status_t windows_kpcr_lookup( vmi_instance_t vmi, char *symbol, addr_t *address) { unsigned long offset = 0; if (!vmi->os.windows_instance.kdversion_block) { if (VMI_FAILURE == init_kdversion_block(vmi)) { goto error_exit; } } // Use heuristic to find windows version addr_t kdvb_p = vmi_translate_kv2p(vmi, vmi->os.windows_instance.kdversion_block); vmi->os.windows_instance.version = find_windows_version(vmi, kdvb_p); if (VMI_FAILURE == kpcr_symbol_offset(vmi, symbol, &offset)) { goto error_exit; } if (VMI_FAILURE == kpcr_symbol_resolve(vmi, offset, address)) { goto error_exit; } return VMI_SUCCESS; error_exit: return VMI_FAILURE; }
status_t windows_kpcr_lookup (vmi_instance_t vmi, char *symbol, addr_t *address) { unsigned long offset = 0; if (!vmi->os.windows_instance.kdversion_block){ if (VMI_FAILURE == init_kdversion_block(vmi)){ goto error_exit; } } if (VMI_FAILURE == kpcr_symbol_offset(vmi, symbol, &offset)){ goto error_exit; } if (VMI_FAILURE == kpcr_symbol_resolve(vmi, offset, address)){ goto error_exit; } return VMI_SUCCESS; error_exit: return VMI_FAILURE; }