Struct Win32KernelBuilder

pub struct Win32KernelBuilder<T, TK, VK> { /* private fields */ }

Builder for a Windows Kernel structure.

This function encapsulates the entire setup process for a Windows target and will make sure the user gets a properly initialized object at the end.

This function is a high level abstraction over the individual parts of initialization a Windows target:

• Scanning for the ntoskrnl and retrieving the Win32KernelInfo struct.
• Retrieving the Offsets for the target Windows version.
• Creating a struct which implements VirtualTranslate2 for virtual to physical address translations.
• Optionally wrapping the Connector or the VirtualTranslate2 object into a cached object.
• Initialization of the Kernel structure itself.

Examples

Using the builder with default values:

use memflow::mem::PhysicalMemory;
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .build()
        .unwrap();
}

Using the builder with default cache configurations:

use memflow::mem::PhysicalMemory;
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .build_default_caches()
        .build()
        .unwrap();
}

Customizing the caches:

use memflow::mem::{PhysicalMemory, CachedPhysicalMemory, CachedVirtualTranslate};
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
    .build_page_cache(|connector, arch| {
        CachedPhysicalMemory::builder(connector)
            .arch(arch)
            .build()
            .unwrap()
    })
    .build_vat_cache(|vat, arch| {
        CachedVirtualTranslate::builder(vat)
            .arch(arch)
            .build()
            .unwrap()
    })
    .build()
    .unwrap();
}

Remarks

Manual initialization of the above examples would look like the following:

use memflow::prelude::v1::*;
use memflow_win32::prelude::{
    Win32KernelInfo,
    Win32Offsets,
    Win32Kernel,
    offset_builder_with_kernel_info
};

fn test<T: 'static + PhysicalMemory + Clone>(mut connector: T) {
    // Use the ntoskrnl scanner to find the relevant KernelInfo (start_block, arch, dtb, ntoskrnl, etc)
    let kernel_info = Win32KernelInfo::scanner(connector.forward_mut()).scan().unwrap();
    // Download the corresponding pdb from the default symbol store
    let offsets = offset_builder_with_kernel_info(&kernel_info).build().unwrap();

    // Create a struct for doing virtual to physical memory translations
    let vat = DirectTranslate::new();

    // Create a Page Cache layer with default values
    let mut connector_cached = CachedPhysicalMemory::builder(connector)
        .arch(kernel_info.os_info.arch)
        .build()
        .unwrap();

    // Create a Tlb Cache layer with default values
    let vat_cached = CachedVirtualTranslate::builder(vat)
        .arch(kernel_info.os_info.arch)
        .build()
        .unwrap();

    // Initialize the final Kernel object
    let _kernel = Win32Kernel::new(connector_cached, vat_cached, offsets, kernel_info);
}

Implementations

impl<T> Win32KernelBuilder<T, T, DirectTranslate>

where T: PhysicalMemory,

pub fn new(connector: T) -> Win32KernelBuilder<T, T, DirectTranslate>

impl<'a, T, TK, VK> Win32KernelBuilder<T, TK, VK>

where T: PhysicalMemory, TK: 'static + PhysicalMemory + Clone, VK: 'static + VirtualTranslate2 + Clone,

pub fn build(self) -> Result<Win32Kernel<TK, VK>>

pub fn arch(self, arch: ArchitectureIdent) -> Self

pub fn kernel_hint(self, kernel_hint: Address) -> Self

pub fn dtb(self, dtb: Address) -> Self

pub fn symbol_store(self, symbol_store: SymbolStore) -> Self

Configures the symbol store to be used when constructing the Kernel. This will override the default symbol store that is being used if no other setting is configured.

Examples

use memflow::mem::PhysicalMemory;
use memflow_win32::prelude::{Win32Kernel, SymbolStore};

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .symbol_store(SymbolStore::new().no_cache())
        .build()
        .unwrap();
}

pub fn no_symbol_store(self) -> Self

Disables the symbol store when constructing the Kernel. By default a default symbol store will be used when constructing a kernel. This option allows the user to disable the symbol store alltogether and fall back to the built-in offsets table.

Examples

use memflow::mem::PhysicalMemory;
use memflow_win32::win32::Win32Kernel;
use memflow_win32::offsets::SymbolStore;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .no_symbol_store()
        .build()
        .unwrap();
}

pub fn build_default_caches( self, ) -> Win32KernelBuilder<T, CachedPhysicalMemory<'a, T, DefaultCacheValidator>, CachedVirtualTranslate<DirectTranslate, DefaultCacheValidator>>

Creates the Kernel structure with default caching enabled.

If this option is specified, the Kernel structure is generated with a (page level cache)[../index.html] with default settings. On top of the page level cache a vat cache will be setupped.

Examples

use memflow::mem::PhysicalMemory;
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .build_default_caches()
        .build()
        .unwrap();
}

pub fn build_page_cache<TKN, F: FnOnce(T, ArchitectureIdent) -> TKN + 'static>( self, func: F, ) -> Win32KernelBuilder<T, TKN, VK>

where TKN: PhysicalMemory,

Creates a Kernel structure by constructing the page cache from the given closure.

This function accepts a FnOnce closure that is being evaluated after the ntoskrnl has been found.

Examples

use memflow::mem::{PhysicalMemory, CachedPhysicalMemory};
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .build_page_cache(|connector, arch| {
            CachedPhysicalMemory::builder(connector)
                .arch(arch)
                .build()
                .unwrap()
        })
        .build()
        .unwrap();
}

pub fn build_vat_cache<VKN, F: FnOnce(DirectTranslate, ArchitectureIdent) -> VKN + 'static>( self, func: F, ) -> Win32KernelBuilder<T, TK, VKN>

where VKN: VirtualTranslate2,

Creates a Kernel structure by constructing the vat cache from the given closure.

This function accepts a FnOnce closure that is being evaluated after the ntoskrnl has been found.

Examples

use memflow::mem::{PhysicalMemory, CachedVirtualTranslate};
use memflow_win32::win32::Win32Kernel;

fn test<T: 'static + PhysicalMemory + Clone>(connector: T) {
    let _kernel = Win32Kernel::builder(connector)
        .build_vat_cache(|vat, arch| {
            CachedVirtualTranslate::builder(vat)
                .arch(arch)
                .build()
                .unwrap()
        })
        .build()
        .unwrap();
}