physpatch 0.2.1

PhysPatch performs physical memory scans and patches of the entire Windows kernel
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

use clap::Parser;

#[derive(Parser, Debug)]
#[clap(author, version, about)]
pub struct Cli {
    /// Pattern to search for, in raw HEX string format and with '??' in place
    /// of wildcard bytes
    #[clap(last = true)]
    pub pattern: String,

    /// Data to write to all memory locations matched by the pattern, formatted
    /// as a HEX string
    ///
    /// If not specified or empty, the matches will only be printed and no further
    /// action will be performed
    #[clap(short, long, default_value = None)]
    pub patch: Option<String>,

    /// Name of the QEMU Virtual Machine to perform the scan on
    ///
    /// If not specified, the first instance found is utilized
    #[clap(short, long, default_value = None)]
    pub target: Option<String>,
}