Exemple #1
0
/* convert a VA into a symbol */
const char* vmi_translate_v2ksym(vmi_instance_t vmi, const access_context_t *ctx, addr_t va)
{
    char *ret = NULL;
    addr_t dtb = 0;

    switch(ctx->translate_mechanism) {
        case VMI_TM_PROCESS_PID:
            if ( VMI_FAILURE == vmi_pid_to_dtb(vmi, ctx->pid, &dtb) )
                return NULL;
            break;
        case VMI_TM_PROCESS_DTB:
            dtb = ctx->dtb;
            break;
        default:
            dbprint(VMI_DEBUG_MISC, "v2ksym only supported in a virtual context!\n");
            return NULL;
    };

    if (VMI_FAILURE == rva_cache_get(vmi, ctx->addr, dtb, va, &ret)) {
        if (vmi->os_interface && vmi->os_interface->os_v2ksym) {
            ret = vmi->os_interface->os_v2ksym(vmi, va, ctx);
        }

        if (ret) {
            rva_cache_set(vmi, ctx->addr, dtb, va, ret);
        }
    }

    return ret;
}
Exemple #2
0
/* convert an RVA into a symbol */
const char* vmi_translate_v2sym(vmi_instance_t vmi, addr_t base_vaddr, vmi_pid_t pid, addr_t rva)
{
    char *ret = NULL;

    if (VMI_FAILURE == rva_cache_get(vmi, base_vaddr, pid, rva, &ret)) {
        if (vmi->os_interface && vmi->os_interface->os_rva2sym) {
            ret = vmi->os_interface->os_rva2sym(vmi, rva, base_vaddr, pid);
        }

        if (ret) {
            rva_cache_set(vmi, base_vaddr, pid, rva, ret);
        }
    }

    return ret;
}