#memflow #introspection #memory #dma

memflow-ffi

C bindings for the memflow physical memory introspection framework

5 releases

new 0.1.4 Nov 20, 2020
0.1.3 Oct 8, 2020
0.1.1 Sep 5, 2020
0.1.0 Sep 1, 2020
0.0.0 Jul 16, 2020

#4 in #introspection

45 downloads per month
Used in memflow-win32-ffi

Custom license

325KB
7K SLoC

memflow-ffi

Crates.io build and test codecov MIT licensed Discord

The memflow FFI crate provides an interface to the memflow API for C/C++. Currently a single memflow.h file is generated aside from the dynamic library that can be used to interact with memflow.

A simple example that initializes the library:

#include "memflow.h"
#include <stdio.h>

int main(int argc, char *argv[]) {
	log_init(4);

	ConnectorInventory *inv = inventory_try_new();
	printf("inv: %p\n", inv);

	const char *conn_name = argc > 1? argv[1]: "kvm";
	const char *conn_arg = argc > 2? argv[2]: "";

	CloneablePhysicalMemoryObj *conn =
        inventory_create_connector(inv, conn_name, conn_arg);
	printf("conn: %p\n", conn);

	if (conn) {
		PhysicalMemoryObj *phys_mem = downcast_cloneable(conn);
		printf("phys_mem: %p\n", phys_mem);

		uint64_t read = phys_read_u64(phys_mem, addr_to_paddr(0x30000));

		printf("Read: %lx\n", read);

		phys_free(phys_mem);

		connector_free(conn);
		printf("conn freed!\n");
	}

	inventory_free(inv);
	printf("inv freed!\n");

	return 0;
}

Additional examples can be found in the examples folder as well as in the memflow-win32-ffi crate.

Dependencies

~2.5MB
~43K SLoC