Struct LinuxOs

pub struct LinuxOs<Driver>
where
    Driver: VmiDriver,
{ /* private fields */ }

VMI operations for the Linux operating system.

LinuxOs provides methods and utilities for introspecting a Linux-based virtual machine. It encapsulates Linux-specific knowledge and operations, allowing for high-level interactions with the guest OS structures and processes.

Implementations

impl<Driver> LinuxOs<Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new(profile: &Profile<'_>) -> Result<Self, VmiError>

Creates a new LinuxOs instance.

pub fn find_banner( vmi: &VmiCore<Driver>, registers: &<Driver::Architecture as Architecture>::Registers, ) -> Result<Option<String>, VmiError>

Locates and retrieves the Linux banner string from kernel memory.

The banner string typically contains kernel version information and build details.

pub fn kaslr_offset(vmi: VmiState<'_, Driver, Self>) -> Result<u64, VmiError>

Returns the KASLR (Kernel Address Space Layout Randomization) offset.

This value represents the randomized offset applied to the kernel’s base address when KASLR is enabled.

pub fn per_cpu(vmi: VmiState<'_, Driver, Self>) -> Va

Retrieves the per-CPU base address for the current CPU.

Linux maintains per-CPU data structures, and this method returns the base address for accessing such data on the current processor.

pub fn linked_list<'a>( vmi: VmiState<'a, Driver, Self>, list_head: Va, offset: u64, ) -> Result<impl Iterator<Item = Result<Va, VmiError>> + 'a, VmiError>

Returns an iterator over a doubly-linked list of LIST_ENTRY structures.

This method is used to iterate over a doubly-linked list of LIST_ENTRY structures in memory. It returns an iterator that yields the virtual addresses of each LIST_ENTRY structure in the list.

pub fn construct_path( _vmi: VmiState<'_, Driver, Self>, path: &LinuxPath<'_, Driver>, root: &LinuxPath<'_, Driver>, ) -> Result<String, VmiError>

Constructs a file path string from path components in the kernel.

This method walks the dentry chain to build a complete path, handling mount points and filesystem boundaries appropriately. Both the path and root arguments should be pointers to struct path objects.

Trait Implementations

impl<Driver> VmiOs<Driver> for LinuxOs<Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

type Process<'a> = LinuxTaskStruct<'a, Driver>

The process type.

type Thread<'a> = LinuxThread

The thread type.

type Image<'a> = LinuxImage

The image type.

type Module<'a> = LinuxModule

The kernel module type.

type Region<'a> = LinuxVmAreaStruct<'a, Driver>

The memory region type.

type Mapped<'a> = LinuxMapped

The memory mapped region type.

fn kernel_image_base(_vmi: VmiState<'_, Driver, Self>) -> Result<Va, VmiError>

Retrieves the base address of the kernel image.

fn kernel_information_string( _vmi: VmiState<'_, Driver, Self>, ) -> Result<String, VmiError>

Retrieves an implementation-specific string containing kernel information.

fn kpti_enabled(_vmi: VmiState<'_, Driver, Self>) -> Result<bool, VmiError>

Checks if Kernel Page Table Isolation (KPTI) is enabled.

fn modules( _vmi: VmiState<'_, Driver, Self>, ) -> Result<impl Iterator<Item = Result<Self::Module<'_>, VmiError>> + '_, VmiError>

Returns an iterator over the loaded kernel modules.

fn processes( vmi: VmiState<'_, Driver, Self>, ) -> Result<impl Iterator<Item = Result<Self::Process<'_>, VmiError>> + '_, VmiError>

Returns an iterator over the processes.

fn process( vmi: VmiState<'_, Driver, Self>, process: ProcessObject, ) -> Result<Self::Process<'_>, VmiError>

Returns the process corresponding to the given process object.

fn current_process( vmi: VmiState<'_, Driver, Self>, ) -> Result<Self::Process<'_>, VmiError>

Returns the currently executing process.

fn system_process( vmi: VmiState<'_, Driver, Self>, ) -> Result<Self::Process<'_>, VmiError>

Returns the system process object.

fn thread( _vmi: VmiState<'_, Driver, Self>, _thread: ThreadObject, ) -> Result<Self::Thread<'_>, VmiError>

Returns the thread corresponding to the given thread object.

fn current_thread( _vmi: VmiState<'_, Driver, Self>, ) -> Result<Self::Thread<'_>, VmiError>

Returns the currently executing thread.

fn image( _vmi: VmiState<'_, Driver, Self>, _image_base: Va, ) -> Result<Self::Image<'_>, VmiError>

Returns the image corresponding to the given base address.

fn module( _vmi: VmiState<'_, Driver, Self>, _module: Va, ) -> Result<Self::Module<'_>, VmiError>

Returns the kernel module corresponding to the given base address.

fn region( vmi: VmiState<'_, Driver, Self>, region: Va, ) -> Result<Self::Region<'_>, VmiError>

Returns the memory region corresponding to the given address.

fn syscall_argument( vmi: VmiState<'_, Driver, Self>, index: u64, ) -> Result<u64, VmiError>

Retrieves a specific syscall argument according to the system call ABI.

fn function_argument( vmi: VmiState<'_, Driver, Self>, index: u64, ) -> Result<u64, VmiError>

Retrieves a specific function argument according to the calling convention of the operating system.

fn function_return_value( vmi: VmiState<'_, Driver, Self>, ) -> Result<u64, VmiError>

Retrieves the return value of a function.

fn last_error(_vmi: VmiState<'_, Driver, Self>) -> Result<Option<u32>, VmiError>

Retrieves the last error value.