#memflow #introspection #memory #dma

no-std memflow-win32

win32 integration of the memflow physical memory introspection framework

11 releases

0.2.0-beta9 Nov 4, 2022
0.2.0-beta7 Jul 24, 2022
0.2.0-beta4 Mar 18, 2022
0.2.0-beta10 Mar 24, 2023
0.0.0 Jul 16, 2020

#399 in Operating systems

Download history 31/week @ 2023-07-26 13/week @ 2023-08-02 26/week @ 2023-08-09 52/week @ 2023-08-16 142/week @ 2023-08-23 19/week @ 2023-08-30 56/week @ 2023-09-06 26/week @ 2023-09-13 24/week @ 2023-09-20 29/week @ 2023-09-27 31/week @ 2023-10-04 31/week @ 2023-10-11 25/week @ 2023-10-18 39/week @ 2023-10-25 40/week @ 2023-11-01 62/week @ 2023-11-08

171 downloads per month
Used in 5 crates

MIT license

130KB
2.5K SLoC

memflow-win32

Crates.io build and test codecov MIT licensed Discord

This crate provides integration for win32 targets for memflow. This library can be used in addition to the memflow core itself read processes, modules, drivers, etc.

Example initializing a win32 target:

use std::fs::File;
use std::io::Write;

use log::{error, Level};

use memflow::connector::*;
use memflow_win32::win32::{Kernel, Win32OffsetFile};

pub fn main() {
    let connector_name = std::env::args().nth(1).unwrap();
    let connector_args = std::env::args().nth(2).unwrap_or_default();

    // create inventory + connector
    let inventory = unsafe { ConnectorInventory::try_new() }.unwrap();
    let connector = unsafe {
        inventory.create_connector(
            &connector_name,
            &ConnectorArgs::parse(&connector_args).unwrap(),
        )
    }
    .unwrap();

    // initialize kernel
    let kernel = Kernel::builder(connector)
        .build_default_caches()
        .build()
        .unwrap();

    println!("{:?}", kernel);
}

Additional examples can be found in the examples subdirectory.

Dependencies

~7–9.5MB
~181K SLoC