memprocfs

package module
v0.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 4, 2026 License: MIT Imports: 9 Imported by: 0

README

go-memprocfs

Build Test

Go bindings for MemProcFS, providing live memory analysis and forensics capabilities via a pure Go API without CGo.

Compatibility

go-memprocfs MemProcFS (Native DLL/SO)
v0.1.x v5.x

Requirements

This library wraps the native vmmdll shared library using purego. The native libraries must be present on the system:

Platform Libraries needed
macOS vmm.dylib, leechcore.dylib
Windows vmm.dll, leechcore.dll
Linux vmm.so, leechcore.so

Download the native libraries from the MemProcFS releases page and place them in a directory accessible at runtime (e.g. next to the binary, or in libs/).

Installation

go get github.com/sergeyzav/gomemprocfs

Quick Start

package main

import (
    "fmt"
    "log"

    "github.com/sergeyzav/gomemprocfs"
)

func main() {
    // Open a memory dump file
    vmm, err := memprocfs.NewVmm("./libs/vmm.dylib",
        memprocfs.WithDevice("./dumps/memdump.raw"),
    )
    if err != nil {
        log.Fatal(err)
    }
    defer vmm.Close()

    // List all running processes
    pids, err := vmm.GetPidList()
    if err != nil {
        log.Fatal(err)
    }

    for _, pid := range pids {
        info, err := vmm.GetProcessInfo(pid)
        if err != nil {
            continue
        }
        fmt.Printf("PID %d: %s\n", pid, info.Name())
    }
}
Reading process memory
pid, err := vmm.GetPidByName("notepad.exe")
if err != nil {
    log.Fatal(err)
}

data, err := vmm.MemRead(pid, 0x7FF000000000, 0x100)
if err != nil {
    log.Fatal(err)
}
fmt.Printf("% x\n", data)
Scatter (batched) reads
scatter, err := vmm.ScatterInitialize(pid, 0)
if err != nil {
    log.Fatal(err)
}
defer scatter.Close()

scatter.Prepare(0x7FF000000000, 0x100)
scatter.Prepare(0x7FF000001000, 0x100)
scatter.ExecuteRead()

data, _ := scatter.Read(0x7FF000000000, 0x100)

Initialization options

Option Description
WithDevice(path) Target device or file path
WithDeviceFPGA() Use FPGA hardware target
WithRemote(dsn) Connect to a remote LeechAgent
WithPageFile(id, path) Attach a Windows page file
WithMemMap(path) Provide a physical memory map
WithForensic(lvl) Enable forensic mode (0–4)
WithVM() Enable virtual machine parsing
WithNorefresh() Disable background refresh
WithDisableSymbols() Skip PDB symbol loading
WithVerbose() Enable verbose output
WithPrintf() Enable native library stdout output

Supported platforms

  • macOS (arm64, amd64)
  • Windows (amd64)
  • Linux (amd64) — experimental

Documentation

Overview

Package memprocfs provides Go bindings for the MemProcFS vmmdll native library, enabling live memory analysis and forensics on Windows targets (physical or VM) without requiring CGo.

The primary entry point is NewVmm, which loads the native library and opens a connection to a memory target. All analysis operations are methods on the returned *Vmm handle.

Index

Constants

View Source 
const (
	MapPTEVersion             = 2
	MapVADVersion             = 6
	MapVADExVersion           = 4
	MapModuleVersion          = 6
	MapUnloadedModuleVersion  = 2
	MapEATVersion             = 3
	MapIATVersion             = 2
	MapHeapVersion            = 4
	MapHeapAllocVersion       = 1
	MapThreadVersion          = 4
	MapThreadCallstackVersion = 1
	MapHandleVersion          = 3
	MapPoolVersion            = 2
	MapKObjectVersion         = 1
	MapKDriverVersion         = 1
	MapKDeviceVersion         = 1
	MapNetVersion             = 3
	MapPhysMemVersion         = 2
	MapUserVersion            = 2
	MapVMVersion              = 2
	MapServiceVersion         = 3
)

Map*Version constants define the vmmdll structure versions this library was built against. Get* methods return an ErrUnsupported*Version error if the loaded native library returns a different version, indicating a vmmdll API mismatch.

View Source 
const (
	PidProcessWithKernelMemory = 0x80000000
)

Special PID to enable kernel memory access

Variables

View Source 
var (
	ErrUnsupportedPTEVersion             = errors.New("unsupported PTE version")
	ErrUnsupportedVADVersion             = errors.New("unsupported VAD version")
	ErrUnsupportedVADExVersion           = errors.New("unsupported VADEx version")
	ErrUnsupportedModuleVersion          = errors.New("unsupported Module version")
	ErrUnsupportedUnloadedModuleVersion  = errors.New("unsupported UnloadedModule version")
	ErrUnsupportedEATVersion             = errors.New("unsupported EAT version")
	ErrUnsupportedIATVersion             = errors.New("unsupported IAT version")
	ErrUnsupportedHeapVersion            = errors.New("unsupported Heap version")
	ErrUnsupportedHeapAllocVersion       = errors.New("unsupported HeapAlloc version")
	ErrUnsupportedThreadVersion          = errors.New("unsupported Thread version")
	ErrUnsupportedThreadCallstackVersion = errors.New("unsupported ThreadCallstack version")
	ErrUnsupportedHandleVersion          = errors.New("unsupported Handle version")
	ErrUnsupportedPoolVersion            = errors.New("unsupported Pool version")
	ErrUnsupportedKObjectVersion         = errors.New("unsupported KObject version")
	ErrUnsupportedKDriverVersion         = errors.New("unsupported KDriver version")
	ErrUnsupportedKDeviceVersion         = errors.New("unsupported KDevice version")
	ErrUnsupportedNetVersion             = errors.New("unsupported Net version")
	ErrUnsupportedPhysMemVersion         = errors.New("unsupported PhysMem version")
	ErrUnsupportedUserVersion            = errors.New("unsupported User version")
	ErrUnsupportedVMVersion              = errors.New("unsupported VM version")
	ErrUnsupportedServiceVersion         = errors.New("unsupported Service version")
)

ErrUnsupported*Version errors are returned when the native vmmdll library returns a map structure version that does not match the expected Map*Version constant.

Functions

func CloseAll 

func CloseAll()

CloseAll closes all active VMM_HANDLE instances and frees all resources. It is a global operation — use with care when multiple Vmm instances exist.

Types

type ConfigOpt 

type ConfigOpt uint64

ConfigOpt defines the type for VMM configuration options used with ConfigGet/ConfigSet. 

const (
	// Core Options
	OptCorePrintfEnable     ConfigOpt = 0x4000000100000000 // RW
	OptCoreVerbose          ConfigOpt = 0x4000000200000000 // RW
	OptCoreVerboseExtra     ConfigOpt = 0x4000000300000000 // RW
	OptCoreVerboseExtraTlp  ConfigOpt = 0x4000000400000000 // RW
	OptCoreMaxNativeAddress ConfigOpt = 0x4000000800000000 // R
	OptCoreLeechcoreHandle  ConfigOpt = 0x4000001000000000 // R
	OptCoreVmmId            ConfigOpt = 0x4000002000000000 // R
	OptCoreSystem           ConfigOpt = 0x2000000100000000 // R
	OptCoreMemoryModel      ConfigOpt = 0x2000000200000000 // R

	// Config Options
	OptConfigIsRefreshEnabled       ConfigOpt = 0x2000000300000000 // R
	OptConfigTickPeriod             ConfigOpt = 0x2000000400000000 // RW
	OptConfigReadCacheTicks         ConfigOpt = 0x2000000500000000 // RW
	OptConfigTlpCacheTicks          ConfigOpt = 0x2000000600000000 // RW
	OptConfigProcCacheTicksPartial  ConfigOpt = 0x2000000700000000 // RW
	OptConfigProcCacheTicksTotal    ConfigOpt = 0x2000000800000000 // RW
	OptConfigVmmVersionMajor        ConfigOpt = 0x2000000900000000 // R
	OptConfigVmmVersionMinor        ConfigOpt = 0x2000000A00000000 // R
	OptConfigVmmVersionRevision     ConfigOpt = 0x2000000B00000000 // R
	OptConfigStatisticsFunctionCall ConfigOpt = 0x2000000C00000000 // RW
	OptConfigIsPagingEnabled        ConfigOpt = 0x2000000D00000000 // RW
	OptConfigDebug                  ConfigOpt = 0x2000000E00000000 // W
	OptConfigYaraRules              ConfigOpt = 0x2000000F00000000 // R

	// Windows Specific Options
	OptWinVersionMajor   ConfigOpt = 0x2000010100000000 // R
	OptWinVersionMinor   ConfigOpt = 0x2000010200000000 // R
	OptWinVersionBuild   ConfigOpt = 0x2000010300000000 // R
	OptWinSystemUniqueId ConfigOpt = 0x2000010400000000 // R

	// Forensic Mode Options
	OptForensicMode ConfigOpt = 0x2000020100000000 // RW

	// Refresh Options
	OptRefreshAll            ConfigOpt = 0x2001ffff00000000 // W
	OptRefreshFreqMem        ConfigOpt = 0x2001100000000000 // W
	OptRefreshFreqMemPartial ConfigOpt = 0x2001000200000000 // W
	OptRefreshFreqTlb        ConfigOpt = 0x2001080000000000 // W
	OptRefreshFreqTlbPartial ConfigOpt = 0x2001000400000000 // W
	OptRefreshFreqFast       ConfigOpt = 0x2001040000000000 // W
	OptRefreshFreqMedium     ConfigOpt = 0x2001000100000000 // W
	OptRefreshFreqSlow       ConfigOpt = 0x2001001000000000 // W

	// Process Specific Options (PID in lower DWORD)
	OptProcessDtb                 ConfigOpt = 0x2002000100000000 // W
	OptProcessDtbFastLowIntegrity ConfigOpt = 0x2002000200000000 // W
)

type EatEntry 

type EatEntry struct {
	FunctionAddress       uint64
	Ordinal               uint32
	FunctionName          string
	ForwardedFunctionName string
	OFunctionsArray       uint32
	ONamesArray           uint32
}

EatEntry represents a single entry in the Export Address Table.

type EatList 

type EatList struct {
	Version                    uint32
	OrdinalBase                uint32
	NumberOfNames              uint32
	NumberOfFunctions          uint32
	NumberOfForwardedFunctions uint32
	ModuleBaseAddress          uint64
	AddressOfFunctions         uint64
	AddressOfNames             uint64
	MultiText                  string
	Count                      uint32
	Entries                    []EatEntry
}

EatList holds the Export Address Table of a module.

type Handle 

type Handle struct {
	Object             uint64
	Handle             uint32
	GrantedAccess      uint32
	TypeIndex          uint32
	HandleCount        uint64
	PointerCount       uint64
	ObjectCreateInfo   uint64
	SecurityDescriptor uint64
	Text               string
	PID                uint32
	PoolTag            uint32
	Type               string
}

Handle represents a single handle in a process.

type HandleList 

type HandleList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Handles   []Handle
}

HandleList contains a list of handles for a process.

type HeapAllocEntry 

type HeapAllocEntry struct {
	Address uint64
	Size    uint32
	Type    HeapAllocType
}

HeapAllocEntry represents a single heap allocation entry.

type HeapAllocList 

type HeapAllocList struct {
	Version uint32
	Count   uint32
	Entries []HeapAllocEntry
}

HeapAllocList contains a list of heap allocation entries for a process and heap.

type HeapAllocType 

type HeapAllocType uint32

HeapAllocType corresponds to the VMMDLL_HEAPALLOC_TP enum. 

const (
	HeapAllocTypeNA       HeapAllocType = 0
	HeapAllocTypeNtHeap   HeapAllocType = 1
	HeapAllocTypeNtLfh    HeapAllocType = 2
	HeapAllocTypeNtLarge  HeapAllocType = 3
	HeapAllocTypeNtNa     HeapAllocType = 4
	HeapAllocTypeSegVs    HeapAllocType = 5
	HeapAllocTypeSegLfh   HeapAllocType = 6
	HeapAllocTypeSegLarge HeapAllocType = 7
	HeapAllocTypeSegNa    HeapAllocType = 8
)

type HeapEntry 

type HeapEntry struct {
	Address uint64
	Type    HeapType
	Is32Bit bool
	IHeap   uint32
	HeapNum uint32
}

HeapEntry represents a single heap entry.

type HeapList 

type HeapList struct {
	Version  uint32
	Count    uint32
	Segments []HeapSegmentEntry
	Entries  []HeapEntry
}

HeapList contains a list of heap entries and segments for a process.

type HeapSegmentEntry 

type HeapSegmentEntry struct {
	Address     uint64
	Size        uint32
	SegmentType HeapSegmentType
	HeapIndex   uint16
}

HeapSegmentEntry represents a single heap segment.

type HeapSegmentType 

type HeapSegmentType uint16

HeapSegmentType corresponds to the VMMDLL_HEAP_SEGMENT_TP enum. 

const (
	HeapSegmentNA         HeapSegmentType = 0
	HeapSegmentNtSegment  HeapSegmentType = 1
	HeapSegmentNtLfh      HeapSegmentType = 2
	HeapSegmentNtLarge    HeapSegmentType = 3
	HeapSegmentNtNa       HeapSegmentType = 4
	HeapSegmentSegHeap    HeapSegmentType = 5
	HeapSegmentSegSegment HeapSegmentType = 6
	HeapSegmentSegLarge   HeapSegmentType = 7
	HeapSegmentSegNa      HeapSegmentType = 8
)

type HeapType 

type HeapType uint32

HeapType corresponds to the VMMDLL_HEAP_TP enum. 

const (
	HeapTypeNA  HeapType = 0
	HeapTypeNT  HeapType = 1
	HeapTypeSeg HeapType = 2
)

type IATThunkInfo 

type IATThunkInfo struct {
	Is32Bit      bool   // true if thunk entry is 4 bytes wide (32-bit process)
	VaThunk      uint64 // virtual address of the IAT slot itself
	VaFunction   uint64 // current value of the IAT slot = actual function address
	VaNameModule uint64 // VA of the null-terminated module name string
	VaNameFunc   uint64 // VA of the null-terminated function name string
}

IATThunkInfo holds information about a single Import Address Table thunk. Useful for detecting IAT hooks and for locating where a specific import lives in memory.

type IatEntry 

type IatEntry struct {
	FunctionAddress uint64
	FunctionName    string
	ModuleName      string
	Thunk           IatThunk
}

IatEntry represents a single entry in the Import Address Table.

type IatList 

type IatList struct {
	Version           uint32
	ModuleBaseAddress uint64
	Count             uint32
	MultiText         string
	Entries           []IatEntry
}

IatList represents the Import Address Table for a module.

type IatThunk 

type IatThunk struct {
	Is32Bit               bool
	Hint                  uint16
	RvaFirstThunk         uint32
	RvaOriginalFirstThunk uint32
	RvaNameModule         uint32
	RvaNameFunction       uint32
}

IatThunk represents the Thunk data for an IAT entry.

type ImageDataDirectory 

type ImageDataDirectory struct {
	VirtualAddress uint32
	Size           uint32
}

ImageDataDirectory mirrors the Windows IMAGE_DATA_DIRECTORY structure.

type ImageSectionHeader 

type ImageSectionHeader struct {
	Name                 [8]byte
	VirtualSize          uint32 // Also PhysicalAddress
	VirtualAddress       uint32
	SizeOfRawData        uint32
	PointerToRawData     uint32
	PointerToRelocations uint32
	PointerToLinenumbers uint32
	NumberOfRelocations  uint16
	NumberOfLinenumbers  uint16
	Characteristics      uint32
}

ImageSectionHeader mirrors the Windows IMAGE_SECTION_HEADER structure.

type KDeviceEntry 

type KDeviceEntry struct {
	Va                 uint64
	Depth              uint32
	DeviceType         uint32
	DeviceTypeName     string
	VaDriverObject     uint64
	VaAttachedDevice   uint64
	VaFileSystemDevice uint64
	VolumeInfo         string
}

KDeviceEntry represents a single kernel device object entry.

type KDeviceList 

type KDeviceList struct {
	Version uint32
	Count   uint32
	Entries []KDeviceEntry
}

KDeviceList contains a list of kernel device objects.

type KDriverEntry 

type KDriverEntry struct {
	Va             uint64
	VaDriverStart  uint64
	CbDriverSize   uint64
	VaDeviceObject uint64
	Name           string
	Path           string
	ServiceKeyName string
	MajorFunction  [28]uint64
}

KDriverEntry represents a single kernel driver entry.

type KDriverList 

type KDriverList struct {
	Version uint32
	Count   uint32
	Entries []KDriverEntry
}

KDriverList contains a list of kernel drivers.

type KObjectEntry 

type KObjectEntry struct {
	Va       uint64
	VaParent uint64
	Children []uint64
	Name     string
	Type     string
}

KObjectEntry represents a single kernel object entry.

type KObjectList 

type KObjectList struct {
	Version uint32
	Count   uint32
	Entries []KObjectEntry
}

KObjectList contains a list of kernel objects.

type MemFlag 

type MemFlag uint32

MemFlag is a bitmask of memory read/write flags (VMMDLL_FLAG_*). 

const (
	// MemFlagNone is the default — no special flags.
	MemFlagNone MemFlag = 0

	// MemFlagNoCache forces reading from the acquisition device, bypassing cache.
	MemFlagNoCache MemFlag = 0x0001

	// MemFlagZeroPadOnFail zero-pads failed physical memory reads and reports
	// success if the read is within range of physical memory.
	MemFlagZeroPadOnFail MemFlag = 0x0002

	// MemFlagForceCacheRead forces use of cache; fails non-cached pages.
	// Invalid combined with MemFlagNoCache or MemFlagZeroPadOnFail.
	MemFlagForceCacheRead MemFlag = 0x0008

	// MemFlagNoPaging skips retrieval of paged-out memory from pagefile/compressed.
	MemFlagNoPaging MemFlag = 0x0010

	// MemFlagNoPagingIO skips retrieval of paged-out memory if it would incur I/O.
	MemFlagNoPagingIO MemFlag = 0x0020

	// MemFlagNoCachePut prevents writing back to the data cache after a successful read.
	MemFlagNoCachePut MemFlag = 0x0100

	// MemFlagCacheRecentOnly fetches only from the most recent active cache region.
	MemFlagCacheRecentOnly MemFlag = 0x0200

	// MemFlagForceCacheReadDisable disables VMMDLL_FLAG_FORCECACHE_READ.
	// Recommended for local files to improve forensic artifact ordering.
	MemFlagForceCacheReadDisable MemFlag = 0x0800

	// MemFlagScatterPrepareExNoMemZero skips zero-ing the buffer when
	// preparing a scatter read.
	MemFlagScatterPrepareExNoMemZero MemFlag = 0x1000

	// MemFlagNoMemCallback suppresses user-set memory callback functions.
	MemFlagNoMemCallback MemFlag = 0x2000

	// MemFlagScatterForcePageRead forces page-sized reads in scatter operations.
	MemFlagScatterForcePageRead MemFlag = 0x4000
)

type MemoryModel 

type MemoryModel uint32

MemoryModel corresponds to the VMMDLL_MEMORYMODEL_TP enum. 

const (
	MemoryModelNA     MemoryModel = 0
	MemoryModelX86    MemoryModel = 1
	MemoryModelX86PAE MemoryModel = 2
	MemoryModelX64    MemoryModel = 3
	MemoryModelARM64  MemoryModel = 4
)

type Module 

type Module struct {
	BaseAddress  uint64
	EntryPoint   uint64
	ImageSize    uint32
	IsWow64      bool
	Name         string
	FullName     string
	Type         ModuleType
	FileSize     uint32
	SectionCount uint32
	ExportCount  uint32
	ImportCount  uint32
	DebugInfo    *ModuleDebugInfo
	VersionInfo  *ModuleVersionInfo
}

Module contains information about a single loaded module.

type ModuleDebugInfo added in v0.1.2 

type ModuleDebugInfo struct {
	Age         uint32
	Guid        [16]byte
	GuidString  string
	PdbFilename string
}

ModuleDebugInfo contains PDB debug information for a module. Populated only when ModuleFlagDebugInfo is passed.

type ModuleFlag added in v0.1.2 

type ModuleFlag uint32

ModuleFlag controls module enumeration behavior. 

const (
	// ModuleFlagNone retrieves basic module information.
	ModuleFlagNone ModuleFlag = 0
	// ModuleFlagDebugInfo includes debug info (Age, GUID, PDB filename).
	ModuleFlagDebugInfo ModuleFlag = 1
	// ModuleFlagVersionInfo includes version info (company, description, version, etc.).
	ModuleFlagVersionInfo ModuleFlag = 2
)

type ModuleList 

type ModuleList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Modules   []Module
}

ModuleList contains a list of loaded modules for a process.

type ModuleType 

type ModuleType uint32

ModuleType corresponds to the VMMDLL_MODULE_TP enum. 

const (
	ModuleTypeUnknown ModuleType = 0
	ModuleTypeNormal  ModuleType = 1
	ModuleTypeData    ModuleType = 2
)

type ModuleVersionInfo added in v0.1.2 

type ModuleVersionInfo struct {
	CompanyName      string
	FileDescription  string
	FileVersion      string
	InternalName     string
	LegalCopyright   string
	OriginalFilename string
	ProductName      string
	ProductVersion   string
}

ModuleVersionInfo contains version resource information for a module. Populated only when ModuleFlagVersionInfo is passed.

type NetAddr 

type NetAddr struct {
	Valid   bool
	Port    uint16
	Address [16]byte
	Text    string
}

NetAddr represents a single network address.

type NetEntry 

type NetEntry struct {
	PID           uint32
	State         uint32
	AddressFamily uint16
	Src           NetAddr
	Dst           NetAddr
	Object        uint64
	Timestamp     uint64
	PoolTag       uint32
	Text          string
}

NetEntry represents a single network connection entry.

type NetList 

type NetList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Entries   []NetEntry
}

NetList contains a list of network connections for a process.

type Option 

type Option func() []string

Option is a functional option for NewVmm. Use the With* constructors to build the option list.

func WithDevice 

func WithDevice(device string) Option

WithDevice sets the target device or memory source. Accepts a file path (e.g. "./dump.raw"), a device name, or a special string like "fpga".

func WithDeviceFPGA 

func WithDeviceFPGA() Option

WithDeviceFPGA connects to an FPGA hardware device (default if no option is given).

func WithDisableInfoDB 

func WithDisableInfoDB() Option

WithDisableInfoDB disables the internal info/symbol database.

func WithDisablePython 

func WithDisablePython() Option

WithDisablePython disables the Python plugin subsystem.

func WithDisableSymbolServer 

func WithDisableSymbolServer() Option

WithDisableSymbolServer disables network access to the Microsoft symbol server. Use when offline or to speed up initialization.

func WithDisableSymbols 

func WithDisableSymbols() Option

WithDisableSymbols skips PDB symbol loading entirely (faster startup, no symbol resolution).

func WithForensic 

func WithForensic(lvl int) Option

WithForensic enables forensic mode at the given level (0–4). Higher levels perform more analysis (e.g. timeline, yara scanning) at the cost of time.

func WithMemMap 

func WithMemMap(filename string) Option

WithMemMap provides a physical memory map file that describes memory regions.

func WithNorefresh 

func WithNorefresh() Option

WithNorefresh disables the background memory refresh that re-reads live targets periodically.

func WithPageFile 

func WithPageFile(pageID int, pageFile string) Option

WithPageFile attaches a Windows page file to supplement the memory image. pageID is 0–9 corresponding to pagefile0–pagefile9.

func WithPrintf 

func WithPrintf() Option

WithPrintf enables stdout output from the native vmmdll library.

func WithRemote 

func WithRemote(dsn string) Option

WithRemote connects to a remote LeechAgent instead of a local device. dsn format: "remoteaddr:port" or a LeechCore DSN string.

func WithVM 

func WithVM() Option

WithVM enables detection and parsing of virtual machines in the memory image.

func WithVMBasic 

func WithVMBasic() Option

WithVMBasic enables basic VM detection (less thorough than WithVM, faster).

func WithVMNested 

func WithVMNested() Option

WithVMNested enables nested VM detection (VMs inside VMs).

func WithVerbose 

func WithVerbose() Option

WithVerbose enables verbose diagnostic output from the native library.

func WithWaitInitialize 

func WithWaitInitialize() Option

WithWaitInitialize blocks NewVmm until full initialization is complete. Without this, some data (e.g. processes) may not be ready immediately after NewVmm returns.

type PfnEntry 

type PfnEntry struct {
	Pfn            uint32
	TypeExtended   PfnTypeExtended
	Pid            uint32 // valid for active non-prototype pages
	Va             uint64 // virtual address (non-zero when known)
	VaPte          uint64
	OriginalPte    uint64
	Type           PfnType // page location type (PageLocation bitfield)
	ReferenceCount uint16
}

PfnEntry holds information about a single Page Frame Number.

type PfnFlag added in v0.1.2 

type PfnFlag uint32

PfnFlag controls the level of detail returned by GetPfnList. 

const (
	PfnFlagNormal   PfnFlag = 0
	PfnFlagExtended PfnFlag = 1
)

type PfnList 

type PfnList struct {
	Count   uint32
	Entries []PfnEntry
}

PfnList holds the result of a PFN lookup.

type PfnType 

type PfnType uint32

PfnType corresponds to the VMMDLL_MAP_PFN_TYPE enum. 

const (
	PfnTypeZero            PfnType = 0
	PfnTypeFree            PfnType = 1
	PfnTypeStandby         PfnType = 2
	PfnTypeModified        PfnType = 3
	PfnTypeModifiedNoWrite PfnType = 4
	PfnTypeBad             PfnType = 5
	PfnTypeActive          PfnType = 6
	PfnTypeTransition      PfnType = 7
)

type PfnTypeExtended 

type PfnTypeExtended uint32

PfnTypeExtended corresponds to the VMMDLL_MAP_PFN_TYPEEXTENDED enum. 

const (
	PfnExtUnknown        PfnTypeExtended = 0
	PfnExtUnused         PfnTypeExtended = 1
	PfnExtProcessPrivate PfnTypeExtended = 2
	PfnExtPageTable      PfnTypeExtended = 3
	PfnExtLargePage      PfnTypeExtended = 4
	PfnExtDriverLocked   PfnTypeExtended = 5
	PfnExtShareable      PfnTypeExtended = 6
	PfnExtFile           PfnTypeExtended = 7
)

type PhysMemEntry 

type PhysMemEntry struct {
	BaseAddress uint64
	Size        uint64
}

PhysMemEntry represents a physical memory range.

type PhysMemList 

type PhysMemList struct {
	Version uint32
	Count   uint32
	Entries []PhysMemEntry
}

PhysMemList contains a list of physical memory ranges.

type PoolEntry 

type PoolEntry struct {
	Va     uint64
	Tag    [4]byte
	Alloc  bool
	TpPool PoolType
	TpSS   uint8
	Size   uint32
}

PoolEntry represents a single kernel pool allocation.

type PoolList 

type PoolList struct {
	Version uint32
	Count   uint32
	Entries []PoolEntry
}

PoolList contains a list of kernel pool allocations.

type PoolMapFlag 

type PoolMapFlag uint32

PoolMapFlag controls which pool allocations are returned. 

const (
	PoolMapFlagAll PoolMapFlag = 0
	PoolMapFlagBig PoolMapFlag = 1
)

type PoolType 

type PoolType uint8

PoolType represents the type of a pool allocation. 

const (
	PoolTypeUnknown        PoolType = 0
	PoolTypeNonPagedPool   PoolType = 1
	PoolTypeNonPagedPoolNx PoolType = 2
	PoolTypePagedPool      PoolType = 3
)

type ProcessInfo 

type ProcessInfo struct {
	Magic       uint64
	Version     uint16
	Size        uint16
	MemoryModel MemoryModel
	SystemType  SystemType
	IsUserOnly  uint32 // BOOL
	PID         uint32
	ParentPID   uint32
	State       uint32
	NameRaw     [16]byte
	NameLongRaw [64]byte

	DTB     uint64
	UserDTB uint64
	Win     WinProcessInfo
	// contains filtered or unexported fields
}

ProcessInfo mirrors the C struct VMMDLL_PROCESS_INFORMATION

func (*ProcessInfo) Name 

func (pi *ProcessInfo) Name() string

Name returns the process name as a Go string.

func (*ProcessInfo) NameLong 

func (pi *ProcessInfo) NameLong() string

NameLong returns the long process name as a Go string.

type ProcessInfoStringOptions 

type ProcessInfoStringOptions uint32
const (
	ProcessInformationOptStringPathUserImage ProcessInfoStringOptions = 0x1
	ProcessInformationOptStringPathKernel    ProcessInfoStringOptions = 0x2
	ProcessInformationOptStringCmdline       ProcessInfoStringOptions = 0x4
	ProcessInformationOptStringSID           ProcessInfoStringOptions = 0x8
	ProcessInformationOptStringSystemRoot    ProcessInfoStringOptions = 0x10
)

type ProcessIntegrityLevel 

type ProcessIntegrityLevel uint32

type PteEntry 

type PteEntry struct {
	BaseAddress   uint64
	PageCount     uint64
	PageFlags     uint64
	IsWow64       bool
	Name          string
	SoftwareCount uint32
}

PteEntry represents a single Page Table Entry.

type PteList 

type PteList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Entries   []PteEntry
}

PteList contains a list of Page Table Entries for a process.

type PteType 

type PteType uint32

PteType corresponds to the VMMDLL_PTE_TP enum. 

const (
	PteTypeNA         PteType = 0
	PteTypeHardware   PteType = 1
	PteTypeTransition PteType = 2
	PteTypePrototype  PteType = 3
	PteTypeDemandZero PteType = 4
	PteTypeCompressed PteType = 5
	PteTypePageFile   PteType = 6
	PteTypeFile       PteType = 7
)

type RegistryHive 

type RegistryHive struct {
	BaseAddress uint64
	Name        string
	ShortName   string
	Path        string
}

RegistryHive represents a single registry hive.

type RegistryKey 

type RegistryKey struct {
	Name          string
	LastWriteTime uint64 // FILETIME: 100-nanosecond intervals since Jan 1, 1601
}

RegistryKey represents a single registry sub-key entry.

type RegistryValue 

type RegistryValue struct {
	Name string
	Type uint32
	Data []byte
}

RegistryValue represents a single registry value entry.

type ScatterHandle 

type ScatterHandle struct {
	// contains filtered or unexported fields
}

ScatterHandle is a handle for batched scatter read/write operations. Create via Vmm.ScatterInitialize; close with Close when done.

func (*ScatterHandle) Clear 

func (h *ScatterHandle) Clear(pid uint32, flags MemFlag) error

Clear resets the handle for reuse in a subsequent scatter operation. Optionally change the target PID; pass 0 to keep the current PID.

func (*ScatterHandle) Close 

func (h *ScatterHandle) Close()

Close releases all resources associated with the scatter handle.

func (*ScatterHandle) Execute 

func (h *ScatterHandle) Execute() error

Execute writes all ranges registered with PrepareWrite, then reads all ranges registered with Prepare.

func (*ScatterHandle) ExecuteRead 

func (h *ScatterHandle) ExecuteRead() error

ExecuteRead reads all ranges registered with Prepare.

func (*ScatterHandle) Prepare 

func (h *ScatterHandle) Prepare(va uint64, cb uint32) error

Prepare registers a virtual address range for reading. After Execute or ExecuteRead, retrieve the data with Read.

func (*ScatterHandle) PrepareWrite 

func (h *ScatterHandle) PrepareWrite(va uint64, data []byte) error

PrepareWrite registers a virtual address range for writing. Data is copied immediately, so the slice may be modified after this call. Writing takes place before reading during Execute. Note: requires a live/writable target.

func (*ScatterHandle) Read 

func (h *ScatterHandle) Read(va uint64, cb uint32) ([]byte, error)

Read retrieves data for a range previously registered with Prepare. Must be called after Execute or ExecuteRead.

type ServiceEntry 

type ServiceEntry struct {
	Object      uint64
	Ordinal     uint32
	StartType   uint32
	Status      ServiceStatus
	ServiceName string
	DisplayName string
	Path        string
	UserType    string
	UserAccount string
	ImagePath   string
	PID         uint32
}

ServiceEntry represents a single service entry.

type ServiceList 

type ServiceList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Entries   []ServiceEntry
}

ServiceList contains a list of services.

type ServiceStatus 

type ServiceStatus struct {
	ServiceType             uint32
	CurrentState            uint32
	ControlsAccepted        uint32
	Win32ExitCode           uint32
	ServiceSpecificExitCode uint32
	CheckPoint              uint32
	WaitHint                uint32
}

ServiceStatus mirrors the Windows SERVICE_STATUS structure.

type SystemType 

type SystemType uint32

SystemType corresponds to the VMMDLL_SYSTEM_TP enum. 

const (
	SystemUnknownPhysical SystemType = 0
	SystemUnknown64       SystemType = 1
	SystemWindows64       SystemType = 2
	SystemUnknown32       SystemType = 3
	SystemWindows32       SystemType = 4
)

type Thread 

type Thread struct {
	TID                uint32
	PID                uint32
	ExitStatus         uint32
	State              byte
	Running            byte
	Priority           byte
	BasePriority       byte
	ETHREAD            uint64
	Teb                uint64
	CreateTime         uint64
	ExitTime           uint64
	StartAddress       uint64
	StackBaseUser      uint64
	StackLimitUser     uint64
	StackBaseKernel    uint64
	StackLimitKernel   uint64
	TrapFrame          uint64
	RIP                uint64
	RSP                uint64
	Affinity           uint64
	UserTime           uint32
	KernelTime         uint32
	SuspendCount       byte
	WaitReason         byte
	ImpersonationToken uint64
	Win32StartAddress  uint64
}

Thread represents a single thread in a process.

type ThreadCallstack 

type ThreadCallstack struct {
	Version   uint32
	PID       uint32
	TID       uint32
	Text      string
	MultiText string
	Count     uint32
	Entries   []ThreadCallstackEntry
}

ThreadCallstack contains the callstack for a thread.

type ThreadCallstackEntry 

type ThreadCallstackEntry struct {
	Index        uint32
	RegPresent   bool
	RetAddr      uint64
	RSP          uint64
	BaseSP       uint64
	Displacement uint32
	ModuleName   string
	FunctionName string
}

ThreadCallstackEntry represents a single entry in the thread callstack.

type ThreadList 

type ThreadList struct {
	Version uint32
	Count   uint32
	Threads []Thread
}

ThreadList contains a list of threads for a process.

type UnloadedModule 

type UnloadedModule struct {
	BaseAddress uint64
	ImageSize   uint32
	IsWow64     bool
	Name        string
	UnloadTime  uint64
	Checksum    uint32
	Timestamp   uint32
}

UnloadedModule represents a single unloaded module.

type UnloadedModuleList 

type UnloadedModuleList struct {
	Version   uint32
	Count     uint32
	MultiText string
	Modules   []UnloadedModule
}

UnloadedModuleList contains a list of unloaded modules for a process.

type UserEntry 

type UserEntry struct {
	Text      string
	VaRegHive uint64
	SID       string
}

UserEntry represents a single user entry.

type UserList 

type UserList struct {
	Version uint32
	Count   uint32
	Entries []UserEntry
}

UserList contains a list of system users.

type VMList 

type VMList struct {
	Count   uint32
	Entries []VmEntry
}

VMList holds the list of virtual machines.

type Vad 

type Vad struct {
	Start            uint64
	End              uint64
	VadAddress       uint64
	VadType          uint32
	Protection       uint32
	IsImage          bool
	IsFile           bool
	IsPageFile       bool
	IsPrivateMemory  bool
	IsTeb            bool
	IsStack          bool
	HeapNum          uint32
	IsHeap           bool
	CommitCharge     uint32
	IsCommitted      bool
	PrototypePteSize uint32
	PrototypePte     uint64
	Subsection       uint64
	Text             string
	FileObject       uint64
	VadExPages       uint32
	VadExPagesBase   uint32
}

Vad represents a single Virtual Address Descriptor.

type VadExEntry 

type VadExEntry struct {
	Type         PteType
	PageMapLevel uint8
	PteFlags     uint8
	Va           uint64
	Pa           uint64
	Pte          uint64
	ProtoType    PteType
	ProtoPa      uint64
	ProtoPte     uint64
	VadBase      uint64
}

VadExEntry is a single extended VAD page entry returned by GetVadExList.

type VadExList 

type VadExList struct {
	Count   uint32
	Entries []VadExEntry
}

VadExList holds extended VAD page entries.

type VadList 

type VadList struct {
	Version   uint32
	PageCount uint32
	Count     uint32
	MultiText string
	Vads      []Vad
}

VadList contains a list of VADs for a process.

type VfsEntry 

type VfsEntry struct {
	Name           string
	Size           uint64 // file size in bytes; ^uint64(0) means directory
	IsDirectory    bool
	CreationTime   uint64 // FILETIME
	LastAccessTime uint64 // FILETIME
	LastWriteTime  uint64 // FILETIME
}

VfsEntry represents a single file or directory in the MemProcFS virtual filesystem.

type VmEntry 

type VmEntry struct {
	Handle           uintptr
	Name             string
	GpaMax           uint64
	Type             VmType
	IsActive         bool
	IsReadOnly       bool
	IsPhysicalOnly   bool
	PartitionID      uint32
	VersionBuild     uint32
	SystemType       SystemType
	ParentVmmMountID uint32
	VmMemPID         uint32
}

VmEntry represents a single virtual machine discovered by MemProcFS.

type VmType 

type VmType uint32

VmType corresponds to the VMMDLL_VM_TP enum. 

const (
	VmTypeUnknown VmType = 0
	VmTypeHV      VmType = 1
	VmTypeHVWHVP  VmType = 2
)

type Vmm 

type Vmm struct {
	// contains filtered or unexported fields
}

Vmm is a handle to an active MemProcFS session. Create one with NewVmm; release resources with Close when done. All analysis methods (memory reads, process info, registry, etc.) are methods on *Vmm.

func NewVmm 

func NewVmm(libPath string, opts ...Option) (*Vmm, error)

NewVmm loads the vmmdll native library from libPath and initializes a new MemProcFS session with the given options.

libPath is the path to the platform-specific vmmdll shared library (e.g. "./libs/vmm.dylib" on macOS, "vmm.dll" on Windows).

Use option functions (WithDevice, WithRemote, etc.) to configure the target. If no options are provided, the default target is an FPGA device.

The caller must call Close on the returned handle to release resources.

func (*Vmm) Close 

func (vmm *Vmm) Close() error

Close shuts down this Vmm session and frees all associated resources. After Close, the Vmm handle must not be used.

func (*Vmm) ConfigGet 

func (vmm *Vmm) ConfigGet(option ConfigOpt) (uint64, error)

ConfigGet retrieves a configuration value from the VMM.

func (*Vmm) ConfigSet 

func (vmm *Vmm) ConfigSet(option ConfigOpt, value uint64) error

ConfigSet sets a configuration value in the VMM.

func (*Vmm) GetEatList 

func (vmm *Vmm) GetEatList(pid uint32, moduleName string) (*EatList, error)

GetEatList retrieves the Export Address Table (EAT) for a given module in a process. GetEatList returns the Export Address Table for moduleName in process pid.

func (*Vmm) GetHandleList 

func (vmm *Vmm) GetHandleList(pid uint32) (*HandleList, error)

GetHandleList returns all open kernel handles for process pid.

func (*Vmm) GetHeapAllocList 

func (vmm *Vmm) GetHeapAllocList(pid uint32, heapNumOrAddress uint64) (*HeapAllocList, error)

GetHeapAllocList retrieves the heap allocation entries for a given process and heap. GetHeapAllocList returns individual allocations within a heap for process pid. heapNumOrAddress is either a heap index (0, 1, …) or the base address of the heap.

func (*Vmm) GetHeapList 

func (vmm *Vmm) GetHeapList(pid uint32) (*HeapList, error)

GetHeapList retrieves the heap entries for a given process. GetHeapList returns all heaps for process pid.

func (*Vmm) GetIATThunkInfo 

func (vmm *Vmm) GetIATThunkInfo(pid uint32, moduleName string, importModuleName string, importFuncName string) (*IATThunkInfo, error)

GetIATThunkInfo retrieves IAT thunk details for a specific imported function.

  • pid — target process PID
  • moduleName — the module that owns the IAT (e.g. "notepad.exe")
  • importModuleName — the DLL being imported from (e.g. "ntdll.dll")
  • importFuncName — the function name (e.g. "NtCreateFile")

func (*Vmm) GetIatList 

func (vmm *Vmm) GetIatList(pid uint32, moduleName string) (*IatList, error)

GetIatList retrieves the Import Address Table (IAT) for a given module in a process. GetIatList returns the Import Address Table for moduleName in process pid.

func (*Vmm) GetKDeviceList 

func (vmm *Vmm) GetKDeviceList() (*KDeviceList, error)

GetKDeviceList retrieves the list of Windows kernel device objects. Each entry includes the device's virtual address, type, associated driver object, and optional volume info.

func (*Vmm) GetKDriverList 

func (vmm *Vmm) GetKDriverList() (*KDriverList, error)

GetKDriverList retrieves the list of loaded Windows kernel drivers. Each entry includes the driver's virtual address, image path, service key name, and MajorFunction dispatch table.

func (*Vmm) GetKObjectList 

func (vmm *Vmm) GetKObjectList() (*KObjectList, error)

GetKObjectList retrieves the Windows kernel object manager directory tree. Each entry includes the object's virtual address, parent, children, name, and type.

func (*Vmm) GetModuleBase 

func (vmm *Vmm) GetModuleBase(pid uint32, moduleName string) (uint64, error)

GetModuleBase returns the base virtual address of a loaded module in process pid.

func (*Vmm) GetModuleByName 

func (vmm *Vmm) GetModuleByName(pid uint32, moduleName string, flags ModuleFlag) (*Module, error)

GetModuleByName retrieves a single module by its name for a given process. GetModuleByName returns detailed information for a specific module in process pid.

func (*Vmm) GetModuleList 

func (vmm *Vmm) GetModuleList(pid uint32, flags ModuleFlag) (*ModuleList, error)

GetModuleList returns all loaded modules (DLLs and EXEs) for process pid.

func (*Vmm) GetNetList 

func (vmm *Vmm) GetNetList() (*NetList, error)

GetNetList retrieves the network connections for a given process. GetNetList returns all active and recently closed network connections on the system.

func (*Vmm) GetPfnList 

func (vmm *Vmm) GetPfnList(pfns []uint32, flags PfnFlag) (*PfnList, error)

GetPfnList retrieves Page Frame Number information for the supplied PFNs. flags: PfnFlagNormal (0) for basic info, PfnFlagExtended (1) for full extended info.

func (*Vmm) GetPhysMem 

func (vmm *Vmm) GetPhysMem() (*PhysMemList, error)

GetPhysMem retrieves the physical memory map of the system. Returns the list of physical memory ranges (base address and size) reported by the hardware/hypervisor.

func (*Vmm) GetPidByName 

func (vmm *Vmm) GetPidByName(processName string) (uint32, error)

GetPidByName returns the PID of the first process whose name matches processName. The match is case-insensitive and against the short (≤15 char) process name.

func (*Vmm) GetPidList 

func (vmm *Vmm) GetPidList() ([]uint32, error)

GetPidList returns the PIDs of all currently running processes.

func (*Vmm) GetPoolList 

func (vmm *Vmm) GetPoolList(flag PoolMapFlag) (*PoolList, error)

GetPoolList retrieves kernel pool allocations. Use PoolMapFlagAll to return all allocations or PoolMapFlagBig to return only big-pool allocations.

func (*Vmm) GetProcAddress 

func (vmm *Vmm) GetProcAddress(pid uint32, moduleName string, funcName string) (uint64, error)

GetProcAddress returns the virtual address of an exported function in a module, equivalent to the Windows GetProcAddress API.

func (*Vmm) GetProcessDirectories 

func (vmm *Vmm) GetProcessDirectories(pid uint32, moduleName string) ([16]ImageDataDirectory, error)

GetProcessDirectories retrieves the 16 PE data directories of a module.

func (*Vmm) GetProcessInfo 

func (vmm *Vmm) GetProcessInfo(pid uint32) (*ProcessInfo, error)

GetProcessInfo returns detailed information about a single process.

func (*Vmm) GetProcessInfoAll 

func (vmm *Vmm) GetProcessInfoAll() ([]ProcessInfo, error)

GetProcessInfoAll returns detailed information for every running process in one call.

func (*Vmm) GetProcessInfoString 

func (vmm *Vmm) GetProcessInfoString(pid uint32, opt ProcessInfoStringOptions) (string, error)

GetProcessInfoString returns a specific string field for a process. opt selects which string to return (e.g. ProcessInformationOptStringCmdline for the command line).

func (*Vmm) GetProcessSections 

func (vmm *Vmm) GetProcessSections(pid uint32, moduleName string) ([]ImageSectionHeader, error)

GetProcessSections retrieves the sections of a module in a process.

func (*Vmm) GetPteList 

func (vmm *Vmm) GetPteList(pid uint32, identifyModules bool) (*PteList, error)

GetPteList retrieves the Page Table Entries (PTEs) for a given process. GetPteList returns the Page Table Entries for process pid. If identifyModules is true, vmmdll will attempt to resolve module names for each entry.

func (*Vmm) GetRegistryHives 

func (vmm *Vmm) GetRegistryHives() ([]RegistryHive, error)

GetRegistryHives returns all registry hives present in the memory image. Each hive includes its base address, name, short name, and path.

func (*Vmm) GetRegistrySubKeys 

func (vmm *Vmm) GetRegistrySubKeys(keyPath string) ([]RegistryKey, error)

GetRegistrySubKeys enumerates all sub-keys of the given registry key path. keyPath examples: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

func (*Vmm) GetRegistryValues 

func (vmm *Vmm) GetRegistryValues(keyPath string) ([]RegistryValue, error)

GetRegistryValues enumerates all values of the given registry key path.

func (*Vmm) GetServiceList 

func (vmm *Vmm) GetServiceList() (*ServiceList, error)

GetServiceList retrieves the list of Windows services from the system. Each entry includes the service name, display name, start type, status, image path, and associated PID.

func (*Vmm) GetThreadCallstack 

func (vmm *Vmm) GetThreadCallstack(pid, tid uint32) (*ThreadCallstack, error)

GetThreadCallstack retrieves the callstack for a specific thread.

func (*Vmm) GetThreadList 

func (vmm *Vmm) GetThreadList(pid uint32) (*ThreadList, error)

GetThreadList returns all threads for process pid.

func (*Vmm) GetUnloadedModuleList 

func (vmm *Vmm) GetUnloadedModuleList(pid uint32) (*UnloadedModuleList, error)

GetUnloadedModuleList retrieves the list of unloaded modules for a given process. GetUnloadedModuleList returns modules that were previously loaded and then unloaded in process pid.

func (*Vmm) GetUserList 

func (vmm *Vmm) GetUserList() (*UserList, error)

GetUserList retrieves the list of user accounts found in the memory image. Each entry includes the account name (text), registry hive address, and SID.

func (*Vmm) GetVMList 

func (vmm *Vmm) GetVMList() (*VMList, error)

GetVMList retrieves the list of virtual machines detected by MemProcFS. Returns an empty list (not an error) if no VMs are present (e.g. bare-metal dump).

func (*Vmm) GetVadExList 

func (vmm *Vmm) GetVadExList(pid uint32, oPage uint32, cPage uint32) (*VadExList, error)

GetVadExList retrieves extended per-page VAD information for a process. oPage is the 0-based page offset into the process VAD map; cPage is the number of pages to retrieve.

func (*Vmm) GetVadList 

func (vmm *Vmm) GetVadList(pid uint32, identifyModules bool) (*VadList, error)

GetVadList returns the Virtual Address Descriptor entries for process pid. If identifyModules is true, vmmdll will attempt to resolve module names for each VAD region.

func (*Vmm) HiveReadEx 

func (vmm *Vmm) HiveReadEx(vaCMHive uint64, ra uint32, cb uint32, flags MemFlag) ([]byte, uint32, error)

HiveReadEx reads up to cb bytes from a registry hive at registry address ra. ra is the byte offset within the hive data space (regf header is NOT included). flags: use MemFlagNone (0) for default behaviour; other VMMDLL_FLAG_* values are accepted. Returns the data read and the actual byte count; a short read is not an error.

func (*Vmm) HiveWrite 

func (vmm *Vmm) HiveWrite(vaCMHive uint64, ra uint32, data []byte) error

HiveWrite writes data to a registry hive at registry address ra. Note: requires a live/writable target — will fail on a read-only dump.

func (*Vmm) InitializePlugins 

func (vmm *Vmm) InitializePlugins() error

InitializePlugins loads all available vmmdll plugins. Called automatically by NewVmm; exposed for manual re-initialization.

func (*Vmm) MemPrefetchPages 

func (vmm *Vmm) MemPrefetchPages(pid uint32, addresses []uint64) error

MemPrefetchPages preloads the given virtual addresses into the memory cache. Useful to batch-warm the cache before making multiple smaller reads.

func (*Vmm) MemRead 

func (vmm *Vmm) MemRead(pid uint32, addr uint64, size uint32) ([]byte, error)

MemRead reads size bytes from virtual address addr in process pid. Use pid = 0xFFFFFFFF (PidProcessWithKernelMemory) for kernel/physical reads. Returns an error if any byte in the range is unreadable; use MemReadEx for partial reads.

func (*Vmm) MemReadEx 

func (vmm *Vmm) MemReadEx(pid uint32, addr uint64, size uint32, flags MemFlag) ([]byte, uint32, error)

MemReadEx reads memory with optional flags and reports the actual bytes read. NB: may return success even if fewer than size bytes were read — check bytesRead.

func (*Vmm) MemReadPage 

func (vmm *Vmm) MemReadPage(pid uint32, addr uint64) ([]byte, error)

MemReadPage reads exactly one 4096-byte memory page.

func (*Vmm) MemVirt2Phys 

func (vmm *Vmm) MemVirt2Phys(pid uint32, va uint64) (uint64, error)

MemVirt2Phys translates virtual address va in process pid to a physical address.

func (*Vmm) MemWrite 

func (vmm *Vmm) MemWrite(pid uint32, addr uint64, data []byte) error

MemWrite writes data to virtual address addr in process pid. Note: requires a live/writable target — will fail on a read-only memory dump.

func (*Vmm) PdbLoad 

func (vmm *Vmm) PdbLoad(pid uint32, vaModuleBase uint64) (string, error)

PdbLoad loads the PDB symbol file for the given module and returns the module name used internally (e.g. "nt", "kernel32"). The module name can then be passed to PdbSymbolAddress, PdbTypeSize, etc.

func (*Vmm) PdbSymbolAddress 

func (vmm *Vmm) PdbSymbolAddress(module string, symbolName string) (uint64, error)

PdbSymbolAddress returns the virtual address of a symbol in the given module.

func (*Vmm) PdbSymbolName 

func (vmm *Vmm) PdbSymbolName(module string, addressOrOffset uint64) (string, uint32, error)

PdbSymbolName resolves a symbol name from a virtual address or offset within the given module. Also returns the displacement from the symbol start.

func (*Vmm) PdbTypeChildOffset 

func (vmm *Vmm) PdbTypeChildOffset(module string, typeName string, childName string) (uint32, error)

PdbTypeChildOffset returns the byte offset of a child field within a struct type.

func (*Vmm) PdbTypeSize 

func (vmm *Vmm) PdbTypeSize(module string, typeName string) (uint32, error)

PdbTypeSize returns the byte size of a named type in the given module.

func (*Vmm) RegQueryValueEx 

func (vmm *Vmm) RegQueryValueEx(keyValuePath string) (uint32, []byte, error)

RegQueryValueEx queries a specific registry value by full path. keyValuePath example: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName"

func (*Vmm) ScatterInitialize 

func (vmm *Vmm) ScatterInitialize(pid uint32, flags MemFlag) (*ScatterHandle, error)

ScatterInitialize creates a new scatter handle for the given PID and flags. Use pid = 0xFFFFFFFF to target physical memory. The caller must call Close() to release resources.

func (*Vmm) VfsList 

func (vmm *Vmm) VfsList(path string) ([]VfsEntry, error)

VfsList lists entries in the given MemProcFS virtual path. Path examples: "/", "/sys", "/pid/4/modules"

func (*Vmm) VfsRead 

func (vmm *Vmm) VfsRead(path string, cb uint32, offset uint64) ([]byte, error)

VfsRead reads up to cb bytes from a MemProcFS virtual file at the given offset. Returns the data actually read; a short read is not an error.

func (*Vmm) VfsWrite 

func (vmm *Vmm) VfsWrite(path string, data []byte, offset uint64) error

VfsWrite writes data to a MemProcFS virtual file at the given offset. Note: requires a live/writable target — will fail on a read-only dump.

func (*Vmm) VmGetVmmHandle 

func (vmm *Vmm) VmGetVmmHandle(vm *VmEntry) (*Vmm, error)

VmGetVmmHandle returns a full VMM_HANDLE for the given virtual machine, allowing all standard Vmm methods to be used directly against the VM guest. The returned *Vmm must be closed by calling Close() when no longer needed. Physical-memory-only VMs are not supported.

func (*Vmm) VmMemRead 

func (vmm *Vmm) VmMemRead(vm *VmEntry, qwGPA uint64, cb uint32) ([]byte, error)

VmMemRead reads cb bytes from guest physical address qwGPA inside the VM.

func (*Vmm) VmMemTranslateGPA 

func (vmm *Vmm) VmMemTranslateGPA(vm *VmEntry, qwGPA uint64) (pa uint64, va uint64, err error)

VmMemTranslateGPA translates a VM guest physical address (GPA) to a host physical address (PA) and/or a virtual address (VA) in the host 'vmmem' process. Pass nil for outputs you do not need.

func (*Vmm) VmMemWrite 

func (vmm *Vmm) VmMemWrite(vm *VmEntry, qwGPA uint64, data []byte) error

VmMemWrite writes data to guest physical address qwGPA inside the VM.

func (*Vmm) VmScatterInitialize 

func (vmm *Vmm) VmScatterInitialize(vm *VmEntry) (*ScatterHandle, error)

VmScatterInitialize returns a ScatterHandle for efficient scatter-read/write of guest physical address (GPA) memory inside a virtual machine. The handle must be closed with Close() when no longer needed.

type WinProcessInfo 

type WinProcessInfo struct {
	EPROCESS  uint64
	PEB       uint64
	Reserved1 uint64
	IsWow64   uint32 // BOOL
	PEB32     uint32
	SessionID uint32

	LUID           uint64
	SIDRaw         [260]byte
	IntegrityLevel ProcessIntegrityLevel
	// contains filtered or unexported fields
}

WinProcessInfo mirrors the nested 'win' struct from VMMDLL_PROCESS_INFORMATION

Source Files

View all Source files

Directories

Path Synopsis
internal
ffi

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.