Struct Reader 

pub struct Reader<'parser> { /* private fields */ }

A reader lets you translate & read virtual memory from a dump file.

Implementations

impl<'parser> Reader<'parser>

pub fn new(parser: &'parser KernelDumpParser) -> Self

pub fn with_dtb(parser: &'parser KernelDumpParser, dtb: Gpa) -> Self

pub fn translate(&self, gva: Gva) -> Result<Translation>

Translate a Gva into a Gpa.

pub fn read_exact(&self, gva: Gva, buf: &mut [u8]) -> Result<()>

Read the exact amount of bytes asked by the user & return a Error::PartialRead error if it couldn’t read as much as wanted.

pub fn read(&self, gva: Gva, buf: &mut [u8]) -> Result<usize>

Read the virtual memory starting at gva into buf. If it cannot read as much as asked by the user because the dump file is missing a physical memory page or because one of the PXE is non present, the function doesn’t error out and return the amount of bytes that was successfully read.

pub fn read_struct<T: Pod>(&self, gva: Gva) -> Result<T>

Read a T from virtual memory.

pub fn try_translate(&self, gva: Gva) -> Result<Option<Translation>>

Try to translate gva into Gpa.

pub fn try_read_exact(&self, gva: Gva, buf: &mut [u8]) -> Result<Option<()>>

Try to read the exact amount of bytes asked by the user.

pub fn try_read_struct<T: Pod>(&self, gva: Gva) -> Result<Option<T>>

Try to read a T from virtual memory.