pub struct KernelDumpParser { /* private fields */ }
Expand description
A kernel dump parser that gives access to the physical memory space stored in the dump. It also offers virtual to physical memory translation as well as a virtual read facility.
Implementations§
Source§impl KernelDumpParser
impl KernelDumpParser
Sourcepub fn with_reader(reader: impl Reader + 'static) -> Result<Self>
pub fn with_reader(reader: impl Reader + 'static) -> Result<Self>
Create an instance from a file path. This memory maps the file and parses it.
pub fn new(dump_path: impl AsRef<Path>) -> Result<Self>
Sourcepub fn physmem(&self) -> impl ExactSizeIterator<Item = (Gpa, u64)> + '_
pub fn physmem(&self) -> impl ExactSizeIterator<Item = (Gpa, u64)> + '_
Physical memory map that maps page aligned Gpa
to offset
where the
content of the page can be found. The offset is relevant with the
associated reader
.
Sourcepub fn kernel_modules(
&self,
) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_
pub fn kernel_modules( &self, ) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_
Kernel modules loaded when the dump was taken.
Sourcepub fn user_modules(
&self,
) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_
pub fn user_modules( &self, ) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_
User modules loaded when the dump was taken.
Sourcepub fn exception_record(&self) -> &ExceptionRecord64
pub fn exception_record(&self) -> &ExceptionRecord64
Get the exception record.
Sourcepub fn context_record(&self) -> &Context
pub fn context_record(&self) -> &Context
Get the context record.
Sourcepub fn phys_translate(&self, gpa: Gpa) -> Result<u64>
pub fn phys_translate(&self, gpa: Gpa) -> Result<u64>
Translate a Gpa
into a file offset of where the content of the page
resides in.
Sourcepub fn phys_read(&self, gpa: Gpa, buf: &mut [u8]) -> Result<usize>
pub fn phys_read(&self, gpa: Gpa, buf: &mut [u8]) -> Result<usize>
Read physical memory starting at gpa
into a buffer
.
Sourcepub fn phys_read_exact(&self, gpa: Gpa, buf: &mut [u8]) -> Result<()>
pub fn phys_read_exact(&self, gpa: Gpa, buf: &mut [u8]) -> Result<()>
Read an exact amount of physical memory starting at gpa
into a
buffer
.
Sourcepub fn phys_read_struct<T>(&self, gpa: Gpa) -> Result<T>
pub fn phys_read_struct<T>(&self, gpa: Gpa) -> Result<T>
Read a T
from physical memory.
Sourcepub fn virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<usize>
pub fn virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<usize>
Read virtual memory starting at gva
into a buffer
.
Sourcepub fn try_virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<Option<usize>>
pub fn try_virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<Option<usize>>
Try to read virtual memory starting at gva
into a buffer
. If a
memory translation error occurs, it’ll return None
instead of an
error.
Sourcepub fn virt_read_exact(&self, gva: Gva, buf: &mut [u8]) -> Result<()>
pub fn virt_read_exact(&self, gva: Gva, buf: &mut [u8]) -> Result<()>
Read an exact amount of virtual memory starting at gva
.
Sourcepub fn try_virt_read_exact(
&self,
gva: Gva,
buf: &mut [u8],
) -> Result<Option<()>>
pub fn try_virt_read_exact( &self, gva: Gva, buf: &mut [u8], ) -> Result<Option<()>>
Try to read an exact amount of virtual memory starting at gva
. If a
memory translation error occurs, it’ll return None
instead of an
error.
Sourcepub fn virt_read_struct<T>(&self, gva: Gva) -> Result<T>
pub fn virt_read_struct<T>(&self, gva: Gva) -> Result<T>
Read a T
from virtual memory.
Sourcepub fn try_virt_read_struct<T>(&self, gva: Gva) -> Result<Option<T>>
pub fn try_virt_read_struct<T>(&self, gva: Gva) -> Result<Option<T>>
Try to read a T
from virtual memory. If a memory translation error
occurs, it’ll return None
instead of an error.