mquire 1.2.7

Memory forensics and analysis tool for querying Linux kernel memory dumps using SQL
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

//
// Copyright (c) 2025-present, Trail of Bits, Inc.
// All rights reserved.
//
// This source code is licensed in accordance with the terms specified in
// the LICENSE file found in the root directory of this source tree.
//

use crate::memory::{error::Result, primitives::PhysicalAddress, readable::Readable};

use std::fs::File;

#[cfg(unix)]
use std::os::unix::fs::FileExt;

#[cfg(windows)]
use std::os::windows::fs::FileExt;

/// Provides a convenient interface for reading from a Readable instance
pub struct ReadableFile<'a> {
    /// The Readable instance
    file: &'a mut File,
}

impl<'a> ReadableFile<'a> {
    /// Creates a new ReadableFile instance
    pub fn new(file: &'a mut File) -> Self {
        Self { file }
    }
}

impl<'a> Readable for ReadableFile<'a> {
    /// Reads data from the given physical address
    #[cfg(unix)]
    fn read(&self, buffer: &mut [u8], physical_address: PhysicalAddress) -> Result<usize> {
        self.file
            .read_at(buffer, physical_address.into())
            .map_err(|error| error.into())
    }

    /// Reads data from the given physical address
    #[cfg(windows)]
    fn read(&self, buffer: &mut [u8], physical_address: PhysicalAddress) -> Result<usize> {
        self.file
            .seek_read(buffer, physical_address.into())
            .map_err(|error| error.into())
    }

    /// Returns the size of the memory backing store
    fn len(&self) -> Result<u64> {
        Ok(self.file.metadata()?.len())
    }
}