#memflow #memory #introspection #dma #api-bindings

memflow-ffi

C bindings for the memflow physical memory introspection framework

14 releases

0.2.0 Dec 25, 2023
0.2.0-beta8 Oct 30, 2022
0.2.0-beta7 Jul 24, 2022
0.2.0-beta5 Mar 20, 2022
0.0.0 Jul 16, 2020

#482 in Memory management

Download history 15/week @ 2024-02-26 8/week @ 2024-03-11 68/week @ 2024-04-01

68 downloads per month
Used in memflow-win32-ffi

MIT license

700KB
13K SLoC

memflow-ffi

Crates.io build and test codecov MIT licensed Discord

The memflow FFI crate provides an interface to the memflow API for C/C++. Currently a single memflow.h file is generated aside from the dynamic library that can be used to interact with memflow.

A simple example that initializes the library:

#include "memflow.h"
#include <stdio.h>

int main(int argc, char *argv[]) {
	log_init(4);

	ConnectorInventory *inv = inventory_try_new();
	printf("inv: %p\n", inv);

	const char *conn_name = argc > 1? argv[1]: "kvm";
	const char *conn_arg = argc > 2? argv[2]: "";

	CloneablePhysicalMemoryObj *conn =
        inventory_create_connector(inv, conn_name, conn_arg);
	printf("conn: %p\n", conn);

	if (conn) {
		PhysicalMemoryObj *phys_mem = downcast_cloneable(conn);
		printf("phys_mem: %p\n", phys_mem);

		uint64_t read = phys_read_u64(phys_mem, addr_to_paddr(0x30000));

		printf("Read: %lx\n", read);

		phys_free(phys_mem);

		connector_free(conn);
		printf("conn freed!\n");
	}

	inventory_free(inv);
	printf("inv freed!\n");

	return 0;
}

Additional examples can be found in the examples folder.

Dependencies

~6–15MB
~176K SLoC