Classes | |
class | MemoryFactory |
class | IMemory |
struct | LinuxData |
class | MemoryFactoryImpl |
class | MemoryFile |
class | MemoryOsSpecific |
Functions | |
DECLARE_EXCEPTION (MemoryException) | |
Base class for all Memory operations. | |
DECLARE_EXCEPTION_EX (AccessError, memory, MemoryException) | |
DECLARE_EXCEPTION_EX (OutOfBounds, memory, MemoryException) | |
static void | condOpenFd (struct LinuxData *data) |
static void | closeFd (struct LinuxData *data) |
int | LoadNtdllFuncs (void) |
HANDLE | OpenMemAccess (void) |
int | CloseMemAccess (HANDLE hPhysMem) |
int | MapMem (HANDLE hPhysMem, PVOID pBaseAddr, PDWORD pPhysAddr, PDWORD pSize) |
int | UnMapMem (PVOID pBaseAddr) |
static BOOL | setPrivilege (LPCTSTR privilegeName, BOOL enable) |
void | readPhysicalMemoryMap (HANDLE hPhysMem, u8 *buffer, u64 offset, unsigned int length) |
void | readPhysicalMemoryDebugSysctl (u8 *buffer, u64 offset, unsigned int length) |
void | enumSystemFirmwareTables (u8 *buffer, u64 offset, unsigned int length) |
DEFINE_EXCEPTION_EX (AccessErrorImpl, memory, AccessError) | |
DEFINE_EXCEPTION_EX (OutOfBoundsImpl, memory, OutOfBounds) | |
Variables | |
NtOpenSectionPtr | NtOpenSection = NULL |
NtClosePtr | NtClose = NULL |
NtMapViewOfSectionPtr | NtMapViewOfSection = NULL |
NtUnmapViewOfSectionPtr | NtUnmapViewOfSection = NULL |
RtlInitUnicodeStringPtr | RtlInitUnicodeString = NULL |
ZwSystemDebugControlPtr | ZwSystemDebugControl = NULL |
EnumSystemFirmwareTablesPtr | EnumSystemFirmwareTables = NULL |
GetSystemFirmwareTablePtr | GetSystemFirmwareTable = NULL |
u8 * | CBlockBuffer = NULL |
u8 * | EBlockBuffer = NULL |
int | reopenHint = 1 |
static void memory::closeFd | ( | struct LinuxData * | data | ) | [static] |
Definition at line 66 of file Memory_Linux.cpp.
References LinuxData::fd, LinuxData::lastMappedOffset, LinuxData::lastMapping, and LinuxData::mappingSize.
Referenced by MemoryOsSpecific::fillBuffer(), MemoryOsSpecific::putByte(), and MemoryOsSpecific::~MemoryOsSpecific().
int memory::CloseMemAccess | ( | HANDLE | hPhysMem | ) |
static void memory::condOpenFd | ( | struct LinuxData * | data | ) | [static] |
Definition at line 48 of file Memory_Linux.cpp.
References _, LinuxData::fd, LinuxData::filename, LinuxData::lastMappedOffset, and LinuxData::lastMapping.
Referenced by MemoryOsSpecific::fillBuffer(), and MemoryOsSpecific::putByte().
memory::DECLARE_EXCEPTION | ( | MemoryException | ) |
Base class for all Memory operations.
memory::DECLARE_EXCEPTION_EX | ( | OutOfBounds | , | |
memory | , | |||
MemoryException | ||||
) |
memory::DECLARE_EXCEPTION_EX | ( | AccessError | , | |
memory | , | |||
MemoryException | ||||
) |
memory::DEFINE_EXCEPTION_EX | ( | OutOfBoundsImpl | , | |
memory | , | |||
OutOfBounds | ||||
) |
memory::DEFINE_EXCEPTION_EX | ( | AccessErrorImpl | , | |
memory | , | |||
AccessError | ||||
) |
void memory::enumSystemFirmwareTables | ( | u8 * | buffer, | |
u64 | offset, | |||
unsigned int | length | |||
) |
Definition at line 254 of file Memory_Windows.cpp.
References _, CBlockBuffer, EBlockBuffer, EnumSystemFirmwareTables, and smbios::GetSystemFirmwareTable.
int memory::LoadNtdllFuncs | ( | void | ) |
Definition at line 50 of file Memory_Windows.cpp.
References EnumSystemFirmwareTables, smbios::GetSystemFirmwareTable, NtClose, NtMapViewOfSection, NtOpenSection, NtUnmapViewOfSection, RtlInitUnicodeString, and ZwSystemDebugControl.
int memory::MapMem | ( | HANDLE | hPhysMem, | |
PVOID | pBaseAddr, | |||
PDWORD | pPhysAddr, | |||
PDWORD | pSize | |||
) |
Definition at line 112 of file Memory_Windows.cpp.
References NT_SUCCESS, NtCurrentProcess, NtMapViewOfSection, and ViewShare.
Referenced by readPhysicalMemoryMap().
HANDLE memory::OpenMemAccess | ( | void | ) |
Definition at line 79 of file Memory_Windows.cpp.
References InitializeObjectAttributes, NT_SUCCESS, NtOpenSection, OBJ_CASE_INSENSITIVE, RtlInitUnicodeString, and SECTION_MAP_READ.
void memory::readPhysicalMemoryDebugSysctl | ( | u8 * | buffer, | |
u64 | offset, | |||
unsigned int | length | |||
) |
Definition at line 228 of file Memory_Windows.cpp.
References _, MEM_STRUCT::Addr, DebugSysReadPhysicalMemory, NT_SUCCESS, MEM_STRUCT::NumBytes, MEM_STRUCT::pBuf, and ZwSystemDebugControl.
void memory::readPhysicalMemoryMap | ( | HANDLE | hPhysMem, | |
u8 * | buffer, | |||
u64 | offset, | |||
unsigned int | length | |||
) |
static BOOL memory::setPrivilege | ( | LPCTSTR | privilegeName, | |
BOOL | enable | |||
) | [static] |
Definition at line 147 of file Memory_Windows.cpp.
int memory::UnMapMem | ( | PVOID | pBaseAddr | ) |
Definition at line 133 of file Memory_Windows.cpp.
References NT_SUCCESS, NtCurrentProcess, and NtUnmapViewOfSection.
Referenced by readPhysicalMemoryMap().
u8* CBlockBuffer = NULL |
u8* EBlockBuffer = NULL |
EnumSystemFirmwareTablesPtr EnumSystemFirmwareTables = NULL |
Definition at line 44 of file Memory_Windows.cpp.
Referenced by enumSystemFirmwareTables(), and LoadNtdllFuncs().
GetSystemFirmwareTablePtr GetSystemFirmwareTable = NULL |
Definition at line 45 of file Memory_Windows.cpp.
NtClosePtr NtClose = NULL |
Definition at line 38 of file Memory_Windows.cpp.
Referenced by CloseMemAccess(), and LoadNtdllFuncs().
NtMapViewOfSectionPtr NtMapViewOfSection = NULL |
NtOpenSectionPtr NtOpenSection = NULL |
Definition at line 37 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and OpenMemAccess().
NtUnmapViewOfSectionPtr NtUnmapViewOfSection = NULL |
int reopenHint = 1 |
Definition at line 48 of file Memory_Windows.cpp.
RtlInitUnicodeStringPtr RtlInitUnicodeString = NULL |
Definition at line 41 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and OpenMemAccess().
ZwSystemDebugControlPtr ZwSystemDebugControl = NULL |
Definition at line 42 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and readPhysicalMemoryDebugSysctl().