmm/fc.h
+1 -1
View File
@@ -16,7 +16,7 @@
#define __FC_H__
#include "oscompatibility.h"
#include "vmm.h"
#include "mm_pfn.h"
#include "mm/mm_pfn.h"
#include "sqlite/sqlite3.h"
#define FC_SQL_POOL_CONNECTION_NUM 4
vmm/mm.h → vmm/mm/mm.h
+1 -1
View File
@@ -5,7 +5,7 @@
//
#ifndef __MM_H__
#define __MM_H__
#include "vmm.h"
#include "../vmm.h"
/*
* Initialize the X86 32-bit protected mode memory model.
vmm/mm_pfn.c → vmm/mm/mm_pfn.c
+3 -3
View File
@@ -4,10 +4,10 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "mm.h"
#include "mm_pfn.h"
#include "pdb.h"
#include "util.h"
#include "../pdb.h"
typedef struct tdMMPFN_CONTEXT {
BOOL fValid;
vmm/mm_pfn.h → vmm/mm/mm_pfn.h
+1 -1
View File
@@ -6,7 +6,7 @@
//
#ifndef __MM_PFN_H__
#define __MM_PFN_H__
#include "vmm.h"
#include "../vmm.h"
static LPCSTR MMPFN_TYPE_TEXT[] = { "Zero", "Free", "Standby", "Modifiy", "ModNoWr", "Bad", "Active", "Transit" };
static LPCSTR MMPFN_TYPEEXTENDED_TEXT[] = { "-", "Unused", "ProcPriv", "PageTable", "LargePage", "DriverLock", "Shareable", "File" };
vmm/mm_vad.c → vmm/mm/mm_vad.c
+2 -3
View File
@@ -3,10 +3,9 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "mm.h"
#include "vmmwindef.h"
#include "util.h"
#include "../util.h"
#define MMVAD_POOLTAG_VAD 'Vad '
#define MMVAD_POOLTAG_VADF 'VadF'
vmm/mm_win.c → vmm/mm/mm_win.c
+4 -5
View File
@@ -3,12 +3,10 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "mm.h"
#include "pdb.h"
#include "pe.h"
#include "statistics.h"
#include "util.h"
#include "../pdb.h"
#include "../statistics.h"
#define MM_LOOP_PROTECT_ADD(flags) ((flags & ~0x00ff0000) | ((((flags >> 16) & 0xff) + 1) << 16))
#define MM_LOOP_PROTECT_MAX(flags) (((flags >> 16) & 0xff) > 4)
@@ -1458,6 +1456,7 @@ BOOL MmWinX64_ReadPaged(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_opt_
// MmCa - control area: _CONTROL_AREA
// MmCi - image control area.
if(MMWINX64_PTE_IS_FILE_BACKED(H, pte)) {
if(ptp && !*ptp) { *ptp = VMM_PTE_TP_FILE; }
InterlockedIncrement64(&H->vmm.stat.page.cFailFileMapped);
return FALSE;
}
vmm/mm_x64.c → vmm/mm/mm_x64.c
+2 -2
View File
@@ -3,8 +3,8 @@
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmproc.h"
#include "mm.h"
#define MMX64_MEMMAP_DISPLAYBUFFER_LINE_LENGTH 89
#define MMX64_PTE_IS_TRANSITION(H, pte, iPML) ((((pte & 0x0c01) == 0x0800) && (iPML == 1) && (H->vmm.tpSystem == VMM_SYSTEM_WINDOWS_X64)) ? ((pte & 0xffffdffffffff000) | 0x005) : 0)
vmm/mm_x86.c → vmm/mm/mm_x86.c
+2 -2
View File
@@ -3,8 +3,8 @@
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmproc.h"
#include "mm.h"
#define MMX86_MEMMAP_DISPLAYBUFFER_LINE_LENGTH 70
#define MMX86_PTE_IS_TRANSITION(H, pte, iPML) ((((pte & 0x0c01) == 0x0800) && (iPML == 1) && (H->vmm.tpSystem == VMM_SYSTEM_WINDOWS_X86)) ? ((pte & 0xfffff000) | 0x005) : 0)
vmm/mm_x86pae.c → vmm/mm/mm_x86pae.c
+2 -2
View File
@@ -3,8 +3,8 @@
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmproc.h"
#include "mm.h"
#define MMX86PAE_MEMMAP_DISPLAYBUFFER_LINE_LENGTH 70
#define MMX86PAE_PTE_IS_TRANSITION(H, pte, iPML) ((((pte & 0x0c01) == 0x0800) && (iPML == 1) && (H->vmm.tpSystem == VMM_SYSTEM_WINDOWS_X86)) ? ((pte & 0xffffdffffffff000) | 0x005) : 0)
vmm/m_conf.c → vmm/modules/m_conf.c
+2 -17
View File
@@ -4,23 +4,8 @@
// Author: Ulf Frisk, [email protected]
//
/*
* The m_conf module registers itself with the name 'conf' with the plugin manager.
*
* The module showcase a "root" directory module as well as a stateless module.
*
* The module implements listing of directories as well as read and write.
* Read/Write happens, if allowed, to various configuration and status settings
* related to the VMM and Memory Process File System.
*/
#include "pdb.h"
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "vmmproc.h"
#include "vmmwinreg.h"
#include "statistics.h"
#include "modules.h"
#include "../vmmwinreg.h"
/*
* Read : function as specified by the module manager. The module manager will
vmm/m_fc_csv.c → vmm/modules/m_fc_csv.c
+1 -5
View File
@@ -6,11 +6,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
#define MFCCSV_TIMELINE_LINEHEADER "Time,Type,Action,PID,Value32,Value64,Text\n"
vmm/m_fc_handle.c → vmm/modules/m_fc_handle.c
+2 -5
View File
@@ -8,11 +8,8 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "vmmwin.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
#include "../vmmwin.h"
static LPSTR MFCHANDLE_CSV_HANDLE = "PID,Handle,Object,Access,Type,Tag,HandleCount,Device,Description\n";
vmm/m_fc_json.c → vmm/modules/m_fc_json.c
+2 -7
View File
@@ -6,13 +6,8 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "version.h"
#include "resource.h"
#include "modules.h"
#include "../version.h"
/*
* Read the json version of the timeline info files.
vmm/m_fc_module.c → vmm/modules/m_fc_module.c
+1 -6
View File
@@ -8,12 +8,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pe.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
static LPSTR MFCMODULE_CSV_MODULES = "PID,Process,Name,Wow64,Size,Start,End,#Imports,#Exports,#Sections,Path,KernelPath,PdbPath,PdbAge,PdbHexGUID,VerCompanyName,VerFileDescription,VerFileVersion,VerInternalName,VerLegalCopyright,VerOriginalFilename,VerProductName,VerProductVersion\n";
static LPSTR MFCMODULE_CSV_UNLOADEDMODULES = "PID,Process,ModuleName,UnloadTime,Wow64,Size,Start,End\n";
vmm/m_fc_ntfs.c → vmm/modules/m_fc_ntfs.c
+1 -5
View File
@@ -9,11 +9,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
#define M_NTFS_INFO_LINELENGTH_UTF8 98
#define M_NTFS_INFO_LINELENGTH_JSON 98
vmm/m_fc_proc.c → vmm/modules/m_fc_proc.c
+2 -5
View File
@@ -8,11 +8,8 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "vmmwin.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
#include "../vmmwin.h"
static LPSTR MFCPROC_CSV_PROCESS = "PID,PPID,State,ShortName,Name,IntegrityLevel,User,CreateTime,ExitTime,Wow64,EPROCESS,PEB,PEB32,DTB,UserDTB,UserPath,KernelPath,CommandLine\n";
vmm/m_fc_registry.c → vmm/modules/m_fc_registry.c
+3 -7
View File
@@ -8,13 +8,9 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "vmmwinreg.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "version.h"
#include "modules.h"
#include "../version.h"
#include "../vmmwinreg.h"
static LPSTR FC_SQL_SCHEMA_REGISTRY =
"DROP VIEW IF EXISTS v_registry; " \
vmm/m_fc_sys.c → vmm/modules/m_fc_sys.c
+1 -5
View File
@@ -8,11 +8,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "vmmwin.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
PVOID MFcSys_FcInitialize(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP)
{
vmm/m_fc_thread.c → vmm/modules/m_fc_thread.c
+1 -5
View File
@@ -8,11 +8,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pluginmanager.h"
#include "util.h"
#include "vmmwindef.h"
#include "modules.h"
static LPSTR MFCPROC_CSV_THREAD = "PID,TID,ETHREAD,State,WaitReason,CreateTime,ExitTime,Running,BasePriority,Priority,ExitStatus,StartAddress,IP,SP,TEB,StackBaseUser,StackLimitUser,StackBaseKernel,StackLimitKernel,TrapFrame\n";
vmm/m_fc_timeline.c → vmm/modules/m_fc_timeline.c
+1 -5
View File
@@ -6,11 +6,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
/*
* Read the text version of the timeline info files.
vmm/m_findevil.c → vmm/modules/m_findevil.c
+4 -6
View File
@@ -3,12 +3,10 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "mm.h"
#include "vmm.h"
#include "vmmevil.h"
#include "modules.h"
#include "../mm/mm.h"
#include "../vmmevil.h"
#define MFINDEVIL_LINELENGTH_X64 214ULL
#define MFINDEVIL_LINEHEADER " # PID Process Type Address Description"
vmm/m_misc_bitlocker.c → vmm/modules/m_misc_bitlocker.c
+2 -2
View File
@@ -3,8 +3,8 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "charutil.h"
#include "modules.h"
LPSTR szMBDE_README =
"Bitlocker plugin for MemProcFS: \n" \
vmm/m_misc_procinfo.c → vmm/modules/m_misc_procinfo.c
+1 -4
View File
@@ -4,10 +4,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "statistics.h"
#include "util.h"
#include "mm_pfn.h"
#include "modules.h"
typedef struct tdOB_MMISCINFO_CONTEXT {
OB ObHdr;
vmm/m_misc_view.c → vmm/modules/m_misc_view.c
+1 -3
View File
@@ -4,9 +4,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "pluginmanager.h"
#include "charutil.h"
#include "modules.h"
// forward declarations of VFS implemented functionality in core VMMDLL.
BOOL VMMDLL_VfsList_Impl(_In_ VMM_HANDLE H, _In_ LPSTR uszPath, _Inout_ PHANDLE pFileList);
vmm/m_misc_web.c → vmm/modules/m_misc_web.c
+3 -7
View File
@@ -4,13 +4,9 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "vmm.h"
#include "vmmwinobj.h"
#include "pluginmanager.h"
#include "util.h"
#include "charutil.h"
#include "sqlite/sqlite3.h"
#include "modules.h"
#include "../sqlite/sqlite3.h"
#include "../vmmwinobj.h"
LPSTR szMWEB_README =
"Web plugin for MemProcFS: \n" \
vmm/m_phys2virt.c → vmm/modules/m_phys2virt.c
+2 -3
View File
@@ -3,9 +3,8 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "modules.h"
LPCSTR szMPHYS2VIRT_README =
"Information about the phys2virt module \n" \
vmm/m_file_handles_vads.c → vmm/modules/m_proc_file_handles_vads.c
+4 -7
View File
@@ -3,12 +3,9 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "vmmwin.h"
#include "vmmwinobj.h"
#include "modules.h"
#include "../vmmwinobj.h"
_Success_(return == 0)
NTSTATUS M_FileHandlesVads_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctx, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ QWORD cbOffset, _In_ BOOL fHandles)
@@ -72,7 +69,7 @@ BOOL M_FileVads_List(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Inout
return M_FileHandlesVads_List(H, ctxP, pFileList, FALSE);
}
VOID M_FileHandlesVads_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pRI)
VOID M_ProcFileHandlesVads_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pRI)
{
if((pRI->magic != VMMDLL_PLUGIN_REGINFO_MAGIC) || (pRI->wVersion != VMMDLL_PLUGIN_REGINFO_VERSION)) { return; }
if(!((pRI->tpSystem == VMM_SYSTEM_WINDOWS_X64) || (pRI->tpSystem == VMM_SYSTEM_WINDOWS_X86))) { return; }
vmm/m_file_modules.c → vmm/modules/m_proc_file_modules.c
+3 -5
View File
@@ -3,10 +3,8 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "vmm.h"
#include "pe.h"
#include "util.h"
#include "modules.h"
typedef struct tdFILEMODULES_FILENTRY {
DWORD cb;
@@ -161,7 +159,7 @@ NTSTATUS M_FileModules_Write(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP
* -- H
* -- pRI
*/
VOID M_FileModules_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pRI)
VOID M_ProcFileModules_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pRI)
{
if((pRI->magic != VMMDLL_PLUGIN_REGINFO_MAGIC) || (pRI->wVersion != VMMDLL_PLUGIN_REGINFO_VERSION)) { return; }
if((pRI->tpSystem != VMM_SYSTEM_WINDOWS_X64) && (pRI->tpSystem != VMM_SYSTEM_WINDOWS_X86)) { return; }
vmm/m_proc_handle.c → vmm/modules/m_proc_handle.c
+4 -6
View File
@@ -3,12 +3,10 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "vmmwin.h"
#include "vmmwinobj.h"
#include "modules.h"
#include "../vmmwin.h"
#include "../vmmwinobj.h"
#define MHANDLE_LINELENGTH 222ULL
#define MHANDLE_LINEHEADER " # PID Handle Object Address Access Type Description"
vmm/m_proc_heap.c → vmm/modules/m_proc_heap.c
+2 -5
View File
@@ -3,11 +3,8 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "modules.h"
LPCSTR szMHEAP_README =
"Information about the heap process module \n" \
vmm/m_proc_ldrmodules.c → vmm/modules/m_proc_ldrmodules.c
+2 -6
View File
@@ -3,12 +3,8 @@
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "vmm.h"
#include "vmmwin.h"
#include "charutil.h"
#include "util.h"
#include "pe.h"
#include "modules.h"
#define LDRMODULES_CACHE_TP_EAT 1
#define LDRMODULES_CACHE_TP_IAT 2
vmm/m_proc_memmap.c → vmm/modules/m_proc_memmap.c
+3 -6
View File
@@ -3,12 +3,9 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "mm.h"
#include "vmm.h"
#include "vmmdll.h"
#include "modules.h"
#include "../mm/mm.h"
#define MEMMAP_PTE_LINELENGTH_X86 112ULL
#define MEMMAP_PTE_LINELENGTH_X64 128ULL
vmm/m_proc_minidump.c → vmm/modules/m_proc_minidump.c
+5 -10
View File
@@ -3,16 +3,11 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "pe.h"
#include "charutil.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "vmmwin.h"
#include "vmmwindef.h"
#include "vmmwinreg.h"
#include "version.h"
#include "modules.h"
#include "../version.h"
#include "../vmmwinobj.h"
#include "../vmmwinreg.h"
#ifdef _WIN32
vmm/m_proc_thread.c → vmm/modules/m_proc_thread.c
+2 -6
View File
@@ -3,12 +3,8 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "charutil.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "vmmwindef.h"
#include "modules.h"
#define MTHREAD_INFOFILE_LENGTH 803ULL
#define MTHREAD_LINELENGTH 250ULL
vmm/m_proc_token.c → vmm/modules/m_proc_token.c
+4 -8
View File
@@ -3,14 +3,10 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "vmmdll.h"
#include "vmmwin.h"
#include "vmmwindef.h"
#include "charutil.h"
#include "infodb.h"
#include "modules.h"
#include "../infodb.h"
#include "../vmmwin.h"
#ifdef _WIN32
#include <sddl.h>
#endif /* _WIN32 */
vmm/m_search.c → vmm/modules/m_search.c
+2 -3
View File
@@ -3,9 +3,8 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "util.h"
#include "pluginmanager.h"
#include "modules.h"
LPCSTR szSEARCH_README =
"Information about the search module \n" \
vmm/m_sys.c → vmm/modules/m_sys.c
+4 -6
View File
@@ -6,12 +6,10 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmwin.h"
#include "vmmwinreg.h"
#include "sysquery.h"
#include "util.h"
#include "charutil.h"
#include "modules.h"
#include "../sysquery.h"
#include "../vmmwinreg.h"
VOID MSys_QueryTimeZone(_In_ VMM_HANDLE H, _Out_writes_(49) LPSTR uszTimeZone, _In_ BOOL fLine)
{
vmm/m_sys_cert.c → vmm/modules/m_sys_cert.c
+4 -6
View File
@@ -6,12 +6,10 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "charutil.h"
#include "util.h"
#include "infodb.h"
#include "vmmwin.h"
#include "vmmwinreg.h"
#include "modules.h"
#include "../infodb.h"
#include "../vmmwinreg.h"
#define MSYSCERT_LINE_LENGTH 228ULL
vmm/m_sys_driver.c → vmm/modules/m_sys_driver.c
+3 -7
View File
@@ -6,13 +6,9 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "fc.h"
#include "charutil.h"
#include "util.h"
#include "pluginmanager.h"
#include "vmmwinobj.h"
#include "vmmwindef.h"
#include "modules.h"
#include "../vmmwinobj.h"
static LPSTR MSYSDRIVER_CSV_DRIVERS = "Name,ObjectAddress,Size,Start,End,ServiceKey,DriverName,DriverPath\n";
static LPSTR MSYSDRIVER_CSV_DEVICES = "Name,ObjectAddress,Depth,AttachedDeviceAddress,DriverName,DriverPath,DriverObjectAddress,ExtraInfo\n";
vmm/m_sys_mem.c → vmm/modules/m_sys_mem.c
+2 -3
View File
@@ -6,9 +6,8 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "mm_pfn.h"
#include "util.h"
#include "modules.h"
#define MSYSMEM_PFNMAP_LINELENGTH 56ULL
#define MSYSMEM_PHYSMEMMAP_LINELENGTH 33ULL
vmm/m_sys_net.c → vmm/modules/m_sys_net.c
+2 -3
View File
@@ -8,9 +8,8 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "util.h"
#include "fc.h"
#include "modules.h"
LPCSTR szMSYSNET_README =
"Information about the sys net module \n" \
vmm/m_sys_obj.c → vmm/modules/m_sys_obj.c
+3 -6
View File
@@ -6,12 +6,9 @@
// (c) Ulf Frisk, 2021-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "fc.h"
#include "charutil.h"
#include "util.h"
#include "pluginmanager.h"
#include "vmmwinobj.h"
#include "modules.h"
#include "../vmmwinobj.h"
#define MSYSOBJ_LINELENGTH 200ULL
#define MSYSOBJ_LINEHEADER " # Object Address Type Description"
vmm/m_sys_pool.c → vmm/modules/m_sys_pool.c
+2 -3
View File
@@ -6,9 +6,8 @@
// (c) Ulf Frisk, 2021-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "util.h"
#include "charutil.h"
#include "modules.h"
LPCSTR szMSYSPOOL_README =
"Information about the pool module \n" \
vmm/m_sys_proc.c → vmm/modules/m_sys_proc.c
+3 -4
View File
@@ -7,10 +7,9 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmwin.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
#include "../vmmwin.h"
// ----------------------------------------------------------------------------
// ProcTree functionality below:
vmm/m_sys_svc.c → vmm/modules/m_sys_svc.c
+2 -4
View File
@@ -6,10 +6,8 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "util.h"
#include "fc.h"
#include "pluginmanager.h"
#include "modules.h"
static LPSTR MSYSSVC_CSV_SERVICES = "PID,Ordinal,ServiceName,DisplayName,User,StartType,State,Type1,Type2,ObjectAddress,ImagePath,DriverpathOrCmdline\n";
vmm/m_sys_syscall.c → vmm/modules/m_sys_syscall.c
+2 -4
View File
@@ -6,10 +6,8 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "vmm.h"
#include "pdb.h"
#include "util.h"
#include "modules.h"
typedef struct tdKSERVICE_DESCRIPTOR_TABLE32 {
DWORD ServiceTableBase;
vmm/m_sys_task.c → vmm/modules/m_sys_task.c
+3 -6
View File
@@ -9,12 +9,9 @@
// (c) Ulf Frisk, 2021-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmwinreg.h"
#include "charutil.h"
#include "util.h"
#include "fc.h"
#include "pluginmanager.h"
#include "modules.h"
#include "../vmmwinreg.h"
static LPSTR MSYSTASK_CSV_TASKS = "GUID,TaskName,TaskPath,User,TimeMostRecent,CommandLine,Parameters,TimeReg,TimeCreate,TimeLastRun,TimeCompleted\n";
vmm/m_sys_user.c → vmm/modules/m_sys_user.c
+2 -3
View File
@@ -5,9 +5,8 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "charutil.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
#define MSYSUSER_LINELENGTH 120ULL
#define MSYSUSER_LINEHEADER " # Username SID"
vmm/m_vfsfc.c → vmm/modules/m_vfsfc.c
+1 -3
View File
@@ -4,9 +4,7 @@
// Author: Ulf Frisk, [email protected]
//
#include "fc.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
LPCSTR szMFC_README =
"Information about MemProcFS forensics: \n" \
vmm/m_vfsproc.c → vmm/modules/m_vfsproc.c
+3 -4
View File
@@ -3,11 +3,10 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "vmmproc.h"
#include "vmmwin.h"
#include "util.h"
#include "modules.h"
#include "../vmmproc.h"
#include "../vmmwin.h"
/*
* Read process root file.
vmm/m_vfsroot.c → vmm/modules/m_vfsroot.c
+6 -8
View File
@@ -6,14 +6,12 @@
// (c) Ulf Frisk, 2020-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "pe.h"
#include "sysquery.h"
#include "version.h"
#include "vmm.h"
#include "vmmwindef.h"
#include "vmmwininit.h"
#include "vmmwinobj.h" // DEBUG
#include "modules.h"
#include "../sysquery.h"
#include "../version.h"
#include "../vmmwin.h"
#include "../vmmwininit.h"
#define KDBG64_KiProcessorBlock 0x218
#define KDBG64_ContextKPRCB 0x338
vmm/m_virt2phys.c → vmm/modules/m_virt2phys.c
+2 -3
View File
@@ -3,9 +3,8 @@
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#include "pluginmanager.h"
#include "util.h"
#include "vmm.h"
#include "modules.h"
LPCSTR szMVIRT2PHYS_README =
"Information about the virt2phys module \n" \
vmm/m_vm.c → vmm/modules/m_vm.c
+2 -4
View File
@@ -3,10 +3,8 @@
// (c) Ulf Frisk, 2022-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "charutil.h"
#include "pluginmanager.h"
#include "util.h"
#include "modules.h"
#define MVM_LINELENGTH 127ULL
#define MVM_LINEHEADER " # VmMemPID Type Flags ObjectAddress MaxGPA Name OsType OsBuild Mount"
vmm/m_winreg.c → vmm/modules/m_winreg.c
+3 -4
View File
@@ -3,10 +3,9 @@
// (c) Ulf Frisk, 2019-2023
// Author: Ulf Frisk, [email protected]
//
#include "vmm.h"
#include "vmmwinreg.h"
#include "charutil.h"
#include "util.h"
#include "modules.h"
#include "../vmmwinreg.h"
#define KEY_INFO_META_SIZE 59ULL
#define KEY_META_BUFFER_SIZE 0xA000
vmm/modules/modules.h
+21
View File
@@ -0,0 +1,21 @@
// modules.h : common includes used by modules.
//
// (c) Ulf Frisk, 023
// Author: Ulf Frisk, [email protected]
//
#ifndef __MODULES_H__
#define __MODULES_H__
#include "../vmmdll.h"
#include "../vmm.h"
#include "../fc.h"
#include "../charutil.h"
#include "../pdb.h"
#include "../pe.h"
#include "../pluginmanager.h"
#include "../statistics.h"
#include "../util.h"
#include "../vmmwindef.h"
#endif /* __MODULES_H__ */
vmm/m_modules.h → vmm/modules/modules_init.h
+9 -7
View File
@@ -1,11 +1,13 @@
// m_modules.h : definitions related to initialization of built-in modules.
// modules_init.h : definitions related to initialization of built-in modules.
//
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
#ifndef __M_MODULES_H__
#define __M_MODULES_H__
#include "vmmdll.h"
#include "../vmmdll.h"
/*
* Initialization function for the build-in virtual file system root folder module.
@@ -66,8 +68,8 @@ VOID M_FcThread_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPl
/*
* Initialization functions for PROCESS related modules.
*/
VOID M_FileHandlesVads_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_FileModules_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_ProcFileHandlesVads_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_ProcFileModules_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_ProcHandle_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_ProcHeap_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
VOID M_ProcLdrModules_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pPluginRegInfo);
@@ -83,8 +85,8 @@ VOID(*g_pfnModulesAllInternal[])(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_REGINFO
M_VfsProc_Initialize,
M_VfsFc_Initialize,
// per-process modules
M_FileHandlesVads_Initialize,
M_FileModules_Initialize,
M_ProcFileHandlesVads_Initialize,
M_ProcFileModules_Initialize,
M_FindEvil_Initialize,
M_Phys2Virt_Initialize,
M_ProcHandle_Initialize,
@@ -110,6 +112,7 @@ VOID(*g_pfnModulesAllInternal[])(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_REGINFO
M_SysPool_Initialize,
M_SysProc_Initialize,
M_SysSvc_Initialize,
M_SysSyscall_Initialize,
M_SysTask_Initialize,
M_SysUser_Initialize,
M_WinReg_Initialize,
@@ -128,7 +131,6 @@ VOID(*g_pfnModulesAllInternal[])(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_REGINFO
#ifdef _WIN32
// windows-only global modules
M_SysCert_Initialize, // req: winapi
M_SysSyscall_Initialize, // req: full symbols
#endif /* _WIN32 */
};
vmm/ob/ob.h
+1
View File
@@ -16,6 +16,7 @@ typedef unsigned __int64 QWORD, *PQWORD;
// OB_DEBUG is not working (as currently coded) with arm32 due to alignment issues.
#if _WIN32 || _WIN64 || __i386__ || __amd64__ || __aarch64__
#define OB_DEBUG
//#define OB_DEBUG_MEMZERO
#endif /* _WIN32 || _WIN64 || __i386__ || __amd64__ || __aarch64__ */
#define OB_HEADER_MAGIC 0x0c0efefe
typedef struct tdVMM_HANDLE *VMM_HANDLE;
vmm/ob/ob_core.c
+3
View File
@@ -104,6 +104,9 @@ PVOID Ob_XDECREF(_In_opt_ PVOID pObIn)
if(pOb->_pfnRef_0) { pOb->_pfnRef_0(pOb); }
pOb->_magic1 = 0;
pOb->_magic2 = 0;
#ifdef OB_DEBUG_MEMZERO
ZeroMemory(pOb, sizeof(OB) + pOb->cbData);
#endif /* OB_DEBUG_MEMZERO */
LocalFree(pOb);
} else if((c == 1) && pOb->_pfnRef_1) {
pOb->_pfnRef_1(pOb);
vmm/pluginmanager.c
+3 -2
View File
@@ -10,8 +10,8 @@
#include "vmm.h"
#include "vmmdll.h"
#include "vmmlog.h"
#include "m_modules.h"
#include "fc.h"
#include "modules/modules_init.h"
//
// This file contains functionality related to keeping track of plugins, both
@@ -667,7 +667,7 @@ BOOL PluginManager_Register(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_REGINFO pRegI
pModule = (PPLUGIN_ENTRY)LocalAlloc(LMEM_ZEROINIT, sizeof(PLUGIN_ENTRY));
if(!pModule) { return FALSE; }
pModule->hDLL = pRegInfo->hDLL;
pModule->MID = InterlockedIncrement(&H->vmm.PluginManager.dwNextMID);
pModule->MID = InterlockedIncrement(&H->vmm.PluginManager.NextMID);
strncpy_s(pModule->uszName, 32, uszPluginName, _TRUNCATE);
pModule->dwNameHash = CharUtil_HashNameFsU(pModule->uszName, TRUE);
pModule->fRootModule = pRegInfo->reg_info.fRootModule;
@@ -771,6 +771,7 @@ VOID PluginManager_Initialize_RegInfoInit(_In_ VMM_HANDLE H, _Out_ PVMMDLL_PLUGI
pRI->wVersion = VMMDLL_PLUGIN_REGINFO_VERSION;
pRI->wSize = sizeof(VMMDLL_PLUGIN_REGINFO);
pRI->hDLL = hDLL;
pRI->uszPathVmmDLL = H->cfg.szPathLibraryVmm;
pRI->tpMemoryModel = (VMMDLL_MEMORYMODEL_TP)H->vmm.tpMemoryModel;
pRI->tpSystem = (VMMDLL_SYSTEM_TP)H->vmm.tpSystem;
pRI->pfnPluginManager_Register = PluginManager_Register;
vmm/statistics.c
+8 -8
View File
@@ -142,26 +142,26 @@ BOOL Statistics_CallToString(_In_ VMM_HANDLE H, _Out_opt_ LPSTR *psz, _Out_ PDWO
/*
* Start a call statistics logging session.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- pProcess
* -- ps
* -- uszText
*/
VOID VmmStatisticsLogStart(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_opt_ PVMM_PROCESS pProcess, _Out_ PVMMSTATISTICS_LOG ps, _In_ LPSTR uszText)
VOID VmmStatisticsLogStart(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_opt_ PVMM_PROCESS pProcess, _Out_ PVMMSTATISTICS_LOG ps, _In_ LPSTR uszText)
{
ps->f = VmmLogIsActive(H, dwMID, dwLogLevel);
ps->f = VmmLogIsActive(H, MID, dwLogLevel);
if(H->fAbort || !ps->f) { return; }
ps->dwPID = pProcess ? pProcess->dwPID : 0;
ps->dwMID = dwMID;
ps->MID = MID;
ps->dwLogLevel = dwLogLevel;
ps->v[0] = GetTickCount64();
LcGetOption(H->hLC, LC_OPT_CORE_STATISTICS_CALL_COUNT | LC_STATISTICS_ID_READSCATTER, &ps->v[1]);
ps->v[2] = H->vmm.stat.cPhysReadSuccess;
if(ps->dwPID) {
VmmLog(H, ps->dwMID, ps->dwLogLevel, "%s START: [pid=%i]", uszText, ps->dwPID);
VmmLog(H, ps->MID, ps->dwLogLevel, "%s START: [pid=%i]", uszText, ps->dwPID);
} else {
VmmLog(H, ps->dwMID, ps->dwLogLevel, "%s START:", uszText);
VmmLog(H, ps->MID, ps->dwLogLevel, "%s START:", uszText);
}
}
@@ -179,8 +179,8 @@ VOID VmmStatisticsLogEnd(_In_ VMM_HANDLE H, _In_ PVMMSTATISTICS_LOG ps, _In_ LPS
LcGetOption(H->hLC, LC_OPT_CORE_STATISTICS_CALL_COUNT | LC_STATISTICS_ID_READSCATTER, &v[1]);
v[2] = H->vmm.stat.cPhysReadSuccess;
if(ps->dwPID) {
VmmLog(H, ps->dwMID, ps->dwLogLevel, "%s END: [pid=%i time=%llims scatter=0x%llx pages=0x%llx]", uszText, ps->dwPID, (v[0] - ps->v[0]), (v[1] - ps->v[1]), (v[2] - ps->v[2]));
VmmLog(H, ps->MID, ps->dwLogLevel, "%s END: [pid=%i time=%llims scatter=0x%llx pages=0x%llx]", uszText, ps->dwPID, (v[0] - ps->v[0]), (v[1] - ps->v[1]), (v[2] - ps->v[2]));
} else {
VmmLog(H, ps->dwMID, ps->dwLogLevel, "%s END: [time=%llims scatter=0x%llx pages=0x%llx]", uszText, (v[0] - ps->v[0]), (v[1] - ps->v[1]), (v[2] - ps->v[2]));
VmmLog(H, ps->MID, ps->dwLogLevel, "%s END: [time=%llims scatter=0x%llx pages=0x%llx]", uszText, (v[0] - ps->v[0]), (v[1] - ps->v[1]), (v[2] - ps->v[2]));
}
}
vmm/statistics.h
+5 -3
View File
@@ -62,6 +62,7 @@ typedef enum tdSTATISTICS_ID {
STATISTICS_ID_VMMDLL_Map_GetVM,
STATISTICS_ID_VMMDLL_Map_GetServices,
STATISTICS_ID_VMMDLL_Map_GetPfn,
STATISTICS_ID_VMMDLL_Map_GetPfnEx,
STATISTICS_ID_VMMDLL_ProcessGetDirectories,
STATISTICS_ID_VMMDLL_ProcessGetSections,
STATISTICS_ID_VMMDLL_ProcessGetProcAddress,
@@ -144,6 +145,7 @@ static LPCSTR STATISTICS_ID_STR[STATISTICS_ID_MAX] = {
[STATISTICS_ID_VMMDLL_Map_GetVM] = "MMDLL_Map_GetVM",
[STATISTICS_ID_VMMDLL_Map_GetServices] = "VMMDLL_Map_GetServices",
[STATISTICS_ID_VMMDLL_Map_GetPfn] = "VMMDLL_Map_GetPfn",
[STATISTICS_ID_VMMDLL_Map_GetPfnEx] = "VMMDLL_Map_GetPfnEx",
[STATISTICS_ID_VMMDLL_ProcessGetDirectories] = "VMMDLL_ProcessGetDirectories",
[STATISTICS_ID_VMMDLL_ProcessGetSections] = "VMMDLL_ProcessGetSections",
[STATISTICS_ID_VMMDLL_ProcessGetProcAddress] = "VMMDLL_ProcessGetProcAddress",
@@ -197,7 +199,7 @@ BOOL Statistics_CallToString(_In_ VMM_HANDLE H, _Out_opt_ LPSTR *psz, _Out_ PDWO
typedef struct tdVMMSTATISTICS_LOG {
BOOL f;
DWORD dwPID;
DWORD dwMID;
DWORD MID;
VMMLOG_LEVEL dwLogLevel;
QWORD v[3];
} VMMSTATISTICS_LOG, *PVMMSTATISTICS_LOG;
@@ -205,13 +207,13 @@ typedef struct tdVMMSTATISTICS_LOG {
/*
* Start a call statistics logging session.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- pProcess
* -- pLogStatistics
* -- uszText
*/
VOID VmmStatisticsLogStart(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_opt_ PVMM_PROCESS pProcess, _Out_ PVMMSTATISTICS_LOG pStatisticsLog, _In_ LPSTR uszText);
VOID VmmStatisticsLogStart(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_opt_ PVMM_PROCESS pProcess, _Out_ PVMMSTATISTICS_LOG pStatisticsLog, _In_ LPSTR uszText);
/*
* End a statistics logging session.
vmm/version.h
+3 -3
View File
@@ -2,9 +2,9 @@
#define STRINGIZE(s) STRINGIZE2(s)
#define VERSION_MAJOR 5
#define VERSION_MINOR 3
#define VERSION_REVISION 1
#define VERSION_BUILD 100
#define VERSION_MINOR 4
#define VERSION_REVISION 0
#define VERSION_BUILD 102
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/vmm.c
+2 -2
View File
@@ -5,8 +5,8 @@
//
#include "vmm.h"
#include "mm.h"
#include "mm_pfn.h"
#include "mm/mm.h"
#include "mm/mm_pfn.h"
#include "pdb.h"
#include "vmmheap.h"
#include "vmmproc.h"
vmm/vmm.h
+5 -1
View File
@@ -147,6 +147,7 @@ typedef enum tdVMM_PTE_TP {
VMM_PTE_TP_DEMANDZERO = 4,
VMM_PTE_TP_COMPRESSED = 5,
VMM_PTE_TP_PAGEFILE = 6,
VMM_PTE_TP_FILE = 7,
} VMM_PTE_TP, *PVMM_PTE_TP;
// OBJECT TYPE table exists on Win7+ It's initialized on first use and it will
@@ -731,6 +732,8 @@ typedef struct tdVMM_MAP_SERVICEENTRY {
QWORD _Reserved;
} VMM_MAP_SERVICEENTRY, *PVMM_MAP_SERVICEENTRY;
typedef DWORD VMM_MODULE_ID;
typedef enum tdVMM_EVIL_TP { // EVIL types - sorted by "evilness"
VMM_EVIL_TP_PE_NA, // _NA
VMM_EVIL_TP_PE_INJECTED, // MODULE
@@ -1261,6 +1264,7 @@ typedef struct tdVMMCONFIG {
CHAR szMemMapStr[2048];
CHAR szLogFile[MAX_PATH];
CHAR szLogLevel[MAX_PATH];
CHAR szPathLibraryVmm[MAX_PATH];
} VMMCONFIG, *PVMMCONFIG;
typedef struct tdVMMCONFIG_PDB {
@@ -1601,9 +1605,9 @@ typedef struct tdVMM_CONTEXT {
PVOID FLinkForensic;
PVOID Root;
PVOID Proc;
DWORD dwNextMID;
DWORD cIngestPhysmem;
DWORD cIngestVirtmem;
VMM_MODULE_ID NextMID;
} PluginManager;
CRITICAL_SECTION LockUpdateMap; // lock for global maps - such as MapUser
CRITICAL_SECTION LockUpdateModule; // lock for internal modules
vmm/vmm.vcxproj
+56 -54
View File
@@ -327,9 +327,10 @@
<ClInclude Include="charutil.h" />
<ClInclude Include="fc.h" />
<ClInclude Include="infodb.h" />
<ClInclude Include="mm.h" />
<ClInclude Include="mm_pfn.h" />
<ClInclude Include="m_modules.h" />
<ClInclude Include="mm\mm.h" />
<ClInclude Include="mm\mm_pfn.h" />
<ClInclude Include="modules\modules.h" />
<ClInclude Include="modules\modules_init.h" />
<ClInclude Include="ob\ob.h" />
<ClInclude Include="oscompatibility.h" />
<ClInclude Include="pdb.h" />
@@ -344,6 +345,7 @@
<ClInclude Include="version.h" />
<ClInclude Include="vmm.h" />
<ClInclude Include="vmmdll.h" />
<ClInclude Include="vmmdll_core.h" />
<ClInclude Include="vmmevil.h" />
<ClInclude Include="vmmheap.h" />
<ClInclude Include="vmmlog.h" />
@@ -363,56 +365,57 @@
<ClCompile Include="charutil.c" />
<ClCompile Include="fc.c" />
<ClCompile Include="infodb.c" />
<ClCompile Include="mm_pfn.c" />
<ClCompile Include="mm_vad.c" />
<ClCompile Include="mm_win.c" />
<ClCompile Include="mm_x64.c" />
<ClCompile Include="mm_x86.c" />
<ClCompile Include="mm_x86pae.c" />
<ClCompile Include="m_conf.c" />
<ClCompile Include="m_fc_csv.c" />
<ClCompile Include="m_fc_handle.c" />
<ClCompile Include="m_fc_json.c" />
<ClCompile Include="m_fc_module.c" />
<ClCompile Include="m_fc_ntfs.c" />
<ClCompile Include="m_fc_proc.c" />
<ClCompile Include="m_fc_registry.c" />
<ClCompile Include="m_fc_sys.c" />
<ClCompile Include="m_fc_thread.c" />
<ClCompile Include="m_fc_timeline.c" />
<ClCompile Include="m_file_handles_vads.c" />
<ClCompile Include="m_file_modules.c" />
<ClCompile Include="m_findevil.c" />
<ClCompile Include="m_misc_bitlocker.c" />
<ClCompile Include="m_misc_procinfo.c" />
<ClCompile Include="m_misc_view.c" />
<ClCompile Include="m_misc_web.c" />
<ClCompile Include="m_phys2virt.c" />
<ClCompile Include="m_proc_handle.c" />
<ClCompile Include="m_proc_heap.c" />
<ClCompile Include="m_proc_ldrmodules.c" />
<ClCompile Include="m_proc_memmap.c" />
<ClCompile Include="m_proc_minidump.c" />
<ClCompile Include="m_proc_thread.c" />
<ClCompile Include="m_proc_token.c" />
<ClCompile Include="m_search.c" />
<ClCompile Include="m_sys.c" />
<ClCompile Include="m_sys_cert.c" />
<ClCompile Include="m_sys_driver.c" />
<ClCompile Include="m_sys_mem.c" />
<ClCompile Include="m_sys_net.c" />
<ClCompile Include="m_sys_obj.c" />
<ClCompile Include="m_sys_pool.c" />
<ClCompile Include="m_sys_proc.c" />
<ClCompile Include="m_sys_svc.c" />
<ClCompile Include="m_sys_syscall.c" />
<ClCompile Include="m_sys_task.c" />
<ClCompile Include="m_sys_user.c" />
<ClCompile Include="m_vfsfc.c" />
<ClCompile Include="m_vfsproc.c" />
<ClCompile Include="m_vfsroot.c" />
<ClCompile Include="m_vm.c" />
<ClCompile Include="m_winreg.c" />
<ClCompile Include="mm\mm_pfn.c" />
<ClCompile Include="mm\mm_vad.c" />
<ClCompile Include="mm\mm_win.c" />
<ClCompile Include="mm\mm_x64.c" />
<ClCompile Include="mm\mm_x86.c" />
<ClCompile Include="mm\mm_x86pae.c" />
<ClCompile Include="modules\m_conf.c" />
<ClCompile Include="modules\m_fc_csv.c" />
<ClCompile Include="modules\m_fc_handle.c" />
<ClCompile Include="modules\m_fc_json.c" />
<ClCompile Include="modules\m_fc_module.c" />
<ClCompile Include="modules\m_fc_ntfs.c" />
<ClCompile Include="modules\m_fc_proc.c" />
<ClCompile Include="modules\m_fc_registry.c" />
<ClCompile Include="modules\m_fc_sys.c" />
<ClCompile Include="modules\m_fc_thread.c" />
<ClCompile Include="modules\m_fc_timeline.c" />
<ClCompile Include="modules\m_findevil.c" />
<ClCompile Include="modules\m_misc_bitlocker.c" />
<ClCompile Include="modules\m_misc_procinfo.c" />
<ClCompile Include="modules\m_misc_view.c" />
<ClCompile Include="modules\m_misc_web.c" />
<ClCompile Include="modules\m_phys2virt.c" />
<ClCompile Include="modules\m_proc_file_handles_vads.c" />
<ClCompile Include="modules\m_proc_file_modules.c" />
<ClCompile Include="modules\m_proc_handle.c" />
<ClCompile Include="modules\m_proc_heap.c" />
<ClCompile Include="modules\m_proc_ldrmodules.c" />
<ClCompile Include="modules\m_proc_memmap.c" />
<ClCompile Include="modules\m_proc_minidump.c" />
<ClCompile Include="modules\m_proc_thread.c" />
<ClCompile Include="modules\m_proc_token.c" />
<ClCompile Include="modules\m_search.c" />
<ClCompile Include="modules\m_sys.c" />
<ClCompile Include="modules\m_sys_cert.c" />
<ClCompile Include="modules\m_sys_driver.c" />
<ClCompile Include="modules\m_sys_mem.c" />
<ClCompile Include="modules\m_sys_net.c" />
<ClCompile Include="modules\m_sys_obj.c" />
<ClCompile Include="modules\m_sys_pool.c" />
<ClCompile Include="modules\m_sys_proc.c" />
<ClCompile Include="modules\m_sys_svc.c" />
<ClCompile Include="modules\m_sys_syscall.c" />
<ClCompile Include="modules\m_sys_task.c" />
<ClCompile Include="modules\m_sys_user.c" />
<ClCompile Include="modules\m_vfsfc.c" />
<ClCompile Include="modules\m_vfsproc.c" />
<ClCompile Include="modules\m_vfsroot.c" />
<ClCompile Include="modules\m_virt2phys.c" />
<ClCompile Include="modules\m_vm.c" />
<ClCompile Include="modules\m_winreg.c" />
<ClCompile Include="ob\ob_cachemap.c" />
<ClCompile Include="ob\ob_compressed.c" />
<ClCompile Include="ob\ob_container.c" />
@@ -441,7 +444,6 @@
<ClCompile Include="vmmvm.c" />
<ClCompile Include="vmmwin.c" />
<ClCompile Include="pluginmanager.c" />
<ClCompile Include="m_virt2phys.c" />
<ClCompile Include="vmmwininit.c" />
<ClCompile Include="vmmwinobj.c" />
<ClCompile Include="vmmwinpool.c" />
vmm/vmm.vcxproj.filters
+170 -158
View File
@@ -37,6 +37,12 @@
<Filter Include="Resource Files\res">
<UniqueIdentifier>{36acfda3-7a80-4829-affe-6ab4d6ef5c9f}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\mm">
<UniqueIdentifier>{e6b89b0f-2ea4-4de1-b26d-49376653099f}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\modules">
<UniqueIdentifier>{205ba541-835d-4dc2-a488-6113fe0438d1}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClInclude Include="vmmdll.h">
@@ -81,21 +87,12 @@
<ClInclude Include="sysquery.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="m_modules.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="mm.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="vmmwindef.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="vmmwinobj.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="mm_pfn.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\includes\leechcore.h">
<Filter>Header Files\includes</Filter>
</ClInclude>
@@ -147,6 +144,21 @@
<ClInclude Include="..\includes\libpdbcrust.h">
<Filter>Header Files\includes</Filter>
</ClInclude>
<ClInclude Include="mm\mm.h">
<Filter>Header Files\mm</Filter>
</ClInclude>
<ClInclude Include="mm\mm_pfn.h">
<Filter>Header Files\mm</Filter>
</ClInclude>
<ClInclude Include="modules\modules.h">
<Filter>Header Files\modules</Filter>
</ClInclude>
<ClInclude Include="modules\modules_init.h">
<Filter>Header Files\modules</Filter>
</ClInclude>
<ClInclude Include="vmmdll_core.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ClCompile Include="vmmdll.c">
@@ -179,63 +191,18 @@
<ClCompile Include="vmmwinreg.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_winreg.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_virt2phys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_phys2virt.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="pdb.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="sysquery.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="mm_x86pae.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm_x64.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm_x86.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm_vad.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm_win.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="m_file_handles_vads.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_file_modules.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_vfsproc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_vfsroot.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="vmmwinobj.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="mm_pfn.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="fc.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_fc_ntfs.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_timeline.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="vmmnet.c">
<Filter>Source Files</Filter>
</ClCompile>
@@ -254,24 +221,9 @@
<ClCompile Include="ob\ob_set.c">
<Filter>Source Files\ob</Filter>
</ClCompile>
<ClCompile Include="m_fc_proc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_registry.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_thread.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="vmmwinsvc.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_findevil.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_vfsfc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="ob\ob_cachemap.c">
<Filter>Source Files\ob</Filter>
</ClCompile>
@@ -281,69 +233,24 @@
<ClCompile Include="vmmevil.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_sys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_cert.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_driver.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_mem.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_net.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_obj.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_proc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_svc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_syscall.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="ob\ob_compressed.c">
<Filter>Source Files\ob</Filter>
</ClCompile>
<ClCompile Include="m_proc_token.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="ob\ob_memfile.c">
<Filter>Source Files\ob</Filter>
</ClCompile>
<ClCompile Include="m_sys_task.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_module.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_json.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="charutil.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="oscompatibility.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_conf.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="infodb.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="vmmwinpool.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_sys_pool.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="ob\ob_counter.c">
<Filter>Source Files\ob</Filter>
</ClCompile>
@@ -353,33 +260,6 @@
<ClCompile Include="vmmlog.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_misc_bitlocker.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_search.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_misc_web.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_handle.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_ldrmodules.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_memmap.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_minidump.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_thread.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_proc_heap.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="vmmheap.c">
<Filter>Source Files</Filter>
</ClCompile>
@@ -389,28 +269,160 @@
<ClCompile Include="vmmwork.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_fc_csv.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_handle.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_fc_sys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_sys_user.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_misc_view.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="vmmvm.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="m_vm.c">
<ClCompile Include="mm\mm_pfn.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm\mm_vad.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm\mm_win.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm\mm_x64.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm\mm_x86.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="mm\mm_x86pae.c">
<Filter>Source Files\mm</Filter>
</ClCompile>
<ClCompile Include="modules\m_conf.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="m_misc_procinfo.c">
<ClCompile Include="modules\m_fc_csv.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_handle.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_json.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_module.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_ntfs.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_proc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_registry.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_sys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_thread.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_fc_timeline.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_findevil.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_misc_bitlocker.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_misc_procinfo.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_misc_view.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_misc_web.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_phys2virt.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_file_handles_vads.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_file_modules.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_handle.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_heap.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_ldrmodules.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_memmap.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_minidump.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_thread.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_proc_token.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_search.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_cert.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_driver.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_mem.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_net.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_obj.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_pool.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_proc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_svc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_syscall.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_task.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_sys_user.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_vfsfc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_vfsproc.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_vfsroot.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_virt2phys.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_vm.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
<ClCompile Include="modules\m_winreg.c">
<Filter>Source Files\modules</Filter>
</ClCompile>
</ItemGroup>
vmm/vmmdll.c
+40 -3
View File
@@ -21,7 +21,7 @@
#include "vmmwinobj.h"
#include "vmmwinreg.h"
#include "vmmvm.h"
#include "mm_pfn.h"
#include "mm/mm_pfn.h"
// tags for external allocations:
#define OB_TAG_API_MAP_EAT 'EAT '
@@ -1874,7 +1874,7 @@ _Success_(return) BOOL VMMDLL_Map_GetServicesW(_In_ VMM_HANDLE H, _Out_ PVMMDLL_
}
_Success_(return)
BOOL VMMDLL_Map_GetPfn_Impl(_In_ VMM_HANDLE H, _In_ DWORD pPfns[], _In_ DWORD cPfns, _Out_writes_bytes_opt_(*pcbMapDst) PVMMDLL_MAP_PFN pMapDst, _Inout_ PDWORD pcbMapDst)
BOOL VMMDLL_Map_GetPfn_Impl(_In_ VMM_HANDLE H, _In_reads_(cPfns) DWORD pPfns[], _In_ DWORD cPfns, _Out_writes_bytes_opt_(*pcbMapDst) PVMMDLL_MAP_PFN pMapDst, _Inout_ PDWORD pcbMapDst)
{
BOOL fResult = FALSE;
POB_SET psObPfns = NULL;
@@ -1905,13 +1905,50 @@ fail:
}
_Success_(return)
BOOL VMMDLL_Map_GetPfn(_In_ VMM_HANDLE H, _In_ DWORD pPfns[], _In_ DWORD cPfns, _Out_writes_bytes_opt_(*pcbPfnMap) PVMMDLL_MAP_PFN pPfnMap, _Inout_ PDWORD pcbPfnMap)
BOOL VMMDLL_Map_GetPfnEx_Impl(_In_ VMM_HANDLE H, _In_reads_(cPfns) DWORD pPfns[], _In_ DWORD cPfns, _Out_ PVMMDLL_MAP_PFN *ppMapDst, _In_ DWORD flags)
{
BOOL fResult = FALSE;
POB_SET psObPfns = NULL;
PMMPFNOB_MAP pObMapSrc = NULL;
PVMMDLL_MAP_PFN pMapDst = NULL;
DWORD i, cbDst = 0, cbDstData;
BOOL fExtended = flags & VMMDLL_PFN_FLAG_EXTENDED;
*ppMapDst = NULL;
cbDstData = cPfns * sizeof(VMMDLL_MAP_PFNENTRY);
cbDst = sizeof(VMMDLL_MAP_PFN) + cbDstData;
if(!(pMapDst = VmmDllCore_MemAllocExternal(H, OB_TAG_API_MAP_SERVICES, cbDst, sizeof(VMMDLL_MAP_PFN)))) { goto fail; } // VMMDLL_MemFree()
if(!(psObPfns = ObSet_New(H))) { goto fail; }
for(i = 0; i < cPfns; i++) {
ObSet_Push(psObPfns, pPfns[i]);
}
if(!MmPfn_Map_GetPfnScatter(H, psObPfns, &pObMapSrc, fExtended)) { goto fail; }
ZeroMemory(pMapDst, cbDst);
pMapDst->dwVersion = VMMDLL_MAP_PFN_VERSION;
pMapDst->cMap = pObMapSrc->cMap;
memcpy(pMapDst->pMap, pObMapSrc->pMap, pMapDst->cMap * sizeof(VMMDLL_MAP_PFNENTRY));
*ppMapDst = pMapDst;
fail:
if(pMapDst && !*ppMapDst) { VMMDLL_MemFree(pMapDst); pMapDst = NULL; }
Ob_DECREF(psObPfns);
Ob_DECREF(pObMapSrc);
return *ppMapDst ? TRUE : FALSE;
}
_Success_(return)
BOOL VMMDLL_Map_GetPfn(_In_ VMM_HANDLE H, _In_reads_(cPfns) DWORD pPfns[], _In_ DWORD cPfns, _Out_writes_bytes_opt_(*pcbPfnMap) PVMMDLL_MAP_PFN pPfnMap, _Inout_ PDWORD pcbPfnMap)
{
CALL_IMPLEMENTATION_VMM(H,
STATISTICS_ID_VMMDLL_Map_GetPfn,
VMMDLL_Map_GetPfn_Impl(H, pPfns, cPfns, pPfnMap, pcbPfnMap))
}
BOOL VMMDLL_Map_GetPfnEx(_In_ VMM_HANDLE H, _In_reads_(cPfns) DWORD pPfns[], _In_ DWORD cPfns, _Out_ PVMMDLL_MAP_PFN *ppPfnMap, _In_ DWORD flags)
{
CALL_IMPLEMENTATION_VMM(H,
STATISTICS_ID_VMMDLL_Map_GetPfnEx,
VMMDLL_Map_GetPfnEx_Impl(H, pPfns, cPfns, ppPfnMap, flags))
}
_Success_(return)
BOOL VMMDLL_PidList_Impl(_In_ VMM_HANDLE H, _Out_writes_opt_(*pcPIDs) PDWORD pPIDs, _Inout_ PSIZE_T pcPIDs)
{
vmm/vmmdll.h
+31 -11
View File
@@ -7,17 +7,11 @@
// Windows may access both UTF-8 *U and Wide-Char *W versions of functions
// while Linux may only access UTF-8 versions. Some functionality may also
// be degraded or unavailable on Linux.
//
// v5 API
// ======
// v5 of the API support multiple concurrent parallel analysis tasks.
// To accomodate this significant changes have been done to the API which is
// largely incompatible (but very similar) to the earlier API versions.
//
// (c) Ulf Frisk, 2018-2023
// Author: Ulf Frisk, [email protected]
//
// Header Version: 5.3
// Header Version: 5.4
//
#include "leechcore.h"
@@ -485,7 +479,7 @@ BOOL VMMDLL_InitializePlugins(_In_ VMM_HANDLE hVMM);
#define VMMDLL_PLUGIN_CONTEXT_MAGIC 0xc0ffee663df9301c
#define VMMDLL_PLUGIN_CONTEXT_VERSION 5
#define VMMDLL_PLUGIN_REGINFO_MAGIC 0xc0ffee663df9301d
#define VMMDLL_PLUGIN_REGINFO_VERSION 15
#define VMMDLL_PLUGIN_REGINFO_VERSION 16
#define VMMDLL_PLUGIN_FORENSIC_JSONDATA_VERSION 0xc0ee0002
#define VMMDLL_PLUGIN_NOTIFY_VERBOSITYCHANGE 0x01
@@ -503,6 +497,8 @@ typedef struct tdVMMDLL_CSV_HANDLE *VMMDLL_CSV_HANDLE;
#define VMMDLL_MID_MAIN ((VMMDLL_MODULE_ID)0x80000001)
#define VMMDLL_MID_PYTHON ((VMMDLL_MODULE_ID)0x80000002)
#define VMMDLL_MID_DEBUG ((VMMDLL_MODULE_ID)0x80000003)
#define VMMDLL_MID_RUST ((VMMDLL_MODULE_ID)0x80000004)
typedef struct tdVMMDLL_PLUGIN_CONTEXT {
ULONG64 magic;
@@ -554,7 +550,8 @@ typedef struct tdVMMDLL_PLUGIN_REGINFO {
VMMDLL_SYSTEM_TP tpSystem;
HMODULE hDLL;
BOOL(*pfnPluginManager_Register)(_In_ VMM_HANDLE H, struct tdVMMDLL_PLUGIN_REGINFO *pPluginRegInfo);
DWORD _Reserved[32];
LPSTR uszPathVmmDLL;
DWORD _Reserved[30];
// python plugin information - not for general use
struct {
BOOL fPythonStandalone;
@@ -901,7 +898,7 @@ BOOL VMMDLL_Scatter_PrepareEx(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_
* -- return
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb);
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_reads_(cb) PBYTE pb, _In_ DWORD cb);
/*
* Retrieve and Write memory previously populated.
@@ -1001,6 +998,7 @@ typedef enum tdVMMDLL_PTE_TP {
VMMDLL_PTE_TP_DEMANDZERO = 4,
VMMDLL_PTE_TP_COMPRESSED = 5,
VMMDLL_PTE_TP_PAGEFILE = 6,
VMMDLL_PTE_TP_FILE = 7,
} VMMDLL_PTE_TP, *PVMMDLL_PTE_TP;
typedef struct tdVMMDLL_MAP_PTEENTRY {
@@ -1831,6 +1829,9 @@ BOOL VMMDLL_MemSearch(
#define VMMDLL_MAP_PFN_VERSION 1
#define VMMDLL_PFN_FLAG_NORMAL 0
#define VMMDLL_PFN_FLAG_EXTENDED 1
static LPCSTR VMMDLL_PFN_TYPE_TEXT[] = { "Zero", "Free", "Standby", "Modifiy", "ModNoWr", "Bad", "Active", "Transit" };
static LPCSTR VMMDLL_PFN_TYPEEXTENDED_TEXT[] = { "-", "Unused", "ProcPriv", "PageTable", "LargePage", "DriverLock", "Shareable", "File" };
@@ -1919,12 +1920,31 @@ typedef struct tdVMMDLL_MAP_PFN {
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Map_GetPfn(
_In_ VMM_HANDLE hVMM,
_In_ DWORD pPfns[],
_In_reads_(cPfns) DWORD pPfns[],
_In_ DWORD cPfns,
_Out_writes_bytes_opt_(*pcbPfnMap) PVMMDLL_MAP_PFN pPfnMap,
_Inout_ PDWORD pcbPfnMap
);
/*
* Retrieve PFN information:
* CALLER FREE: VMMDLL_MemFree(*ppPfnMap)
* -- hVMM
* -- pPfns = PFNs to retrieve.
* -- cPfns = number of PFNs to retrieve.
* -- ppPfnMap = ptr to receive result on success. must be free'd with VMMDLL_MemFree().
* -- flags = optional flags as specified by VMMDLL_PFN_FLAG_*
* -- return = success/fail.
*/
EXPORTED_FUNCTION _Success_(return)
BOOL VMMDLL_Map_GetPfnEx(
_In_ VMM_HANDLE hVMM,
_In_reads_(cPfns) DWORD pPfns[],
_In_ DWORD cPfns,
_Out_ PVMMDLL_MAP_PFN *ppPfnMap,
_In_ DWORD flags
);
//-----------------------------------------------------------------------------
vmm/vmmdll_core.c
+4
View File
@@ -335,6 +335,7 @@ VOID VmmDllCore_CloseHandle(_In_opt_ _Post_ptr_invalid_ VMM_HANDLE H, _In_ BOOL
VmmDllCore_CloseHandle_VmmParentDetach(H);
// Close logging (last)
Statistics_CallSetEnabled(H, FALSE);
VmmLog(H, MID_CORE, LOGLEVEL_VERBOSE, "SHUTDOWN COMPLETED (%p).\n", H);
VmmLog_Close(H);
LocalFree(H);
}
@@ -621,6 +622,9 @@ BOOL VmmDllCore_InitializeConfig(_In_ VMM_HANDLE H, _In_ DWORD argc, _In_ char *
H->dev.dwPrintfVerbosity |= H->cfg.fVerbose ? LC_CONFIG_PRINTF_V : 0;
H->dev.dwPrintfVerbosity |= H->cfg.fVerboseExtra ? LC_CONFIG_PRINTF_VV : 0;
H->dev.dwPrintfVerbosity |= H->cfg.fVerboseExtraTlp ? LC_CONFIG_PRINTF_VVV : 0;
Util_GetPathLib(H->cfg.szPathLibraryVmm);
strncat_s(H->cfg.szPathLibraryVmm, _countof(H->cfg.szPathLibraryVmm), "vmm", _TRUNCATE);
strncat_s(H->cfg.szPathLibraryVmm, _countof(H->cfg.szPathLibraryVmm), VMM_LIBRARY_FILETYPE, _TRUNCATE);
return (H->dev.szDevice[0] != 0);
}
vmm/vmmdll_scatter.c
+2 -2
View File
@@ -142,7 +142,7 @@ BOOL VMMDLL_Scatter_PrepareInternal(_In_ PSCATTER_CONTEXT ctx, _In_ QWORD va, _I
}
_Success_(return)
BOOL VMMDLL_Scatter_PrepareWriteInternal(_In_ PSCATTER_CONTEXT ctx, _In_ QWORD va, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb)
BOOL VMMDLL_Scatter_PrepareWriteInternal(_In_ PSCATTER_CONTEXT ctx, _In_ QWORD va, _In_reads_(cb) PBYTE pb, _In_ DWORD cb)
{
DWORD cMEMsRequired;
PSCATTER_RANGE_WRITE pRangeWr;
@@ -206,7 +206,7 @@ BOOL VMMDLL_Scatter_Prepare(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_ D
* -- return
*/
_Success_(return)
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _Out_writes_(cb) PBYTE pb, _In_ DWORD cb)
BOOL VMMDLL_Scatter_PrepareWrite(_In_ VMMDLL_SCATTER_HANDLE hS, _In_ QWORD va, _In_reads_(cb) PBYTE pb, _In_ DWORD cb)
{
SCATTER_CALL_SYNCHRONIZED_IMPLEMENTATION(hS, VMMDLL_Scatter_PrepareWriteInternal((PSCATTER_CONTEXT)hS, va, pb, cb));
}
vmm/vmmlog.c
+54 -53
View File
@@ -21,7 +21,7 @@ static LPCSTR VMMLOG_LEVEL_STR[] = {
};
typedef struct tdVMMLOG_MODULE_MODULEINFO {
DWORD dwMID; // module id
DWORD MID; // module id
VMMLOG_LEVEL dwLevelD; // log level display (other than default)
VMMLOG_LEVEL dwLevelF; // log level file (other than default)
LPSTR uszName;
@@ -40,14 +40,14 @@ typedef struct tdVMMLOG_CONTEXT {
/*
* Helper function to get a log module info object.
*/
inline PVMMLOG_CONTEXT_MODULEINFO VmmLog_GetModuleInfo(_In_ VMM_HANDLE H, _In_ DWORD dwMID)
inline PVMMLOG_CONTEXT_MODULEINFO VmmLog_GetModuleInfo(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID)
{
PVMMLOG_CONTEXT ctxLog = H->log;
if(!ctxLog) { return NULL; }
if(dwMID & 0x80000000) {
return (dwMID <= MID_MAX) ? &ctxLog->CoreInfo[dwMID & 0x7fffffff] : NULL;
if(MID & 0x80000000) {
return (MID <= MID_MAX) ? &ctxLog->CoreInfo[MID & 0x7fffffff] : NULL;
} else {
return (dwMID < ctxLog->iNextMID) ? &ctxLog->ModuleInfo[dwMID] : NULL;
return (MID < ctxLog->iNextMID) ? &ctxLog->ModuleInfo[MID] : NULL;
}
}
@@ -59,14 +59,14 @@ inline PVMMLOG_CONTEXT_MODULEINFO VmmLog_GetModuleInfo(_In_ VMM_HANDLE H, _In_ D
VOID VmmLog_Close(_In_ VMM_HANDLE H)
{
PVMMLOG_CONTEXT_MODULEINFO pmi;
DWORD dwMID;
VMM_MODULE_ID MID;
H->logfilter = (DWORD)LOGLEVEL_NONE;
if(H->log) {
if(H->log->pFile) {
fclose(H->log->pFile);
}
for(dwMID = 0; dwMID < H->log->iNextMID; dwMID++) {
if((pmi = VmmLog_GetModuleInfo(H, dwMID))) {
for(MID = 0; MID < H->log->iNextMID; MID++) {
if((pmi = VmmLog_GetModuleInfo(H, MID))) {
LocalFree(pmi->uszName);
}
}
@@ -78,17 +78,17 @@ VOID VmmLog_Close(_In_ VMM_HANDLE H)
/*
* Get the log level for either display (on-screen) or file.
* -- H
* -- dwMID = specify MID to get specific level override (i.e. not default MID)
* -- MID = specify MID to get specific level override (i.e. not default MID)
* -- fDisplay
* -- return
*/
VMMLOG_LEVEL VmmLog_LevelGet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ BOOL fDisplay)
VMMLOG_LEVEL VmmLog_LevelGet(_In_ VMM_HANDLE H, _In_opt_ VMM_MODULE_ID MID, _In_ BOOL fDisplay)
{
PVMMLOG_CONTEXT ctxLog = H->log;
PVMMLOG_CONTEXT_MODULEINFO pmi;
if(!ctxLog) { return LOGLEVEL_NONE; }
if(dwMID) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
if(MID) {
pmi = VmmLog_GetModuleInfo(H, MID);
if(!pmi) { return LOGLEVEL_NONE; }
return fDisplay ? pmi->dwLevelD : pmi->dwLevelF;
} else {
@@ -99,18 +99,18 @@ VMMLOG_LEVEL VmmLog_LevelGet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ BOOL
/*
* Set the log level for either display (on-screen) or file.
* -- H
* -- dwMID = specify MID (other than 0) to set specific module level override.
* -- MID = specify MID (other than 0) to set specific module level override.
* -- dwLogLevel
* -- fDisplay = TRUE(display), FALSE(file)
* -- fSetOrIncrease = TRUE(set), FALSE(increase)
*/
VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_ BOOL fDisplay, _In_ BOOL fSetOrIncrease)
VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_ BOOL fDisplay, _In_ BOOL fSetOrIncrease)
{
PVMMLOG_CONTEXT ctxLog = H->log;
PVMMLOG_CONTEXT_MODULEINFO pmi = NULL;
if(!ctxLog || (dwLogLevel < 0) || (dwLogLevel > LOGLEVEL_ALL)) { return; }
if(dwMID) {
if(!(pmi = VmmLog_GetModuleInfo(H, dwMID))) { return; }
if(MID) {
if(!(pmi = VmmLog_GetModuleInfo(H, MID))) { return; }
if(fDisplay) {
pmi->dwLevelD = fSetOrIncrease ? dwLogLevel : max(dwLogLevel, pmi->dwLevelD);
} else {
@@ -121,12 +121,12 @@ VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ VMMLOG_LEVEL
ctxLog->dwLevelMID = max(ctxLog->dwLevelMID, dwLogLevel);
} else {
ctxLog->dwLevelMID = 0;
for(dwMID = 1; dwMID < ctxLog->iNextMID; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = 1; MID < ctxLog->iNextMID; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
ctxLog->dwLevelMID = max(ctxLog->dwLevelMID, max(pmi->dwLevelD, pmi->dwLevelF));
}
for(dwMID = MID_NA; dwMID <= MID_MAX; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = MID_NA; MID <= MID_MAX; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
ctxLog->dwLevelMID = max(ctxLog->dwLevelMID, max(pmi->dwLevelD, pmi->dwLevelF));
}
}
@@ -146,7 +146,8 @@ VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ VMMLOG_LEVEL
VOID VmmLog_LevelRefresh(_In_ VMM_HANDLE H)
{
PVMMLOG_CONTEXT ctxLog = H->log;
DWORD i, dwMID, dwTokenMID;
VMM_MODULE_ID MID;
DWORD i, dwTokenMID;
PVMMLOG_CONTEXT_MODULEINFO pmi;
CHAR ch, szModuleName[9], szTokenBuffer[MAX_PATH];
LPSTR szToken, szTokenInitial, szTokenContext = NULL;
@@ -156,20 +157,20 @@ VOID VmmLog_LevelRefresh(_In_ VMM_HANDLE H)
if(!ctxLog) {
H->log = LocalAlloc(LMEM_ZEROINIT, sizeof(VMMLOG_CONTEXT));
if(!(ctxLog = H->log)) { return; }
for(dwMID = MID_NA; dwMID <= MID_MAX; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
pmi->dwMID = dwMID;
pmi->uszName = (LPSTR)VMMLOG_MID_STR[dwMID & 0x7fffffff];
for(MID = MID_NA; MID <= MID_MAX; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
pmi->MID = MID;
pmi->uszName = (LPSTR)VMMLOG_MID_STR[MID & 0x7fffffff];
}
}
// clear module overrides (if any):
for(dwMID = 1; dwMID < ctxLog->iNextMID; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = 1; MID < ctxLog->iNextMID; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
pmi->dwLevelD = LOGLEVEL_NONE;
pmi->dwLevelF = LOGLEVEL_NONE;
}
for(dwMID = MID_NA; dwMID <= MID_MAX; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = MID_NA; MID <= MID_MAX; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
pmi->dwLevelD = LOGLEVEL_NONE;
pmi->dwLevelF = LOGLEVEL_NONE;
}
@@ -220,17 +221,17 @@ VOID VmmLog_LevelRefresh(_In_ VMM_HANDLE H)
i++;
}
if(fModuleName) {
for(dwMID = 1; dwMID < ctxLog->iNextMID; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = 1; MID < ctxLog->iNextMID; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
if(pmi->uszName && !_stricmp(pmi->uszName, szModuleName)) {
dwTokenMID = dwMID;
dwTokenMID = MID;
break;
}
}
for(dwMID = MID_NA; dwMID <= MID_MAX; dwMID++) {
pmi = VmmLog_GetModuleInfo(H, dwMID);
for(MID = MID_NA; MID <= MID_MAX; MID++) {
pmi = VmmLog_GetModuleInfo(H, MID);
if(pmi->uszName && !_stricmp(pmi->uszName, szModuleName)) {
dwTokenMID = dwMID;
dwTokenMID = MID;
break;
}
}
@@ -248,47 +249,47 @@ VOID VmmLog_LevelRefresh(_In_ VMM_HANDLE H)
* Register a new module ID (MID) with the log database.
* This function should be called in a single-threaded context by the plugin manager.
* -- H
* -- dwMID = the module ID (MID) to register
* -- MID = the module ID (MID) to register
* -- uszModuleName
* -- fExternal = externally loaded module (dll/so).
*/
VOID VmmLog_RegisterModule(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ LPSTR uszModuleName, _In_ BOOL fExternal)
VOID VmmLog_RegisterModule(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ LPSTR uszModuleName, _In_ BOOL fExternal)
{
PVMMLOG_CONTEXT_MODULEINFO pmi;
if(!H->log) { return; }
if(dwMID >= VMMLOG_MID_MODULE_MAX) { return; }
pmi = H->log->ModuleInfo + dwMID;
if(MID >= VMMLOG_MID_MODULE_MAX) { return; }
pmi = H->log->ModuleInfo + MID;
if(pmi->uszName) {
LocalFree(pmi->uszName);
ZeroMemory(pmi, sizeof(VMMLOG_CONTEXT_MODULEINFO));
}
if(CharUtil_UtoU(uszModuleName, 8, NULL, 0, &pmi->uszName, NULL, CHARUTIL_FLAG_ALLOC)) {
}
pmi->dwMID = dwMID;
H->log->iNextMID = dwMID + 1;
pmi->MID = MID;
H->log->iNextMID = MID + 1;
}
/*
* Log a message "printf" style. Whether the message is displayed and/or saved
* to log file depends on the internal logging setup.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- uszFormat
* -- ...
*/
VOID VmmLogEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...)
VOID VmmLogEx(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...)
{
va_list arglist;
va_start(arglist, uszFormat);
VmmLogEx2(H, dwMID, dwLogLevel, uszFormat, arglist);
VmmLogEx2(H, MID, dwLogLevel, uszFormat, arglist);
va_end(arglist);
}
/*
* Log a message "printf" style followed by a hexascii printout.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- pb = binary to log
* -- cb = size of binary to log
@@ -296,7 +297,7 @@ VOID VmmLogEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel,
* -- uszFormat
* -- ...
*/
VOID VmmLogHexAsciiEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _In_ DWORD cbInitialOffset, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...)
VOID VmmLogHexAsciiEx(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _In_ DWORD cbInitialOffset, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...)
{
LPSTR usz;
va_list arglist;
@@ -320,7 +321,7 @@ VOID VmmLogHexAsciiEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwL
}
// 4: log
va_start(arglist, uszFormat);
VmmLogEx2(H, dwMID, dwLogLevel, usz, arglist);
VmmLogEx2(H, MID, dwLogLevel, usz, arglist);
va_end(arglist);
LocalFree(usz);
}
@@ -328,11 +329,11 @@ VOID VmmLogHexAsciiEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwL
/*
* Check whether the MID/LogLevel will log to any output.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- return = TRUE(will log), FALSE(will NOT log).
*/
BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel)
BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel)
{
PVMMLOG_CONTEXT ctxLog = H->log;
PVMMLOG_CONTEXT_MODULEINFO pmi;
@@ -340,7 +341,7 @@ BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLog
if(!ctxLog) { return FALSE; }
// sanity checks, get module info object and check if logs should happen to display/file:
if((dwLogLevel < LOGLEVEL_NONE) || (dwLogLevel > LOGLEVEL_ALL) || (dwLogLevel > (VMMLOG_LEVEL)H->logfilter)) { return FALSE; }
if(!(pmi = VmmLog_GetModuleInfo(H, dwMID))) { return FALSE; }
if(!(pmi = VmmLog_GetModuleInfo(H, MID))) { return FALSE; }
fD = ((dwLogLevel <= ctxLog->dwLevelD) || (dwLogLevel <= pmi->dwLevelD)); // log to display
fF = ((dwLogLevel <= ctxLog->dwLevelF) || (dwLogLevel <= pmi->dwLevelF)) && ctxLog->pFile; // log to file
return fD || fF;
@@ -350,12 +351,12 @@ BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLog
* Log a message using a va_list. Whether the message is displayed and/or saved
* to log file depends on the internal logging setup.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- uszFormat
* -- arglist
*/
VOID VmmLogEx2(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, va_list arglist)
VOID VmmLogEx2(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, va_list arglist)
{
PVMMLOG_CONTEXT ctxLog = H->log;
PVMMLOG_CONTEXT_MODULEINFO pmi;
@@ -369,7 +370,7 @@ VOID VmmLogEx2(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel
if(!ctxLog) { return; }
// sanity checks, get module info object and check if logs should happen to display/file:
if((dwLogLevel < LOGLEVEL_NONE) || (dwLogLevel > LOGLEVEL_ALL) || (dwLogLevel > (VMMLOG_LEVEL)H->logfilter)) { return; }
if(!(pmi = VmmLog_GetModuleInfo(H, dwMID))) { return; }
if(!(pmi = VmmLog_GetModuleInfo(H, MID))) { return; }
fD = ((dwLogLevel <= ctxLog->dwLevelD) || (dwLogLevel <= pmi->dwLevelD)); // log to display
fF = ((dwLogLevel <= ctxLog->dwLevelF) || (dwLogLevel <= pmi->dwLevelF)) && ctxLog->pFile; // log to file
if(!fD && !fF) { return; }
vmm/vmmlog.h
+21 -17
View File
@@ -7,6 +7,8 @@
#define __VMMLOG_H__
#include "vmm.h"
typedef DWORD VMM_MODULE_ID;
typedef enum tdVMMLOG_LEVEL {
LOGLEVEL_NONE = 0, // do not use!
LOGLEVEL_0_NONE = 0,
@@ -31,6 +33,7 @@ typedef enum tdVMMLOG_LEVEL {
#define MID_MAIN 0x80000001
#define MID_PYTHON 0x80000002
#define MID_DEBUG 0x80000003
#define MID_RUST 0x80000004
#define MID_CORE 0x80000010
#define MID_API 0x80000011
#define MID_VMM 0x80000012
@@ -57,7 +60,8 @@ static LPCSTR VMMLOG_MID_STR[] = {
"MAIN",
"PYTHON",
"DEBUG",
"N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A",
"RUST",
"N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A", "N/A",
// vmm internal built-in module:
"CORE",
"API",
@@ -95,45 +99,45 @@ VOID VmmLog_Close(_In_ VMM_HANDLE H);
/*
* Get the log level for either display (on-screen) or file.
* -- H
* -- dwMID = specify MID (other than 0) to get specific module level override.
* -- MID = specify MID (other than 0) to get specific module level override.
* -- fDisplay
* -- return
*/
VMMLOG_LEVEL VmmLog_LevelGet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ BOOL fDisplay);
VMMLOG_LEVEL VmmLog_LevelGet(_In_ VMM_HANDLE H, _In_opt_ VMM_MODULE_ID MID, _In_ BOOL fDisplay);
/*
* Set the log level for either display (on-screen) or file.
* -- H
* -- dwMID = specify MID (other than 0) to set specific module level override.
* -- MID = specify MID (other than 0) to set specific module level override.
* -- dwLogLevel
* -- fDisplay = TRUE(display), FALSE(file)
* -- fSetOrIncrease = TRUE(set), FALSE(increase)
*/
VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_ BOOL fDisplay, _In_ BOOL fSetOrIncrease);
VOID VmmLog_LevelSet(_In_ VMM_HANDLE H, _In_opt_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_ BOOL fDisplay, _In_ BOOL fSetOrIncrease);
/*
* Register a new module ID (MID) with the log database.
* This function should be called in a single-threaded context by the plugin manager.
* -- H
* -- dwMID = the module ID (MID) to register
* -- MID = the module ID (MID) to register
* -- uszModuleName
* -- fExternal = externally loaded module (dll/so).
*/
VOID VmmLog_RegisterModule(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ LPSTR uszModuleName, _In_ BOOL fExternal);
VOID VmmLog_RegisterModule(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ LPSTR uszModuleName, _In_ BOOL fExternal);
/*
* Check whether the MID/LogLevel will log to any output.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- return = TRUE(will log), FALSE(will NOT log).
*/
BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel);
BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel);
/*
* Log a message "printf" style followed by a hexascii printout.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- pb = binary to log
* -- cb = size of binary to log
@@ -143,7 +147,7 @@ BOOL VmmLogIsActive(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLog
*/
VOID VmmLogHexAsciiEx(
_In_ VMM_HANDLE H,
_In_ DWORD dwMID,
_In_ VMM_MODULE_ID MID,
_In_ VMMLOG_LEVEL dwLogLevel,
_In_reads_(cb) PBYTE pb,
_In_ DWORD cb,
@@ -156,33 +160,33 @@ VOID VmmLogHexAsciiEx(
* Log a message "printf" style. Whether the message is displayed and/or saved
* to log file depends on the internal logging setup.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- uszFormat
* -- ...
*/
VOID VmmLogEx(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...);
VOID VmmLogEx(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, ...);
/*
* Log a message using a va_list. Whether the message is displayed and/or saved
* to log file depends on the internal logging setup.
* -- H
* -- dwMID = module ID (MID)
* -- MID = module ID (MID)
* -- dwLogLevel = log level as defined by LOGLEVEL_*
* -- uszFormat
* -- arglist
*/
VOID VmmLogEx2(_In_ VMM_HANDLE H, _In_ DWORD dwMID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, va_list arglist);
VOID VmmLogEx2(_In_ VMM_HANDLE H, _In_ VMM_MODULE_ID MID, _In_ VMMLOG_LEVEL dwLogLevel, _In_z_ _Printf_format_string_ LPSTR uszFormat, va_list arglist);
/*
* Log amessage "printf" style.
* -- H
* -- dwMID
* -- MID
* -- dwLogLevel
* -- format
* -- ...
*/
#define VmmLog(H, dwMID, dwLogLevel, format, ...) { if(dwLogLevel <= (VMMLOG_LEVEL)H->logfilter) { VmmLogEx(H, dwMID, dwLogLevel, format, ##__VA_ARGS__); } }
#define VmmLog(H, MID, dwLogLevel, format, ...) { if(dwLogLevel <= (VMMLOG_LEVEL)H->logfilter) { VmmLogEx(H, MID, dwLogLevel, format, ##__VA_ARGS__); } }
/*
* printf a message to the console if allowed (i.e. not suppressed in a dll context).
vmm/vmmproc.c
+1 -1
View File
@@ -15,7 +15,7 @@
#include "vmmwinpool.h"
#include "vmmwinreg.h"
#include "vmmwinsvc.h"
#include "mm_pfn.h"
#include "mm/mm_pfn.h"
#include "pluginmanager.h"
#include "statistics.h"
#include "util.h"
vmm/vmmwin.c
+1 -1
View File
@@ -13,7 +13,7 @@
#include "util.h"
#include "pdb.h"
#include "pe.h"
#include "mm.h"
#include "mm/mm.h"
#include "infodb.h"
#include "statistics.h"
#ifdef _WIN32
vmm/vmmwininit.c
+1 -1
View File
@@ -7,7 +7,6 @@
//
#include "vmm.h"
#include "mm.h"
#include "pe.h"
#include "pdb.h"
#include "util.h"
@@ -16,6 +15,7 @@
#include "vmmwinobj.h"
#include "vmmwinreg.h"
#include "infodb.h"
#include "mm/mm.h"
/*
* Try initialize threading - this is dependent on available PDB symbols.
vmmpyc/version.h
+3 -3
View File
@@ -2,9 +2,9 @@
#define STRINGIZE(s) STRINGIZE2(s)
#define VERSION_MAJOR 5
#define VERSION_MINOR 3
#define VERSION_REVISION 1
#define VERSION_BUILD 100
#define VERSION_MINOR 4
#define VERSION_REVISION 0
#define VERSION_BUILD 102
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmmpyc/vmmpyc_vmm.c
-1
View File
@@ -143,7 +143,6 @@ VmmPycVmm_reg_hive_list(PyObj_Vmm *self, PyObject *args)
if(!self->fValid) { return PyErr_Format(PyExc_RuntimeError, "Vmm.reg_hive_list(): Not initialized."); }
if(!(pyList = PyList_New(0))) { return PyErr_NoMemory(); }
Py_BEGIN_ALLOW_THREADS;
VMMDLL_WinReg_HiveList(self->hVMM, NULL, 0, &cHives);
result =
VMMDLL_WinReg_HiveList(self->hVMM, NULL, 0, &cHives) &&
cHives &&
vmmrust/.vscode/launch.json
Vendored
+28
View File
@@ -0,0 +1,28 @@
{
// Use IntelliSense to learn about possible attributes.
// Hover to view descriptions of existing attributes.
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
"version": "0.2.0",
"configurations": [
{
"name": "VmmRust API BINARY EXAMPLE (Debug)",
"type": "lldb",
"request": "launch",
"cargo": {
"args": ["build", "--manifest-path", "${workspaceRoot}/memprocfs_example/Cargo.toml"]
},
"program": "${workspaceRoot}/memprocfs_example/target/debug/memprocfs_example",
"args": [],
"cwd": "${workspaceRoot}",
},
{
"name": "VmmRust PLUGIN LIBRARY EXAMPLE (Debug)",
"type": "lldb",
"request": "launch",
"preLaunchTask": "build_debug_m_example_plugin",
"program": "${workspaceRoot}/../files/memprocfs",
"args": ["-device", "Z:\\x64\\WIN10-X64-1909-18363-1.core"],
"cwd": "${workspaceRoot}",
}
]
}
vmmrust/.vscode/tasks.json
Vendored
+24
View File
@@ -0,0 +1,24 @@
{
"version": "2.0.0",
"tasks": [
{
"label": "cargo_debug_m_example_plugin",
"type": "shell",
"command": "cargo",
"args": ["build", "--manifest-path", "${workspaceRoot}/m_example_plugin/Cargo.toml"]
},
{
"label": "build_debug_m_example_plugin",
"dependsOn": ["cargo_debug_m_example_plugin"],
"type": "shell",
"windows": {
"command": "copy", // Could be any other shell command
"args": ["${workspaceRoot}\\m_example_plugin\\target\\debug\\m_example_plugin.dll", "${workspaceRoot}\\..\\files\\plugins\\m_vmmrust_plugin.dll"],
},
"linux": {
"command": "cp", // Could be any other shell command
"args": ["-f", "${workspaceRoot}/m_example_plugin/target/debug/libm_example_plugin.so", "${workspaceRoot}/../files/plugins/m_vmmrust_plugin.so", "/y"],
}
}
]
}
vmmrust/m_example_plugin/Cargo.lock
Generated
+111
View File
@@ -0,0 +1,111 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3
[[package]]
name = "cfg-if"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "libloading"
version = "0.7.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
dependencies = [
"cfg-if",
"winapi",
]
[[package]]
name = "m_example_plugin"
version = "5.4.0"
dependencies = [
"memprocfs",
]
[[package]]
name = "memprocfs"
version = "5.4.0"
dependencies = [
"libloading",
"serde",
]
[[package]]
name = "proc-macro2"
version = "1.0.51"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
dependencies = [
"proc-macro2",
]
[[package]]
name = "serde"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "syn"
version = "1.0.109"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]]
name = "unicode-ident"
version = "1.0.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
[[package]]
name = "winapi"
version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
dependencies = [
"winapi-i686-pc-windows-gnu",
"winapi-x86_64-pc-windows-gnu",
]
[[package]]
name = "winapi-i686-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
[[package]]
name = "winapi-x86_64-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
vmmrust/m_example_plugin/Cargo.toml
+20
View File
@@ -0,0 +1,20 @@
[package]
name = "m_example_plugin"
version = "5.4.0"
edition = "2021"
publish = false
[lib]
name = "m_example_plugin"
path = "src/lib.rs"
crate-type = ["cdylib"]
[profile.release]
codegen-units = 1
opt-level = "z"
panic = "abort"
strip = true
lto = true
[dependencies]
memprocfs = { path = "../memprocfs" }
vmmrust/m_example_plugin/src/lib.rs
+265
View File
@@ -0,0 +1,265 @@
// lib.rs - MemProcFS Plugin Example
//
// The example will show up under /rust/example both at the root and per-process.
// The process views are dependent on the process PID and type.
//
// The plugin will not show up in kernel-mode processes.
// The plugin will show the 024 directory for PIDs ending in those numbers.
// The plugin will show the 68 directory for PIDs ending in those numbers.
// The root folder have a readme.txt as a read-only file.
// The sub-folders will have a writeme.txt as a read/write file.
//
// (c) Ulf Frisk, 2023
// Author: Ulf Frisk, [email protected]
// https://github.com/ufrisk/MemProcFS
//
use memprocfs::*;
const PLUGIN_README : &str =
"This is a MemProcFS example plugin for Rust.\n\
--------------------------------------------\n\
Please check the plugin source code for info\n\
Or visit https://github.com/ufrisk/MemProcFS\n";
const PLUGIN_README_024_WRITABLE : &str =
"This is a writable file in the MemProcFS Rust example plugin.\n\
The file should _not_ show up in processes which pid doesn't \n\
end with the numbers 6 or 8. \n";
const PLUGIN_README_68_WRITABLE : &str =
"This is a writable file in the MemProcFS Rust example plugin. \n\
The file should show up in processes which pids ends with 6 or 8.\n";
// User-defined plugin context.
struct PluginContext {
id : u32,
file_024 : Vec<u8>,
file_68 : Vec<u8>,
}
/// MemProcFS plugin main entry point:
///
/// The native VMM library will call this function when the plugin should be
/// initialized. The function should start by making a call to the plugin API
/// initializing the MemProcFS rust sub-system before doing anything else.
#[no_mangle]
pub extern "C" fn InitializeVmmPlugin(native_h : usize, native_reginfo : usize) {
// First line of initialization function:
// Retrieve system information and the plugin init context from native layer.
// Note the generic type T which allows the init function to initialize a
// plugin specific context which will be shared between callbacks.
let (system_info, mut plugin_init_ctx) =
match new_plugin_initialization::<PluginContext>(native_h, native_reginfo) {
Ok(r) => r,
Err(_) => return,
};
// The system_info may be used to check whether the plugin should run or not.
// It's important that this function is fast! General API usage is possibele
// to further check whether the plugin should be run or not, but is discouraged
// due to added overhead. Ideally only the system_info should be used.
// In this example do not allow plugin to run on Windows Vista and older.
if system_info.version_build < 7600 {
return;
}
// Initialize the plugin by setting the custom plugin context and also
// callback functions. Callback functions may be called in multi-threaded
// mode and the custom plugin context will be serialized behind a RwLock to
// avoid race conditions.
// This module is a root module which will show up under /rust/example in
// the MemProcFS virtual file system.
let ctx = PluginContext {
id : 1337,
file_024 : PLUGIN_README_024_WRITABLE.as_bytes().to_vec(),
file_68 : PLUGIN_README_68_WRITABLE.as_bytes().to_vec(),
};
plugin_init_ctx.ctx = Some(ctx);
plugin_init_ctx.is_root_module = true;
plugin_init_ctx.is_process_module = true;
plugin_init_ctx.path_name = String::from("/rust/example");
// Populate the plugin_init_ctx with implemented functions.
// list/read/write is commonly implemented (even if no requirement)
// while notify/visible is more rare and used in special circumstances.
plugin_init_ctx.fn_list = Some(plugin_list_cb);
plugin_init_ctx.fn_read = Some(plugin_read_cb);
plugin_init_ctx.fn_write = Some(plugin_write_cb);
plugin_init_ctx.fn_notify = Some(plugin_notify_cb);
plugin_init_ctx.fn_visible = Some(plugin_visible_cb);
// Register the plugin with MemProcFS. This will consume the context which
// should not be possible to use after this.
let _r = plugin_init_ctx.register();
// Sometimes one may wish to register additional plugins. This is possible.
// Simply call new_plugin_initialization() to retrieve a new
// plugin initialzation context and start anew.
//
// let (system_info, mut plugin_init_ctx) =
// match new_plugin_initialization::<u32>(native_h, native_reginfo) {
// Ok(r) => r,
// Err(_) => return,
// };
// ...
// let _r = plugin_init_ctx.register();
}
// Example: Plugin VFS list Callback:
//
// The list callback should populate the directory that is queried by path.
//
// It is important that the list callback is fast. Any longer running tasks
// should be spawn into a separate thread so that the file system doesn't
// freeze waiting for the list callback to complete processing.
fn plugin_list_cb(ctxp : &VmmPluginContext<PluginContext>, process : Option<VmmProcess>, path : &str, file_list : &VmmPluginFileList) -> ResultEx<()> {
// The user-defined is stored behind a RwLock that may be locked for either read() or write().
// All callbacks may happen in multi-threaded mode so locking is important!
let mut ctx_user = ctxp.ctxlock.write().unwrap();
let mut is_pid_024 = true;
let mut is_pid_68 = true;
if let Some(process) = process {
is_pid_024 = ((process.pid % 10) == 0) || ((process.pid % 10) == 2) || ((process.pid % 10) == 4);
is_pid_68 = ((process.pid % 10) == 6) || ((process.pid % 10) == 8);
}
// root folder:
if path.len() == 0 {
ctx_user.id += 1;
let id_string = ctx_user.id.to_string();
file_list.add_file("readme.txt", PLUGIN_README.len() as u64);
file_list.add_file("numeric_list_counter.txt", id_string.len() as u64);
if is_pid_024 {
file_list.add_directory("024");
}
if is_pid_68 {
file_list.add_directory("68");
}
return Ok(());
}
// 024 folder:
if path.eq_ignore_ascii_case("024") {
file_list.add_file("writeme_024.txt", ctx_user.file_024.len() as u64);
return Ok(());
}
// 68 folder:
if path.eq_ignore_ascii_case("68") {
file_list.add_file("writeme_68.txt", ctx_user.file_68.len() as u64);
return Ok(());
}
return Ok(());
}
// Example: Plugin VFS read Callback:
//
// The read callback should return the read data as a vectorized byte-array.
// If the read is past the file size an empty vector should be returned.
// If the file does not exist an error should be returned.
fn plugin_read_cb(ctxp : &VmmPluginContext<PluginContext>, _process : Option<VmmProcess>, file_name : &str, cb : u32, cb_offset : u64) -> ResultEx<Vec<u8>> {
let ctx_user = ctxp.ctxlock.read().unwrap();
let data_vec;
let data;
// check which file to read:
if file_name.eq_ignore_ascii_case("readme.txt") {
data_vec = Vec::from(PLUGIN_README);
data = &data_vec;
} else if file_name.eq_ignore_ascii_case("numeric_list_counter.txt") {
data_vec = Vec::from(ctx_user.id.to_string());
data = &data_vec;
} else if file_name.eq_ignore_ascii_case("024/writeme_024.txt") {
data = &ctx_user.file_024;
} else if file_name.eq_ignore_ascii_case("68/writeme_68.txt") {
data = &ctx_user.file_68;
} else {
return Err("[err]".into());
}
// read from file:
let file_offset_base = usize::try_from(cb_offset)?;
let file_offset_top = std::cmp::min(data.len(), file_offset_base + usize::try_from(cb)?);
if file_offset_base > data.len() {
return Ok(Vec::new());
}
let r = (&data[file_offset_base..file_offset_top]).to_vec();
return Ok(r);
}
// Example: Plugin VFS write Callback:
//
// The write callback should return success always even if no data is written.
// Errors may be returned when files are missing and in rare error propagation cases.
fn plugin_write_cb(ctxp : &VmmPluginContext<PluginContext>, _process : Option<VmmProcess>, file_name : &str, data : Vec<u8>, cb_offset : u64) -> ResultEx<()> {
let mut ctx_user = ctxp.ctxlock.write().unwrap();
let file_offset_base = usize::try_from(cb_offset)?;
// check which file to write:
if file_name.eq_ignore_ascii_case("024/writeme_024.txt") {
let file_offset_top = std::cmp::min(ctx_user.file_024.len(), file_offset_base + data.len());
let file_copy_len = file_offset_top - file_offset_base;
if (file_offset_base > data.len()) || (file_copy_len == 0) {
return Ok(());
}
for i in 0..file_copy_len {
ctx_user.file_024[file_offset_base + i] = data[i];
}
} else if file_name.eq_ignore_ascii_case("68/writeme_68.txt") {
let file_offset_top = std::cmp::min(ctx_user.file_68.len(), file_offset_base + data.len());
let file_copy_len = file_offset_top - file_offset_base;
if (file_offset_base > data.len()) || (file_copy_len == 0) {
return Ok(());
}
for i in 0..file_copy_len {
ctx_user.file_68[file_offset_base + i] = data[i];
}
} else {
return Err("[err]".into());
}
return Ok(());
}
// Example: Plugin VFS dynamic visibility Callback:
//
// This should almost never be used! It is only used in the cases when it's
// desirable to have dynamic plugin visiblity in select processes.
//
// In this example the plugin is shown in the root and in user-mode processes -
// but it should be hidden in kernel mode processes.
fn plugin_visible_cb(_ctxp : &VmmPluginContext<PluginContext>, process : Option<VmmProcess>) -> ResultEx<bool> {
if process.is_some() {
if let Ok(info) = process.unwrap().info() {
return Ok(info.is_user_mode);
}
}
return Ok(true);
}
// Example: Plugin Notification Callback:
//
// MemProcFS will send notification at some events to subscribers.
// These notifications are stored in constants: PLUGIN_NOTIFY_*
//
// Some times it's desirable to take an action on a notification,
// such as changing plugin visibility when forensic mode is complete,
// or throw away cached data at PLUGIN_NOTIFY_REFRESH_SLOW.
fn plugin_notify_cb(ctxp : &VmmPluginContext<PluginContext>, event_id : u32) -> ResultEx<()> {
// Throw away changes to files if there is a slow (complete) refresh.
// NB! this does only happen on dynamic memory (not on memory dump files).
if event_id == PLUGIN_NOTIFY_REFRESH_SLOW {
let mut ctx_user = ctxp.ctxlock.write().unwrap();
ctx_user.file_024 = PLUGIN_README_024_WRITABLE.as_bytes().to_vec();
ctx_user.file_68 = PLUGIN_README_68_WRITABLE.as_bytes().to_vec();
}
return Ok(());
}
vmmrust/memprocfs/Cargo.lock
Generated
+104
View File
@@ -0,0 +1,104 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3
[[package]]
name = "cfg-if"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "libloading"
version = "0.7.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
dependencies = [
"cfg-if",
"winapi",
]
[[package]]
name = "memprocfs"
version = "5.4.0"
dependencies = [
"libloading",
"serde",
]
[[package]]
name = "proc-macro2"
version = "1.0.51"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
dependencies = [
"proc-macro2",
]
[[package]]
name = "serde"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "syn"
version = "1.0.109"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]]
name = "unicode-ident"
version = "1.0.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
[[package]]
name = "winapi"
version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
dependencies = [
"winapi-i686-pc-windows-gnu",
"winapi-x86_64-pc-windows-gnu",
]
[[package]]
name = "winapi-i686-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
[[package]]
name = "winapi-x86_64-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
vmmrust/memprocfs/Cargo.toml
+19
View File
@@ -0,0 +1,19 @@
[package]
name = "memprocfs"
version = "5.4.0"
edition = "2021"
description = "MemProcFS - Windows Physical Memory Analysis Framwork"
homepage = "https://github.com/ufrisk/MemProcFS"
repository = "https://github.com/ufrisk/MemProcFS"
categories = ["external-ffi-bindings"]
keywords = ["memory", "forensics", "dma", "pcileech", "memprocfs"]
readme = "README.md"
license = "AGPL-3.0-or-later"
[lib]
name = "memprocfs"
path = "src/lib_memprocfs.rs"
[dependencies]
serde = { version = "1.0", features = ["derive"] }
libloading = "0.7.4"
vmmrust/memprocfs/README.md
+92
View File
@@ -0,0 +1,92 @@
# MemProcFS Rust API
The MemProcFS crate contains a wrapper API around the [MemProcFS physical
memory analysis framework](https://github.com/ufrisk/MemProcFS). The native
libray in the form of `vmm.dll` or `vmm.so` must be downloaded or compiled
in order to make use of the memprocfs rust crate.
The aim of the MemProcFS rust crate and rust API is to make MemProcFS usage
as easy and smooth as possible on Rust! Please let me know what you think
or if you have any improvement suggestions!
Physical memory analysis may take place on memory dump files for forensic
purposes. Analysis may also take place on live memory - either captured by
using [PCILeech PCIe DMA devices](https://github.com/ufrisk/pcileech-fpga)
or by using a driver - such as WinPMEM, LiveCloudKd, VMware or similar.
The base of the MemProcFS API is the `Vmm` struct. Once the native vmm
has been initialized it's possible to retrieve processes in the form of
the `VmmProcess` struct. Using the `Vmm` and `VmmProcess` it's
possible to undertake a wide range of actions - such as reading/writing
memory or retrieve various information.
<b>Access the VFS</b> (Virtual File System) via the Rust API to get access
to the full range of built-in and external plugins.
<b>Read and write memory</b> by using the methods `mem_read()`,
`mem_read_ex()`, `mem_write()` of the `Vmm` and `VmmProcess` structs.
<b>Efficiently read and write memory</b> using the `VmmScatterMemory`
struct.
The MemProcFS rust API supports creation of native MemProcFS plugins in
the form of a library `.dll` or `.so` for the more advanced user.
## Example
```Rust
let mut args = Vec::new();
args.push("-printf");
args.push("-device");
args.push("-FPGA");
let vmm = Vmm::new("/home/user/memprocfs/vmm.so", &args)?
if let Ok(process_all) = vmm.process_list() {
for process in &*process_all {
println!("{} : {}", process.pid, process.info()?.name);
}
}
```
## Example projects
Check out the example documentation, both in the form of the [example
project](https://github.com/ufrisk/MemProcFS/tree/master/vmmrust/memprocfs_example)
and the [example MemProcFS plugin](https://github.com/ufrisk/MemProcFS/tree/master/vmmrust/m_example_plugin)
## Project documentation
Check out the project documentation for MemProcFS, LeechCore and pcileech-fpga:
* [MemProcFS](https://github.com/ufrisk/MemProcFS) - [Documentation](https://github.com/ufrisk/MemProcFS/wiki).
* [LeechCore](https://github.com/ufrisk/LeechCore/) - [Documentation](https://github.com/ufrisk/LeechCore/wiki).
* [PCILeech](https://github.com/ufrisk/pcileech) - [Documentation](https://github.com/ufrisk/pcileech/wiki).
* [PCILeech-FPGA](https://github.com/ufrisk/pcileech-fpga).
## License
MemProcFS and its rust API is open source under the [AGPL-3.0](https://github.com/ufrisk/MemProcFS/blob/master/LICENSE) license.
# Support PCILeech/MemProcFS development:
PCILeech and MemProcFS is free and open source!
I put a lot of time and energy into PCILeech and MemProcFS and related research to make this happen. Some aspects of the projects relate to hardware and I put quite some money into my projects and related research. If you think PCILeech and/or MemProcFS are awesome tools and/or if you had a use for them it's now possible to contribute by becoming a sponsor!
If you like what I've created with PCIleech and MemProcFS with regards to DMA, Memory Analysis and Memory Forensics and would like to give something back to support future development please consider becoming a sponsor at: <https://github.com/sponsors/ufrisk>
To all my sponsors, Thank You 💖
## Questions and Comments
Please feel free to contact me!
* Github: <https://github.com/ufrisk/MemProcFS>
* Discord: UlfFrisk#5780
* Discord #pcileech channel at the [Porchetta](https://discord.gg/sEkn3aa) server.
* Twitter: <https://twitter.com/UlfFrisk>
* Email: pcileech@frizk.net
## Get Started!
Check out the `Vmm` documentation and the [example project](https://github.com/ufrisk/MemProcFS/tree/master/vmmrust/memprocfs_example)!
<b>Best wishes with your memory analysis Rust project!</b>
vmmrust/memprocfs/src/lib_memprocfs.rs
+5662
View File
File diff suppressed because it is too large Load Diff
vmmrust/memprocfs_example/Cargo.lock
Generated
+118
View File
@@ -0,0 +1,118 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3
[[package]]
name = "cfg-if"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "libloading"
version = "0.7.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
dependencies = [
"cfg-if",
"winapi",
]
[[package]]
name = "memprocfs"
version = "5.4.0"
dependencies = [
"libloading",
"serde",
]
[[package]]
name = "memprocfs_example"
version = "5.4.0"
dependencies = [
"memprocfs",
"pretty-hex",
]
[[package]]
name = "pretty-hex"
version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c6fa0831dd7cc608c38a5e323422a0077678fa5744aa2be4ad91c4ece8eec8d5"
[[package]]
name = "proc-macro2"
version = "1.0.51"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
dependencies = [
"proc-macro2",
]
[[package]]
name = "serde"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.152"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "syn"
version = "1.0.109"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]]
name = "unicode-ident"
version = "1.0.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
[[package]]
name = "winapi"
version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
dependencies = [
"winapi-i686-pc-windows-gnu",
"winapi-x86_64-pc-windows-gnu",
]
[[package]]
name = "winapi-i686-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
[[package]]
name = "winapi-x86_64-pc-windows-gnu"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

Some files were not shown because too many files have changed in this diff Show More