1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
use goblin::Object;
use memflow::connector::fileio::{CloneFile, FileIoMemory};
use memflow::mem::MemoryMap;
use memflow::prelude::v1::*;
use std::fs::File;
use std::io::Read;
#[cfg_attr(feature = "plugins", connector(name = "kcore"))]
pub fn create_connector(args: &ConnectorArgs) -> Result<FileIoMemory<CloneFile>> {
let mut mem = File::open(
args.target
.as_ref()
.map(|v| v.as_ref())
.unwrap_or("/proc/kcore"),
)
.map_err(|_| Error(ErrorOrigin::Connector, ErrorKind::UnableToReadFile))?;
let mut head = vec![0; size::mb(2)];
mem.read(&mut head).ok();
let mut map = MemoryMap::new();
if let Ok(Object::Elf(elf)) = Object::parse(&head) {
for (b, s, r) in elf
.program_headers
.iter()
.filter(|h| h.p_paddr != u64::MAX)
.filter(|h| h.p_vaddr != 0)
.map(|h| {
(
Address::from(h.p_paddr),
h.p_filesz as umem,
Address::from(h.p_offset),
)
})
{
map.push_remap(b, s, r);
}
FileIoMemory::try_with_reader(mem.into(), map)
} else {
Err(Error(ErrorOrigin::Connector, ErrorKind::InvalidExeFile))
}
}