ufrisk/MemProcFS
1
0
Fork 0
mirror of https://github.com/ufrisk/MemProcFS.git synced 2026-10-12 02:23:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 5.17.2

Browse Source
This commit is contained in:
Ulf Frisk
2026-02-24 19:39:58 +01:00
parent 8304ca9ab9
commit d4e4b93e6d
23 changed files with 165 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3
View File
@@ -253,3 +253,6 @@ v5.8
* New refresh options in the API.
* New optional logging callback in the API.
* Support for non-ascii characters in file paths.
Latest:
* Bug fixes.
m_vmemd/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 17
#define VERSION_REVISION 1
#define VERSION_BUILD 230
#define VERSION_REVISION 2
#define VERSION_BUILD 231
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
memprocfs/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 17
#define VERSION_REVISION 1
#define VERSION_BUILD 230
#define VERSION_REVISION 2
#define VERSION_BUILD 231
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/modules/m_fc_handle.c
+1 -1
View File
@@ -29,7 +29,7 @@ VOID MFcHandle_FcLogCSV(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In
CHAR szPoolTag[5] = { 0 };
CHAR uszBufferDevName[MAX_PATH] = { 0 };
DWORD i;
if(pProcess && VmmMap_GetHandle(H, pProcess, &pObHandleMap, TRUE)) {
if(pProcess && VmmMap_GetHandle(H, pProcess, &pObHandleMap, VMM_HANDLE_FLAG_FULLTEXT)) {
for(i = 0; i < pObHandleMap->cMap; i++) {
pe = pObHandleMap->pMap + i;
// type&pool tag:
vmm/modules/m_misc_eventlog.c
+1 -1
View File
@@ -42,7 +42,7 @@ PVMM_PROCESS MEventlog_GetProcess(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT
while((pObProcess = VmmProcessGetNext(H, pObProcess, 0))) {
if(CharUtil_StrEquals(pObProcess->szName, "svchost.exe", 0)) {
c = 0;
if(VmmMap_GetHandle(H, pObProcess, &pObHandleMap, TRUE)) {
if(VmmMap_GetHandle(H, pObProcess, &pObHandleMap, VMM_HANDLE_FLAG_FULLTEXT)) {
for(i = 0; i < pObHandleMap->cMap; i++) {
pe = &pObHandleMap->pMap[i];
if(CharUtil_StrEndsWith(pe->uszText, ".evtx", FALSE)) {
vmm/modules/m_proc_handle.c
+4 -4
View File
@@ -78,7 +78,7 @@ NTSTATUS MHandle_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Out_
NTSTATUS nt = VMMDLL_STATUS_FILE_INVALID;
PVMMOB_MAP_HANDLE pObHandleMap = NULL;
PVMM_MAP_HANDLEENTRY pe;
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, TRUE)) {
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, VMM_HANDLE_FLAG_FULLTEXT)) {
if(!_stricmp(ctxP->uszPath, "handles.txt")) {
nt = Util_VfsLineFixed_Read(
H, (UTIL_VFSLINEFIXED_PFN_CB)MHandle_ReadLine_CB, NULL, MHANDLE_LINELENGTH, MHANDLE_LINEHEADER,
@@ -111,13 +111,13 @@ BOOL MHandle_List(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Inout_ P
PVMM_MAP_HANDLEENTRY pe;
PVMMOB_MAP_HANDLE pObHandleMap = NULL;
if(!ctxP->uszPath[0]) {
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, FALSE)) {
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, VMM_HANDLE_FLAG_CORE)) {
VMMDLL_VfsList_AddFile(pFileList, "handles.txt", UTIL_VFSLINEFIXED_LINECOUNT(H, pObHandleMap->cMap) * MHANDLE_LINELENGTH, NULL);
VMMDLL_VfsList_AddDirectory(pFileList, "by-id", NULL);
}
goto finish;
}
if(!VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, TRUE)) { return TRUE; }
if(!VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, VMM_HANDLE_FLAG_FULLTEXT)) { return TRUE; }
if(!_stricmp(ctxP->uszPath, "by-id")) {
for(i = 0; i < pObHandleMap->cMap; i++) {
pe = pObHandleMap->pMap + i;
@@ -153,7 +153,7 @@ VOID MHandle_FcLogJSON(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_
pd->dwVersion = VMMDLL_FORENSIC_JSONDATA_VERSION;
pd->dwPID = pProcess->dwPID;
pd->szjType = "handle";
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, TRUE)) {
if(VmmMap_GetHandle(H, ctxP->pProcess, &pObHandleMap, VMM_HANDLE_FLAG_FULLTEXT)) {
for(i = 0; i < pObHandleMap->cMap; i++) {
pe = pObHandleMap->pMap + i;
// get type:
vmm/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 17
#define VERSION_REVISION 1
#define VERSION_BUILD 230
#define VERSION_REVISION 2
#define VERSION_BUILD 231
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/vmm.c
+35 -4
View File
@@ -2566,7 +2566,7 @@ BOOL VmmScatter_Read(_In_ PVMMOB_SCATTER hS, _In_ QWORD va, _In_ DWORD cb, _Out_
* -- return
*/
_Success_(return)
BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_ PVMM_PROCESS pProcess)
BOOL VmmScatter_ExecuteInternal(_In_ PVMMOB_SCATTER hS, _In_opt_ PVMM_PROCESS pProcess, _In_opt_ PVOID pCustomContext, _In_opt_ VMM_SCATTER_CUSTOM_EXECUTE_SCATTER_PFN pfnCustomScatter)
{
SIZE_T cPagesToAlloc, cbBuffer, cbBufferAlloc, oBufferAllocMEM = 0;
DWORD i;
@@ -2599,6 +2599,8 @@ BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_ PVMM_PROCESS pProcess)
// read scatter
if(pProcess) {
VmmReadScatterVirtual(hS->H, pProcess, ppMEMs, hS->cPageTotal, hS->flags);
} else if(pfnCustomScatter) {
pfnCustomScatter(hS->H, pCustomContext, ppMEMs, hS->cPageTotal, hS->flags);
} else {
VmmReadScatterPhysical(hS->H, ppMEMs, hS->cPageTotal, hS->flags);
}
@@ -2614,6 +2616,35 @@ BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_ PVMM_PROCESS pProcess)
return TRUE;
}
/*
* Retrieve the memory ranges previously populated with calls to the
* VmmScatter_Prepare* functions.
* -- hS
* -- pProcess = the process to read from, NULL = physical memory.
* -- return
*/
_Success_(return)
BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_opt_ PVMM_PROCESS pProcess)
{
return VmmScatter_ExecuteInternal(hS, pProcess, NULL, NULL);
}
/*
* Retrieve the memory ranges previously populated with calls to the
* VmmScatter_Prepare* functions.
* Use a custom user-settable backend scatter function to retrieve memory.
* -- hS
* -- pCustomContext
* -- pfnCustomScatter
* -- return
*/
_Success_(return)
BOOL VmmScatter_ExecuteEx(_In_ PVMMOB_SCATTER hS, _In_opt_ PVOID pCustomContext, _In_ VMM_SCATTER_CUSTOM_EXECUTE_SCATTER_PFN pfnCustomScatter)
{
if(!pfnCustomScatter) { return FALSE; }
return VmmScatter_ExecuteInternal(hS, NULL, pCustomContext, pfnCustomScatter);
}
VOID VmmScatter_CleanupCB(PVMMOB_SCATTER hS)
{
PVMM_SCATTER_RANGE pRangeRd, pRangeRdNext;
@@ -3322,13 +3353,13 @@ BOOL VmmMap_GetThreadCallstack(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _I
* -- H
* -- pProcess
* -- ppObHandleMap
* -- fExtendedText
* -- flags = optional flag: VMM_HANDLE_FLAG_*
* -- return
*/
_Success_(return)
BOOL VmmMap_GetHandle(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _Out_ PVMMOB_MAP_HANDLE *ppObHandleMap, _In_ BOOL fExtendedText)
BOOL VmmMap_GetHandle(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _Out_ PVMMOB_MAP_HANDLE *ppObHandleMap, _In_ DWORD flags)
{
if(!VmmWinHandle_Initialize(H, pProcess, fExtendedText)) { return FALSE; }
if(!VmmWinHandle_Initialize(H, pProcess, flags)) { return FALSE; }
*ppObHandleMap = Ob_INCREF(pProcess->Map.pObHandle);
return *ppObHandleMap != NULL;
}
vmm/vmm.h
+23 -4
View File
@@ -310,6 +310,10 @@ typedef struct tdVMM_MAP_VADEXENTRY {
#define VMM_MODULE_FLAG_DEBUGINFO 1
#define VMM_MODULE_FLAG_VERSIONINFO 2
#define VMM_HANDLE_FLAG_CORE 0
#define VMM_HANDLE_FLAG_BASIC 1
#define VMM_HANDLE_FLAG_FULLTEXT 2
typedef enum tdVMM_MODULE_TP {
VMM_MODULE_TP_NORMAL = 0,
VMM_MODULE_TP_DATA = 1,
@@ -878,7 +882,7 @@ typedef struct tdVMMOB_MAP_HANDLE {
OB ObHdr;
PBYTE pbMultiText; // UTF-8 multi-string.
DWORD cbMultiText;
BOOL fInfoExFile;
DWORD flags; // VMM_HANDLE_FLAG_*
DWORD cMap; // # map entries.
VMM_MAP_HANDLEENTRY pMap[]; // map entries.
} VMMOB_MAP_HANDLE, *PVMMOB_MAP_HANDLE;
@@ -2271,7 +2275,22 @@ BOOL VmmScatter_Prepare5(_In_ PVMMOB_SCATTER hS, _In_opt_ POB_MAP pm, _In_ DWORD
* -- return
*/
_Success_(return)
BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_ PVMM_PROCESS pProcess);
BOOL VmmScatter_Execute(_In_ PVMMOB_SCATTER hS, _In_opt_ PVMM_PROCESS pProcess);
// Custom scatter execute function type definition. See VmmScatter_ExecuteEx() for usage.
typedef VOID(*VMM_SCATTER_CUSTOM_EXECUTE_SCATTER_PFN)(_In_ VMM_HANDLE H, _In_ PVOID ctx, _Inout_updates_(cpMEMs) PPMEM_SCATTER ppMEMs, _In_ DWORD cpMEMs, _In_ QWORD flags);
/*
* Retrieve the memory ranges previously populated with calls to the
* VmmScatter_Prepare* functions.
* Use a custom user-settable backend scatter function to retrieve memory.
* -- hS
* -- pCustomContext
* -- pfnCustomScatter
* -- return
*/
_Success_(return)
BOOL VmmScatter_ExecuteEx(_In_ PVMMOB_SCATTER hS, _In_opt_ PVOID pCustomContext, _In_ VMM_SCATTER_CUSTOM_EXECUTE_SCATTER_PFN pfnCustomScatter);
/*
* Read out memory in previously populated ranges. This function should only be
@@ -2920,11 +2939,11 @@ BOOL VmmMap_GetThreadCallstack(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _I
* -- H
* -- pProcess
* -- ppObHandleMap
* -- fExtendedText
* -- flags = optional flag: VMM_HANDLE_FLAG_*
* -- return
*/
_Success_(return)
BOOL VmmMap_GetHandle(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _Out_ PVMMOB_MAP_HANDLE *ppObHandleMap, _In_ BOOL fExtendedText);
BOOL VmmMap_GetHandle(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _Out_ PVMMOB_MAP_HANDLE *ppObHandleMap, _In_ DWORD flags);
/*
* Retrieve a single PVMM_MAP_HANDLEENTRY for a given HandleMap and HandleID.
vmm/vmmdll.c
+2 -2
View File
@@ -407,7 +407,7 @@ BOOL VMMDLL_ConfigSet_Impl(_In_ VMM_HANDLE H, _In_ ULONG64 fOption, _In_ ULONG64
PluginManager_Notify(H, VMMDLL_PLUGIN_NOTIFY_VERBOSITYCHANGE, NULL, 0);
return TRUE;
case VMMDLL_OPT_CONFIG_IS_PAGING_ENABLED:
H->vmm.flags = (H->vmm.flags & ~VMM_FLAG_NOPAGING) | (qwValue ? 0 : 1);
H->vmm.flags = (H->vmm.flags & ~VMM_FLAG_NOPAGING) | (qwValue ? 0 : VMM_FLAG_NOPAGING);
return TRUE;
case VMMDLL_OPT_CONFIG_DEBUG:
VMMDLL_ConfigSet_Impl_Debug(H, fOption, qwValue);
@@ -1788,7 +1788,7 @@ BOOL VMMDLL_Map_GetHandle_Impl(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _Out_ PVMMDL
// 1: fetch map [and populate strings]:
if(!(psmOb = ObStrMap_New(H, 0))) { goto fail; }
if(!(pObProcess = VmmProcessGet(H, dwPID))) { goto fail; }
if(!VmmMap_GetHandle(H, pObProcess, &pObMapSrc, TRUE)) { goto fail; }
if(!VmmMap_GetHandle(H, pObProcess, &pObMapSrc, VMM_HANDLE_FLAG_FULLTEXT)) { goto fail; }
for(i = 0; i < pObMapSrc->cMap; i++) {
peSrc = pObMapSrc->pMap + i;
pOT = VmmWin_ObjectTypeGet(H, (BYTE)peSrc->iType);
vmm/vmmwin.c
+24 -9
View File
@@ -2078,7 +2078,7 @@ typedef struct tdVMMWINHANDLE_REGHELPER {
} VMMWINHANDLE_REGHELPER, *PVMMWINHANDLE_REGHELPER;
/*
* Helper function for VmmWinHandle_InitializeText_DoWork that fetches registry
* Helper function for VmmWinHandle_InitializeFullText_DoWork that fetches registry
* names provided that the underlying _CM_KEY_CONTROL_BLOCK is prefetched.
* -- H
* -- pSystemProcess
@@ -2172,7 +2172,7 @@ VOID VmmWinHandle_InitializeText_DoWork_FileSizeHelper(_In_ VMM_HANDLE H, _In_ P
}
}
VOID VmmWinHandle_InitializeText_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pSystemProcess, _In_ PVMMOB_MAP_HANDLE pHandleMap)
VOID VmmWinHandle_InitializeExtended_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pSystemProcess, _In_ PVMMOB_MAP_HANDLE pHandleMap, _In_ DWORD flags)
{
BOOL f, f32 = H->vmm.f32, fThreadingEnabled;
PVMM_OFFSET po = &H->vmm.offset;
@@ -2336,6 +2336,10 @@ VOID VmmWinHandle_InitializeText_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pSy
}
}
}
if(flags == VMM_HANDLE_FLAG_BASIC) {
pHandleMap->flags = VMM_HANDLE_FLAG_BASIC;
goto done;
}
// registry key retrieve names & file device object parse
VmmCachePrefetchPages3(H, pSystemProcess, psObDevRegPrefetch, 0x90, 0);
for(i = 0; i < pHandleMap->cMap; i++) {
@@ -2437,6 +2441,8 @@ VOID VmmWinHandle_InitializeText_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pSy
pe->uszText = (LPSTR)pHandleMap->pbMultiText;
}
}
pHandleMap->flags = VMM_HANDLE_FLAG_FULLTEXT;
done:
fail:
Ob_DECREF(psObPrefetch);
Ob_DECREF(psObDevRegPrefetch);
@@ -2507,13 +2513,13 @@ BOOL VmmWinHandle_InitializeCore(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess)
}
_Success_(return)
BOOL VmmWinHandle_InitializeText(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess)
BOOL VmmWinHandle_InitializeText(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ DWORD flags)
{
PVMM_PROCESS pObSystemProcess;
if(pProcess->Map.pObHandle->pbMultiText) { return TRUE; }
EnterCriticalSection(&pProcess->LockUpdate);
if(!pProcess->Map.pObHandle->pbMultiText && (pObSystemProcess = VmmProcessGet(H, 4))) {
VmmWinHandle_InitializeText_DoWork(H, pObSystemProcess, pProcess->Map.pObHandle);
VmmWinHandle_InitializeExtended_DoWork(H, pObSystemProcess, pProcess->Map.pObHandle, flags);
Ob_DECREF(pObSystemProcess);
}
LeaveCriticalSection(&pProcess->LockUpdate);
@@ -2525,14 +2531,23 @@ BOOL VmmWinHandle_InitializeText(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess)
* extra time to initialize.
* -- H
* -- pProcess
* -- fExtendedText = also fetch extended info such as handle paths/names.
* -- flags = optional flag: VMM_HANDLE_FLAG_*
* -- return
*/
_Success_(return)
BOOL VmmWinHandle_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ BOOL fExtendedText)
BOOL VmmWinHandle_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ DWORD flags)
{
if(pProcess->Map.pObHandle && (!fExtendedText || pProcess->Map.pObHandle->pbMultiText)) { return TRUE; }
return VmmWinHandle_InitializeCore(H, pProcess) && (!fExtendedText || VmmWinHandle_InitializeText(H, pProcess));
if(!pProcess->Map.pObHandle) {
VmmWinHandle_InitializeCore(H, pProcess);
if(!pProcess->Map.pObHandle) { return FALSE; }
}
if((flags == VMM_HANDLE_FLAG_FULLTEXT) && (pProcess->Map.pObHandle->flags < VMM_HANDLE_FLAG_FULLTEXT)) {
if(!VmmWinHandle_InitializeText(H, pProcess, VMM_HANDLE_FLAG_FULLTEXT)) { return FALSE; }
}
if((flags == VMM_HANDLE_FLAG_BASIC) && (pProcess->Map.pObHandle->flags < VMM_HANDLE_FLAG_BASIC)) {
if(!VmmWinHandle_InitializeText(H, pProcess, VMM_HANDLE_FLAG_BASIC)) { return FALSE; }
}
return (pProcess->Map.pObHandle->flags >= flags);
}
@@ -3975,7 +3990,7 @@ POB_SET VmmWinProcess_Enumerate_FindNoLinkProcesses(_In_ VMM_HANDLE H)
if(!(psOb = ObSet_New(H))) { goto fail; }
if(!(pObSystemProcess = VmmProcessGet(H, 4))) { goto fail; }
if(!VmmWin_ObjectTypeGet(H, 2) || !(tpProcess = H->vmm.ObjectTypeTable.tpProcess)) { goto fail; }
if(!VmmMap_GetHandle(H, pObSystemProcess, &pObHandleMap, FALSE)) { goto fail; }
if(!VmmMap_GetHandle(H, pObSystemProcess, &pObHandleMap, VMM_HANDLE_FLAG_CORE)) { goto fail; }
// 2: Prefetch object headers
for(i = 0; i < pObHandleMap->cMap; i++) {
ObSet_Push_PageAlign(psOb, pObHandleMap->pMap[i].vaObject - cbHdr, cbHdr);
vmm/vmmwin.h
+2 -2
View File
@@ -117,11 +117,11 @@ BOOL VmmWinToken_Initialize(
* extra time to initialize.
* -- H
* -- pProcess
* -- fExtendedText = also fetch extended info such as handle paths/names.
* -- flags = optional flag: VMM_HANDLE_FLAG_*
* -- return
*/
_Success_(return)
BOOL VmmWinHandle_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ BOOL fExtendedText);
BOOL VmmWinHandle_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ DWORD flags);
/*
* Retrieve a pointer to a VMMWIN_OBJECT_TYPE if possible. Initialization of the
vmm/vmmwinobj.c
+52 -35
View File
@@ -502,7 +502,7 @@ VOID VmmWinObjFile_GetProcessAddressCandidates(_In_ VMM_HANDLE H, _In_ POB_VMMWI
PVMMOB_MAP_HANDLE pmObHandle = NULL;
if(fHandles) {
// handle map -> file objects
if(VmmMap_GetHandle(H, pProcess, &pmObHandle, TRUE)) {
if(VmmMap_GetHandle(H, pProcess, &pmObHandle, VMM_HANDLE_FLAG_BASIC)) {
for(i = 0, iMax = pmObHandle->cMap; i < iMax; i++) {
if((pmObHandle->pMap[i].dwPoolTag & 0x00ffffff) == 'liF') {
va = pmObHandle->pMap[i].vaObject;
@@ -778,7 +778,7 @@ VOID VmmWinObj_GetProcessAssociated_DoWork(_In_ VMM_HANDLE H, _In_ POB_VMMWINOBJ
if(!(pcVaToPid = ObCounter_New(H, 0))) { return; }
// 1: add process object handles to map:
while((pObProcess = VmmProcessGetNext(H, pObProcess, 0))) {
if(VmmMap_GetHandle(H, pObProcess, &pObHandleMap, FALSE)) {
if(VmmMap_GetHandle(H, pObProcess, &pObHandleMap, VMM_HANDLE_FLAG_CORE)) {
for(i = 0; i < pObHandleMap->cMap; i++) {
ObCounter_Set(pcVaToPid, pObHandleMap->pMap[i].vaObject, pObProcess->dwPID);
}
@@ -889,6 +889,30 @@ QWORD VmmWinObjFile_ReadSubsectionAndSharedCache_GetVaSharedCache(_In_ VMM_HANDL
return f ? (va + (iPte << 12)) : 0;
}
DWORD VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPush(_In_reads_(cpMEMs) PPMEM_SCATTER ppMEMsIn, _Inout_updates_(cpMEMs) PPMEM_SCATTER ppMEMsOut, _In_ DWORD cpMEMs)
{
PMEM_SCATTER pMEM;
DWORD i, cMEMs = 0;
for(i = 0; i < cpMEMs; i++) {
if(!ppMEMsIn[i]->f && (ppMEMsIn[i]->qwA != (QWORD)-1)) {
pMEM = ppMEMsIn[i];
ppMEMsOut[cMEMs++] = pMEM;
MEM_SCATTER_STACK_PUSH(pMEM, pMEM->qwA);
}
}
return cMEMs;
}
VOID VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPop(_Inout_updates_(cpMEMs) PPMEM_SCATTER ppMEMs, _In_ DWORD cpMEMs)
{
DWORD i;
PMEM_SCATTER pMEM;
for(i = 0; i < cpMEMs; i++) {
pMEM = ppMEMs[i];
pMEM->qwA = MEM_SCATTER_STACK_POP(pMEM);
}
}
/*
* Read data from a single _FILE_OBJECT _SUBSECTION and/or a _SHARED_CACHE_MAP.
* Function does not support reading from image files currently.
@@ -902,51 +926,36 @@ QWORD VmmWinObjFile_ReadSubsectionAndSharedCache_GetVaSharedCache(_In_ VMM_HANDL
VOID VmmWinObjFile_ReadSubsectionAndSharedCacheScatter(_In_ VMM_HANDLE H, _In_ POB_VMMWINOBJ_FILE pFile, _Inout_updates_(cpMEMsFile) PPMEM_SCATTER ppMEMsFile, _In_ DWORD cpMEMsFile, _In_ QWORD fVmmRead, _In_ VMMWINOBJ_FILE_TP tp)
{
PMEM_SCATTER pMEM;
PPMEM_SCATTER pMEMs = NULL;
PPMEM_SCATTER ppMEMs = NULL;
QWORD iPte;
DWORD i, iSS, cMEMs;
PVMMWINOBJ_FILE_SUBSECTION pSS = NULL;
POB_VMMWINOBJ_CONTROL_AREA pCA = NULL;
// sanity check & init:
// 0: Sanity check & init:
if(tp == VMMWINOBJ_FILE_TP_DEFAULT) { return; }
pMEMs = LocalAlloc(0, cpMEMsFile * sizeof(PMEM_SCATTER));
if(!pMEMs) { return; }
ppMEMs = LocalAlloc(0, cpMEMsFile * sizeof(PMEM_SCATTER));
if(!ppMEMs) { return; }
// 1: Read from _SHARED_CACHE_MAP
if((tp & VMMWINOBJ_FILE_TP_CACHE) && pFile->pCache) {
cMEMs = 0;
for(i = 0; i < cpMEMsFile; i++) {
pMEM = ppMEMsFile[i];
if(!pMEM->f && (pMEM->qwA != (QWORD)-1)) {
MEM_SCATTER_STACK_PUSH(pMEM, pMEM->qwA);
pMEMs[cMEMs++] = pMEM;
}
}
cMEMs = VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPush(ppMEMsFile, ppMEMs, cpMEMsFile);
if(!cMEMs) { goto cleanup; }
for(i = 0; i < cMEMs; i++) {
pMEM = pMEMs[i];
pMEM = ppMEMs[i];
iPte = pMEM->qwA >> 12;
pMEM->qwA = VmmWinObjFile_ReadSubsectionAndSharedCache_GetVaSharedCache(H, PVMM_PROCESS_SYSTEM, pFile, iPte, fVmmRead);
}
VmmReadScatterVirtual(H, PVMM_PROCESS_SYSTEM, pMEMs, cMEMs, fVmmRead);
for(i = 0; i < cMEMs; i++) {
pMEM = pMEMs[i];
pMEM->qwA = MEM_SCATTER_STACK_POP(pMEM);
}
VmmReadScatterVirtual(H, PVMM_PROCESS_SYSTEM, ppMEMs, cMEMs, fVmmRead);
VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPop(ppMEMs, cMEMs);
}
// 2: Read from _DATA
if((tp & VMMWINOBJ_FILE_TP_DATA) && pFile->pData && pFile->pData->cSUBSECTION) {
cMEMs = 0;
for(i = 0; i < cpMEMsFile; i++) {
pMEM = ppMEMsFile[i];
if(!pMEM->f && (pMEM->qwA != (QWORD)-1)) {
MEM_SCATTER_STACK_PUSH(pMEM, pMEM->qwA);
pMEMs[cMEMs++] = pMEM;
}
}
cMEMs = VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPush(ppMEMsFile, ppMEMs, cpMEMsFile);
if(!cMEMs) { goto cleanup; }
pCA = pFile->pData;
for(i = 0; i < cMEMs; i++) {
pMEM = pMEMs[i];
pMEM = ppMEMs[i];
iPte = pMEM->qwA >> 12;
if(pMEM->f) { continue; }
// move to correct subsection:
@@ -960,14 +969,22 @@ VOID VmmWinObjFile_ReadSubsectionAndSharedCacheScatter(_In_ VMM_HANDLE H, _In_ P
// fetch pte:
pMEM->qwA = VmmWinObjFile_ReadSubsectionAndSharedCache_GetPteSubsection(H, PVMM_PROCESS_SYSTEM, pSS->vaSubsectionBase, (iPte - pSS->dwStartingSector), fVmmRead);
}
VmmReadScatterVirtual(H, PVMM_PROCESS_SYSTEM, pMEMs, cMEMs, fVmmRead | VMM_FLAG_ALTADDR_VA_PTE);
for(i = 0; i < cMEMs; i++) {
pMEM = pMEMs[i];
pMEM->qwA = MEM_SCATTER_STACK_POP(pMEM);
}
VmmReadScatterVirtual(H, PVMM_PROCESS_SYSTEM, ppMEMs, cMEMs, fVmmRead | VMM_FLAG_ALTADDR_VA_PTE);
VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPop(ppMEMs, cMEMs);
}
// 3: Read from _IMAGE
/*
if((tp & VMMWINOBJ_FILE_TP_IMAGE) && pFile->pImage && pFile->pImage->cSUBSECTION) {
cMEMs = VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPush(ppMEMsFile, ppMEMs, cpMEMsFile);
if(!cMEMs) { goto cleanup; }
VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_Image(H, pFile, ppMEMs, cMEMs, fVmmRead);
VmmWinObjFile_ReadSubsectionAndSharedCacheScatter_MemPop(ppMEMs, cMEMs);
}
*/
cleanup:
LocalFree(pMEMs);
LocalFree(ppMEMs);
}
/*
vmm/vmmwinpool.c
+1 -1
View File
@@ -1093,7 +1093,7 @@ BOOL VmmWinPool_AllPool7_RangeInit(_In_ VMM_HANDLE H, _In_ PVMMWINPOOL7_CTX ctx)
PVMMOB_MAP_OBJECT pObObj = NULL;
if(!(psvaOb = ObSet_New(H))) { goto fail; }
// 1: fetch sorted handle & object addresses (which are residing inside the pool):
if(VmmMap_GetHandle(H, ctx->pSystemProcess, &pObHnd, FALSE)) {
if(VmmMap_GetHandle(H, ctx->pSystemProcess, &pObHnd, VMM_HANDLE_FLAG_CORE)) {
for(i = 0; i < pObHnd->cMap; i++) {
ObSet_Push(psvaOb, pObHnd->pMap[i].vaObject & ~0x1fffff); // 2MB align
}
vmm/vmmwinreg.c
+1 -1
View File
@@ -974,7 +974,7 @@ VOID VmmWinReg_EnumHive_FileHandle(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess
PVMM_MAP_HANDLEENTRY peHandle;
PVMMOB_MAP_HANDLE pObHandleMap = NULL;
POB_REGISTRY_HIVE pObHive = NULL;
if(VmmMap_GetHandle(H, pProcessSystem, &pObHandleMap, FALSE)) {
if(VmmMap_GetHandle(H, pProcessSystem, &pObHandleMap, VMM_HANDLE_FLAG_CORE)) {
while((pObHive = ObMap_GetNext(pmHive, pObHive))) {
if(pObHive->File.dwHandle) {
if((peHandle = VmmMap_GetHandleEntry(H, pObHandleMap, pObHive->File.dwHandle))) {
vmm/vmmwinthread.c
+1 -1
View File
@@ -98,7 +98,7 @@ VOID VmmWinThread_Initialize_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProces
// 0: 1st run optimization: pre-populate prefetch candidates from handle table.
// i.e. speed up linked list _ETHREAD walking.
if(!ObContainer_Exists(pProcess->pObPersistent->pObCMapThreadPrefetch)) {
if(VmmMap_GetHandle(H, pProcess, &pObHandleMap, FALSE)) {
if(VmmMap_GetHandle(H, pProcess, &pObHandleMap, VMM_HANDLE_FLAG_CORE)) {
psObPrefetch = ObSet_New(H);
for(i = 0; i < pObHandleMap->cMap; i++) {
peHandle = pObHandleMap->pMap + i;
vmmpyc/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 17
#define VERSION_REVISION 1
#define VERSION_BUILD 230
#define VERSION_REVISION 2
#define VERSION_BUILD 231
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmmrust/leechcore_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "leechcore_example"
version = "5.17.1"
version = "5.17.2"
edition = "2021"
publish = false
vmmrust/m_example_plugin/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "m_example_plugin"
version = "5.17.1"
version = "5.17.2"
edition = "2021"
publish = false
vmmrust/memprocfs/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs"
version = "5.17.1"
version = "5.17.2"
edition = "2021"
description = "MemProcFS - Physical Memory Analysis Framework"
documentation = "https://docs.rs/memprocfs"
vmmrust/memprocfs_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs_example"
version = "5.17.1"
version = "5.17.2"
edition = "2021"
publish = false
vmmsharp/vmmsharp/Properties/AssemblyInfo.cs
+2 -2
View File
@@ -32,5 +32,5 @@ using System.Runtime.Versioning;
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("5.17.1.230")]
[assembly: AssemblyFileVersion("5.17.1.230")]
[assembly: AssemblyVersion("5.17.2.231")]
[assembly: AssemblyFileVersion("5.17.2.231")]
vmmsharp/vmmsharp/vmmsharp.csproj
+1 -1
View File
@@ -109,7 +109,7 @@
<None Include="logo.png" Pack="true" Visible="true" PackagePath="" />
</ItemGroup>
<PropertyGroup>
<Version>5.17.1</Version>
<Version>5.17.2</Version>
<RepositoryUrl>https://github.com/ufrisk/MemProcFS</RepositoryUrl>
<RepositoryType>git</RepositoryType>
<PackageLicenseFile>LICENSE</PackageLicenseFile>