Skip to main content

scan_proc_fops

Function scan_proc_fops 

Source
pub fn scan_proc_fops<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
) -> Result<Vec<FopsHookInfo>>
Expand description

Scan key /proc entries for file_operations hooks.

Looks up proc_root (the root /proc directory entry), walks the proc_dir_entry tree via subdir/next, and for each entry with a non-null proc_fops pointer, reads the file_operations struct and checks function pointers against the kernel text range.

Returns Ok(Vec::new()) if required symbols (proc_root, _stext, _etext) are missing.