Skip to main content

check_fops_entry

Function check_fops_entry 

Source
pub fn check_fops_entry<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
    fops_addr: u64,
    kernel_start: u64,
    kernel_end: u64,
) -> Vec<HookedFop>
Expand description

Read function pointers from a file_operations struct and classify each.

For each known field in [FOP_FIELDS], reads the pointer value. Non-null pointers are checked against the kernel text range.