Struct kdmp_parser::KernelDumpParser

pub struct KernelDumpParser<'reader> { /* private fields */ }

A kernel dump parser that gives access to the physical memory space stored in the dump. It also offers virtual to physical memory translation as well as a virtual read facility.

Implementations

impl<'reader> KernelDumpParser<'reader>

pub fn with_reader( reader: impl Reader + 'reader ) -> Result<Self, KdmpParserError>

Create an instance from a file path. This memory maps the file and parses it.

pub fn new<P>(dump_path: &P) -> Result<Self, KdmpParserError>

where P: AsRef<Path>,

pub fn physmem(&self) -> impl ExactSizeIterator<Item = (Gpa, u64)> + '_

pub fn dump_type(&self) -> DumpType

What kind of dump is it?

pub fn exception_record(&self) -> &ExceptionRecord64

Get the exception record.

pub fn context_record(&self) -> &Context

Get the context record.

pub fn phys_read(&self, gpa: Gpa, buffer: &mut [u8]) -> Option<usize>

Read physical memory starting at gpa into a buffer.

pub fn phys_read_exact(&self, gpa: Gpa, buffer: &mut [u8]) -> Option<()>

Read an exact amount of physical memory starting at gpa into a buffer.

pub fn phys_read8(&self, gpa: Gpa) -> Option<u64>

Read a u64 in physical memory at gpa.

pub fn virt_read(&self, gva: Gva, buffer: &mut [u8]) -> Option<usize>

Read virtual memory starting at gva into a buffer.

pub fn virt_read_exact(&self, gva: Gva, buffer: &mut [u8]) -> Option<()>

Read virtual memory starting at gva

pub fn virt_translate(&self, gva: Gva) -> Option<Gpa>

Translate a Gva into a Gpa.

Trait Implementations

impl<'reader> Debug for KernelDumpParser<'reader>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.