/// <summary> /// BLOCK ALIGNED /// </summary> /// <param name="VA"></param> /// <returns>BLOCK of memory (ALIGNED)</returns> public byte[] VGetBlock(long VA) { bool GotData = false; long[] rv = new long[512]; var _va = VA & ~0xfff; HARDWARE_ADDRESS_ENTRY hw; if (vmcs == null) { hw = MemAccess.VirtualToPhysical(CR3Value, _va); } else { hw = MemAccess.VirtualToPhysical(vmcs.EPTP, CR3Value, _va); } MemAccess.GetPageForPhysAddr(hw, ref rv, ref GotData); if (!GotData) { return(null); } byte[] buffer = new byte[4096]; Buffer.BlockCopy(rv, 0, buffer, 0, 4096); return(buffer); }
/// <summary> /// BLOCK ALIGNED /// </summary> /// <param name="VA"></param> /// <returns></returns> public byte[] VGetBlock(long VA) { bool GotData = false; long[] rv = new long[512]; byte[] buffer = new byte[4096]; var _va = VA & ~0xfff; HARDWARE_ADDRESS_ENTRY hw; if (vmcs == null) { hw = MemAccess.VirtualToPhysical(CR3Value, _va); } else { hw = MemAccess.VirtualToPhysical(vmcs.EPTP, CR3Value, _va); } //unsafe //{ //fixed (void* lp = rv, bp = buffer) //{ MemAccess.GetPageForPhysAddr(hw, ref rv, ref GotData, true); Buffer.BlockCopy(rv, 0, buffer, 0, 4096); //Buffer.MemoryCopy((byte*)lp, (byte*)bp, 4096, 4096); //} //} return(buffer); }
/// <summary> /// See all other PAGE ALIGNED /// </summary> /// <param name="VA"></param> /// <param name="GotData"></param> /// <returns></returns> public long[] VGetBlockLong(long VA, ref bool GotData) { long[] rv = new long[512]; var _va = VA & ~0xfff; HARDWARE_ADDRESS_ENTRY hw; if (vmcs == null) { hw = MemAccess.VirtualToPhysical(CR3Value, _va); } else { hw = MemAccess.VirtualToPhysical(vmcs.EPTP, CR3Value, _va); } MemAccess.GetPageForPhysAddr(hw, ref rv, ref GotData); return(rv); }
public List <ScanResult> YaraScan(string RulesFile, bool IncludeData = false, bool KernelSpace = false) { var rv = new List <ScanResult>(); using (var ctx = new YaraContext()) { Rules rules = null; try { // Rules and Compiler objects must be disposed. using (var compiler = new Compiler()) { compiler.AddRuleFile(RulesFile); rules = compiler.GetRules(); } PageTable.AddProcess(this, MemAccess); //var cnt = PT.FillPageQueue(false, KernelSpace); var curr = 0; YaraTotalScanned = 0; // single threaded worked best so far //Parallel.For(0, cnt, (i, loopState) => x foreach (var range in PT.FillPageQueue(false, KernelSpace, true, false)) //for (int i = 0; i < cnt; i++) { curr++; if (Vtero.VerboseLevel > 1) { //var curr = cnt - PT.PageQueue.Count; //var done = Convert.ToDouble(curr) / Convert.ToDouble(cnt) * 100.0; Console.CursorLeft = 0; Console.Write($"{curr} scanned"); } if (range.PTE.Valid) { // skip data as requested if (!IncludeData && range.PTE.NoExecute) { continue; } // Scanner and ScanResults do not need to be disposed. var scanner = new libyaraNET.Scanner(); unsafe { long[] block = null; bool GotData = false; if (range.PTE.LargePage) { block = new long[0x40000]; } else { block = new long[0x200]; } MemAccess.GetPageForPhysAddr(range.PTE, ref block, ref GotData); if (GotData) { fixed(void *lp = block) { var res = scanner.ScanMemory((byte *)lp, block.Length, rules, ScanFlags.None); rv.AddRange(res); YaraTotalScanned += block.Length; } } } } } } finally { // Rules and Compiler objects must be disposed. if (rules != null) { rules.Dispose(); } } } YaraOutput = rv; return(YaraOutput); }
private static extern IntPtr OpenFileMappingW([In, MarshalAs(UnmanagedType.U4)] MemAccess dwDesiredAccess, [In, MarshalAs(UnmanagedType.U1)] bool bInheritHandle, string lpName);
private static extern IntPtr MapViewOfFile(IntPtr hFileMapping, [In, MarshalAs(UnmanagedType.U4)] MemAccess dwDesiredAccess, int dwFileOffsetHi, int dwFileOffsetLo, int dwNumberOfBytesToMap);