memscan

Documentation

Overview

Mem scan utlities

Index

• Constants
• Variables
• func GetProcessPathAndCmdline(process *MemScanProcess) (string, string, error)
• func GetProcessPidToScan(pid int, allPids bool) ([]int, error)
• type MemMatch
• type MemRange
• type MemReader
  • func (ms *MemReader) GenScanRange(from uint64, length uint64, bsize uint64, name string) []MemRange
  • func (ms *MemReader) GetScanRangeForPidMaps(p *MemScanProcess, permMap uint8, bucketLen uint64) ([]MemRange, error)
  • func (ms *MemReader) ScanMemory(process *MemScanProcess, mranges *[]MemRange, bsize uint64, ...)
• type MemScanProcess
  • func GetProcess(pid int) (*MemScanProcess, error)
  • func (p *MemScanProcess) Close()

Constants

const (
	VM_READ_SYSCALL         = 310
	VM_READ_SYSCALL_AARCH64 = 270
	IGNORE_PERM             = "---p"
	IGNORE_NAME             = "[vvar]"
)

const (
	WorkerExit uint8 = iota
	ContinueScan
	StopScan
)

Variables

var ARCH_PLATFORM_SYSCALL int = VM_READ_SYSCALL

Functions

func GetProcessPathAndCmdline

func GetProcessPathAndCmdline(process *MemScanProcess) (string, string, error)

func GetProcessPidToScan

func GetProcessPidToScan(pid int, allPids bool) ([]int, error)

Types

type MemMatch

type MemMatch struct {
	Chunk    *[]byte
	Pos      [][]int
	Location MemRange
}

For each Match on a chunk all found locations

type MemRange

type MemRange struct {
	Start uint64 `json:"Start"`
	End   uint64 `json:"End"`

	Name string `json:"-"`
	// contains filtered or unexported fields
}

Simple memrange structure

type MemReader

type MemReader struct {
}

Struct holder

func (*MemReader) GenScanRange

func (ms *MemReader) GenScanRange(from uint64, length uint64, bsize uint64, name string) []MemRange

Generate a slice of mem scan ranges

Starting at address "from", generatin chunks of bsize length until from+length is reached

Improvement: Add a function to allow inline scan, in case if needed

func (*MemReader) GetScanRangeForPidMaps

func (ms *MemReader) GetScanRangeForPidMaps(p *MemScanProcess, permMap uint8, bucketLen uint64) ([]MemRange, error)

For a given PID returns the memory mapped

func (*MemReader) ScanMemory

func (ms *MemReader) ScanMemory(process *MemScanProcess, mranges *[]MemRange, bsize uint64, callback func(data *[]byte, mrange MemRange, err error, workerNum int) uint8, totalGoRoutines int)

Scan a process for the given memory ranges , invoking callback function with cunks of bsize bytes

type MemScanProcess

type MemScanProcess struct {
	Pid    int
	Handle uintptr // handle is accessed atomically on Windows

}

func GetProcess

func GetProcess(pid int) (*MemScanProcess, error)

func (*MemScanProcess) Close

func (p *MemScanProcess) Close()