memory Namespace Reference

Classes
class	MemoryFactory
class	IMemory
struct	LinuxData
class	MemoryFactoryImpl
class	MemoryFile
class	MemoryOsSpecific
Functions
	DECLARE_EXCEPTION (MemoryException)
	Base class for all Memory operations.
	DECLARE_EXCEPTION_EX (AccessError, memory, MemoryException)
	DECLARE_EXCEPTION_EX (OutOfBounds, memory, MemoryException)
static void	condOpenFd (struct LinuxData *data)
static void	closeFd (struct LinuxData *data)
int	LoadNtdllFuncs (void)
HANDLE	OpenMemAccess (void)
int	CloseMemAccess (HANDLE hPhysMem)
int	MapMem (HANDLE hPhysMem, PVOID pBaseAddr, PDWORD pPhysAddr, PDWORD pSize)
int	UnMapMem (PVOID pBaseAddr)
static BOOL	setPrivilege (LPCTSTR privilegeName, BOOL enable)
void	readPhysicalMemoryMap (HANDLE hPhysMem, u8 *buffer, u64 offset, unsigned int length)
void	readPhysicalMemoryDebugSysctl (u8 *buffer, u64 offset, unsigned int length)
void	enumSystemFirmwareTables (u8 *buffer, u64 offset, unsigned int length)
	DEFINE_EXCEPTION_EX (AccessErrorImpl, memory, AccessError)
	DEFINE_EXCEPTION_EX (OutOfBoundsImpl, memory, OutOfBounds)
Variables
NtOpenSectionPtr	NtOpenSection = NULL
NtClosePtr	NtClose = NULL
NtMapViewOfSectionPtr	NtMapViewOfSection = NULL
NtUnmapViewOfSectionPtr	NtUnmapViewOfSection = NULL
RtlInitUnicodeStringPtr	RtlInitUnicodeString = NULL
ZwSystemDebugControlPtr	ZwSystemDebugControl = NULL
EnumSystemFirmwareTablesPtr	EnumSystemFirmwareTables = NULL
GetSystemFirmwareTablePtr	GetSystemFirmwareTable = NULL
u8 *	CBlockBuffer = NULL
u8 *	EBlockBuffer = NULL
int	reopenHint = 1

---

Function Documentation

static void memory::closeFd

(

struct LinuxData *

data

)

[static]

Definition at line 67 of file Memory_Linux.cpp.

References LinuxData::fd, LinuxData::lastMappedOffset, LinuxData::lastMapping, and LinuxData::mappingSize.

Referenced by MemoryOsSpecific::fillBuffer(), MemoryOsSpecific::putByte(), and MemoryOsSpecific::~MemoryOsSpecific().

int memory::CloseMemAccess

(

HANDLE

hPhysMem

)

Definition at line 98 of file Memory_Windows.cpp.

References NT_SUCCESS, and NtClose.

static void memory::condOpenFd

(

struct LinuxData *

data

)

[static]

Definition at line 49 of file Memory_Linux.cpp.

References _, LinuxData::fd, LinuxData::filename, LinuxData::lastMappedOffset, and LinuxData::lastMapping.

Referenced by MemoryOsSpecific::fillBuffer(), and MemoryOsSpecific::putByte().

memory::DECLARE_EXCEPTION

(

MemoryException

)

Base class for all Memory operations.

memory::DECLARE_EXCEPTION_EX	(	AccessError	,
		memory	,
		MemoryException
	)

memory::DECLARE_EXCEPTION_EX	(	OutOfBounds	,
		memory	,
		MemoryException
	)

memory::DEFINE_EXCEPTION_EX	(	OutOfBoundsImpl	,
		memory	,
		OutOfBounds
	)

memory::DEFINE_EXCEPTION_EX	(	AccessErrorImpl	,
		memory	,
		AccessError
	)

void memory::enumSystemFirmwareTables	(	u8 *	buffer,
		u64	offset,
		unsigned int	length
	)

Definition at line 254 of file Memory_Windows.cpp.

References _, CBlockBuffer, EBlockBuffer, EnumSystemFirmwareTables, and GetSystemFirmwareTable.

int memory::LoadNtdllFuncs

(

void

)

Definition at line 50 of file Memory_Windows.cpp.

References EnumSystemFirmwareTables, GetSystemFirmwareTable, NtClose, NtMapViewOfSection, NtOpenSection, NtUnmapViewOfSection, RtlInitUnicodeString, and cmos::ZwSystemDebugControl.

int memory::MapMem	(	HANDLE	hPhysMem,
		PVOID	pBaseAddr,
		PDWORD	pPhysAddr,
		PDWORD	pSize
	)

Definition at line 112 of file Memory_Windows.cpp.

References NT_SUCCESS, NtCurrentProcess, NtMapViewOfSection, and ViewShare.

Referenced by readPhysicalMemoryMap().

HANDLE memory::OpenMemAccess

(

void

)

Definition at line 79 of file Memory_Windows.cpp.

References InitializeObjectAttributes, NT_SUCCESS, NtOpenSection, OBJ_CASE_INSENSITIVE, RtlInitUnicodeString, and SECTION_MAP_READ.

void memory::readPhysicalMemoryDebugSysctl	(	u8 *	buffer,
		u64	offset,
		unsigned int	length
	)

Definition at line 228 of file Memory_Windows.cpp.

References _, MEM_STRUCT::Addr, DebugSysReadPhysicalMemory, NT_SUCCESS, MEM_STRUCT::NumBytes, MEM_STRUCT::pBuf, and cmos::ZwSystemDebugControl.

void memory::readPhysicalMemoryMap	(	HANDLE	hPhysMem,
		u8 *	buffer,
		u64	offset,
		unsigned int	length
	)

Definition at line 172 of file Memory_Windows.cpp.

References _, MapMem(), and UnMapMem().

Here is the call graph for this function:

static BOOL memory::setPrivilege	(	LPCTSTR	privilegeName,
		BOOL	enable
	)			[static]

Definition at line 147 of file Memory_Windows.cpp.

int memory::UnMapMem

(

PVOID

pBaseAddr

)

Definition at line 133 of file Memory_Windows.cpp.

References NT_SUCCESS, NtCurrentProcess, and NtUnmapViewOfSection.

Referenced by readPhysicalMemoryMap().

---

Variable Documentation

u8* CBlockBuffer = NULL

Definition at line 46 of file Memory_Windows.cpp.

Referenced by enumSystemFirmwareTables().

u8* EBlockBuffer = NULL

Definition at line 47 of file Memory_Windows.cpp.

Referenced by enumSystemFirmwareTables().

EnumSystemFirmwareTablesPtr EnumSystemFirmwareTables = NULL

Definition at line 44 of file Memory_Windows.cpp.

Referenced by enumSystemFirmwareTables(), and LoadNtdllFuncs().

GetSystemFirmwareTablePtr GetSystemFirmwareTable = NULL

Definition at line 45 of file Memory_Windows.cpp.

Referenced by enumSystemFirmwareTables(), smbios::LoadNtdllFuncs(), and LoadNtdllFuncs().

NtClosePtr NtClose = NULL

Definition at line 38 of file Memory_Windows.cpp.

Referenced by CloseMemAccess(), and LoadNtdllFuncs().

NtMapViewOfSectionPtr NtMapViewOfSection = NULL

Definition at line 39 of file Memory_Windows.cpp.

Referenced by LoadNtdllFuncs(), and MapMem().

NtOpenSectionPtr NtOpenSection = NULL

Definition at line 37 of file Memory_Windows.cpp.

Referenced by LoadNtdllFuncs(), and OpenMemAccess().

NtUnmapViewOfSectionPtr NtUnmapViewOfSection = NULL

Definition at line 40 of file Memory_Windows.cpp.

Referenced by LoadNtdllFuncs(), and UnMapMem().

int reopenHint = 1

Definition at line 48 of file Memory_Windows.cpp.

RtlInitUnicodeStringPtr RtlInitUnicodeString = NULL

Definition at line 41 of file Memory_Windows.cpp.

Referenced by LoadNtdllFuncs(), and OpenMemAccess().

ZwSystemDebugControlPtr ZwSystemDebugControl = NULL

Definition at line 42 of file Memory_Windows.cpp.