spcecified starts ¥n",params->cp.name); target_cr3=params->cp.cr3; /// @ingroup hookapi /// install a hook at the function entry by specifying module name and function name /// @param mod module name that this function is located in /// @param func function name /// @param is_global flag specifies if this hook should be invoked globally or only in certain execution context (when should_monitor is true) /// @param cr3 the memory space that this hook is installed. 0 for all memory spaces. /// @param fnhook address of function hook /// @param opaque address of an opaque structure provided by caller (has to be globally allocated) /// @param sizeof_opaque size of the opaque structure (if opaque is an integer, not a pointer to a structure, sizeof_opaque must be zero) /// @return a handle that uniquely identifies this hook /// Note that the handle that is returned, might not actually be active yet - you can check the eip value of the handle to find out /// the default value is 0. ntcreatefile_handle = hookapi_hook_function_byname( "ntdll.dll", "NtCreateFile", 1, target_cr3, NtCreateFile_call, NULL, 0); } }
given instruction belongs to /// @param eip virtual address of a given instruction /// @param cr3 memory space id: physical address of page table /// @param proc process name (output argument) /// @param tm return tmodinfo_t structure extern int VMI_locate_module_c(gva_t eip, gva_t cr3, char proc[],tmodinfo_t *tm); extern int VMI_locate_module_byname_c(const char *name, uint32_t pid,tmodinfo_t * tm); extern int VMI_find_cr3_by_pid_c(uint32_t pid); extern int VMI_find_pid_by_cr3_c(uint32_t cr3); extern int VMI_find_pid_by_name_c(char* proc_name);
space id /// @param cr3 memory space id: physical address of page table /// @param proc process name (output argument) /// @param pid process pid (output argument) /// @return number of modules in this process extern int VMI_find_process_by_cr3_c(uint32_t cr3, char proc_name[], size_t len, uint32_t *pid);
as search key */ extern int VMI_find_process_by_pid_c(uint32_t pid, char proc_name[], size_t len, uint32_t *cr3); extern int VMI_get_proc_modules_c(uint32_t pid, uint32_t mod_no, tmodinfo_t *buf); extern int VMI_get_all_processes_count_c(void); /* Create array with info about all processes running in system */ extern int VMI_find_all_processes_info_c(size_t num_proc, procinfo_t *arr); //Aravind - added to get the number of loaded modules for the process. //This is needed to create the memory required by get_proc_modules extern int VMI_get_loaded_modules_count_c(uint32_t pid); //end - Aravind
If for some reason, this operation / // is not successful, the return value is set to -1. /// This function only works in Windows XP for Now. extern int VMI_get_current_tid_c(CPUState* env); //0 unknown 1 windows 2 linux extern int VMI_get_guest_version_c(void);