pub fn check_fops_entry<P: PhysicalMemoryProvider>(
reader: &ObjectReader<P>,
fops_addr: u64,
kernel_start: u64,
kernel_end: u64,
) -> Vec<HookedFop>Expand description
Read function pointers from a file_operations struct and classify each.
For each known field in [FOP_FIELDS], reads the pointer value. Non-null
pointers are checked against the kernel text range.