Struct KernelDumpParser

Source
pub struct KernelDumpParser { /* private fields */ }
Expand description

A kernel dump parser that gives access to the physical memory space stored in the dump. It also offers virtual to physical memory translation as well as a virtual read facility.

Implementations§

Source§

impl KernelDumpParser

Source

pub fn with_reader(reader: impl Reader + 'static) -> Result<Self>

Create an instance from a file path. This memory maps the file and parses it.

Source

pub fn new(dump_path: impl AsRef<Path>) -> Result<Self>

Source

pub fn physmem(&self) -> impl ExactSizeIterator<Item = (Gpa, u64)> + '_

Physical memory map that maps page aligned Gpa to offset where the content of the page can be found. The offset is relevant with the associated reader.

Source

pub fn kernel_modules( &self, ) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_

Kernel modules loaded when the dump was taken.

Source

pub fn user_modules( &self, ) -> impl ExactSizeIterator<Item = (&Range<Gva>, &str)> + '_

User modules loaded when the dump was taken.

Source

pub fn dump_type(&self) -> DumpType

What kind of dump is it?

Source

pub fn headers(&self) -> &Header64

Get the dump headers.

Source

pub fn exception_record(&self) -> &ExceptionRecord64

Get the exception record.

Source

pub fn context_record(&self) -> &Context

Get the context record.

Source

pub fn phys_translate(&self, gpa: Gpa) -> Result<u64>

Translate a Gpa into a file offset of where the content of the page resides in.

Source

pub fn phys_read(&self, gpa: Gpa, buf: &mut [u8]) -> Result<usize>

Read physical memory starting at gpa into a buffer.

Source

pub fn phys_read_exact(&self, gpa: Gpa, buf: &mut [u8]) -> Result<()>

Read an exact amount of physical memory starting at gpa into a buffer.

Source

pub fn phys_read_struct<T>(&self, gpa: Gpa) -> Result<T>

Read a T from physical memory.

Source

pub fn virt_translate(&self, gva: Gva) -> Result<Gpa>

Translate a Gva into a Gpa.

Source

pub fn virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<usize>

Read virtual memory starting at gva into a buffer.

Source

pub fn try_virt_read(&self, gva: Gva, buf: &mut [u8]) -> Result<Option<usize>>

Try to read virtual memory starting at gva into a buffer. If a memory translation error occurs, it’ll return None instead of an error.

Source

pub fn virt_read_exact(&self, gva: Gva, buf: &mut [u8]) -> Result<()>

Read an exact amount of virtual memory starting at gva.

Source

pub fn try_virt_read_exact( &self, gva: Gva, buf: &mut [u8], ) -> Result<Option<()>>

Try to read an exact amount of virtual memory starting at gva. If a memory translation error occurs, it’ll return None instead of an error.

Source

pub fn virt_read_struct<T>(&self, gva: Gva) -> Result<T>

Read a T from virtual memory.

Source

pub fn try_virt_read_struct<T>(&self, gva: Gva) -> Result<Option<T>>

Try to read a T from virtual memory. If a memory translation error occurs, it’ll return None instead of an error.

Source

pub fn seek(&self, pos: SeekFrom) -> Result<u64>

Source

pub fn read(&self, buf: &mut [u8]) -> Result<usize>

Trait Implementations§

Source§

impl Debug for KernelDumpParser

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.