Classes | |
class | MemoryFactory |
class | IMemory |
struct | LinuxData |
class | MemoryFactoryImpl |
class | MemoryFile |
class | MemoryOsSpecific |
Functions | |
DECLARE_EXCEPTION (MemoryException) | |
Base class for all Memory operations. | |
DECLARE_EXCEPTION_EX (AccessError, memory, MemoryException) | |
DECLARE_EXCEPTION_EX (OutOfBounds, memory, MemoryException) | |
int | LoadNtdllFuncs (void) |
HANDLE | OpenMemAccess (void) |
int | CloseMemAccess (HANDLE hPhysMem) |
int | MapMem (HANDLE hPhysMem, PVOID pBaseAddr, PDWORD pPhysAddr, PDWORD pSize) |
int | UnMapMem (PVOID pBaseAddr) |
static BOOL | setPrivilege (LPCTSTR privilegeName, BOOL enable) |
void | readPhysicalMemoryMap (HANDLE hPhysMem, u8 *buffer, u64 offset, unsigned int length) |
void | readPhysicalMemoryDebugSysctl (u8 *buffer, u64 offset, unsigned int length) |
void | enumSystemFirmwareTables (u8 *buffer, u64 offset, unsigned int length) |
DEFINE_EXCEPTION_EX (AccessErrorImpl, memory, AccessError) | |
DEFINE_EXCEPTION_EX (OutOfBoundsImpl, memory, OutOfBounds) | |
Variables | |
NtOpenSectionPtr | NtOpenSection = NULL |
NtClosePtr | NtClose = NULL |
NtMapViewOfSectionPtr | NtMapViewOfSection = NULL |
NtUnmapViewOfSectionPtr | NtUnmapViewOfSection = NULL |
RtlInitUnicodeStringPtr | RtlInitUnicodeString = NULL |
ZwSystemDebugControlPtr | ZwSystemDebugControl = NULL |
EnumSystemFirmwareTablesPtr | EnumSystemFirmwareTables = NULL |
GetSystemFirmwareTablePtr | GetSystemFirmwareTable = NULL |
u8 * | CBlockBuffer = NULL |
u8 * | EBlockBuffer = NULL |
int memory::CloseMemAccess | ( | HANDLE | hPhysMem | ) |
memory::DECLARE_EXCEPTION | ( | MemoryException | ) |
Base class for all Memory operations.
memory::DECLARE_EXCEPTION_EX | ( | OutOfBounds | , | |
memory | , | |||
MemoryException | ||||
) |
memory::DECLARE_EXCEPTION_EX | ( | AccessError | , | |
memory | , | |||
MemoryException | ||||
) |
memory::DEFINE_EXCEPTION_EX | ( | OutOfBoundsImpl | , | |
memory | , | |||
OutOfBounds | ||||
) |
memory::DEFINE_EXCEPTION_EX | ( | AccessErrorImpl | , | |
memory | , | |||
AccessError | ||||
) |
void memory::enumSystemFirmwareTables | ( | u8 * | buffer, | |
u64 | offset, | |||
unsigned int | length | |||
) |
Definition at line 253 of file Memory_Windows.cpp.
References _, CBlockBuffer, EBlockBuffer, EnumSystemFirmwareTables, and smbios::GetSystemFirmwareTable.
int memory::LoadNtdllFuncs | ( | void | ) |
Definition at line 49 of file Memory_Windows.cpp.
References EnumSystemFirmwareTables, smbios::GetSystemFirmwareTable, NtClose, NtMapViewOfSection, NtOpenSection, NtUnmapViewOfSection, RtlInitUnicodeString, and ZwSystemDebugControl.
int memory::MapMem | ( | HANDLE | hPhysMem, | |
PVOID | pBaseAddr, | |||
PDWORD | pPhysAddr, | |||
PDWORD | pSize | |||
) |
Definition at line 111 of file Memory_Windows.cpp.
References NT_SUCCESS, NtCurrentProcess, NtMapViewOfSection, and ViewShare.
Referenced by readPhysicalMemoryMap().
HANDLE memory::OpenMemAccess | ( | void | ) |
Definition at line 78 of file Memory_Windows.cpp.
References InitializeObjectAttributes, NT_SUCCESS, NtOpenSection, OBJ_CASE_INSENSITIVE, RtlInitUnicodeString, and SECTION_MAP_READ.
void memory::readPhysicalMemoryDebugSysctl | ( | u8 * | buffer, | |
u64 | offset, | |||
unsigned int | length | |||
) |
Definition at line 227 of file Memory_Windows.cpp.
References _, DebugSysReadPhysicalMemory, NT_SUCCESS, and ZwSystemDebugControl.
void memory::readPhysicalMemoryMap | ( | HANDLE | hPhysMem, | |
u8 * | buffer, | |||
u64 | offset, | |||
unsigned int | length | |||
) |
static BOOL memory::setPrivilege | ( | LPCTSTR | privilegeName, | |
BOOL | enable | |||
) | [static] |
Definition at line 146 of file Memory_Windows.cpp.
int memory::UnMapMem | ( | PVOID | pBaseAddr | ) |
Definition at line 132 of file Memory_Windows.cpp.
References NT_SUCCESS, NtCurrentProcess, and NtUnmapViewOfSection.
Referenced by readPhysicalMemoryMap().
u8* CBlockBuffer = NULL |
u8* EBlockBuffer = NULL |
EnumSystemFirmwareTablesPtr EnumSystemFirmwareTables = NULL |
Definition at line 44 of file Memory_Windows.cpp.
Referenced by enumSystemFirmwareTables(), and LoadNtdllFuncs().
GetSystemFirmwareTablePtr GetSystemFirmwareTable = NULL |
Definition at line 45 of file Memory_Windows.cpp.
NtClosePtr NtClose = NULL |
Definition at line 38 of file Memory_Windows.cpp.
Referenced by CloseMemAccess(), and LoadNtdllFuncs().
NtMapViewOfSectionPtr NtMapViewOfSection = NULL |
NtOpenSectionPtr NtOpenSection = NULL |
Definition at line 37 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and OpenMemAccess().
NtUnmapViewOfSectionPtr NtUnmapViewOfSection = NULL |
RtlInitUnicodeStringPtr RtlInitUnicodeString = NULL |
Definition at line 41 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and OpenMemAccess().
ZwSystemDebugControlPtr ZwSystemDebugControl = NULL |
Definition at line 42 of file Memory_Windows.cpp.
Referenced by LoadNtdllFuncs(), and readPhysicalMemoryDebugSysctl().