1 Star 0 Fork 0

pelin0963 / MemProcFS.wiki

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
API_Rust.md 1.76 KB
一键复制 编辑 原始数据 按行查看 历史
ufrisk 提交于 2023-03-02 18:21 . Guide Update

Rust API

Most functionality in the Memory Process File System is made available in a easy-to-use convenient Rust API for the use by developers. The Rust API is a wrapper around the native C/C++ API with some extras.

Crate and API Documentation:

The MemProcFS Rust API is published as the memprocfs crate at crates.io - which makes it very easy to include in your memory analysis projects!

Check out the API documentation at docs.rs.

Example projects:

Check out the example project and the example MemProcFS plugin.

Quick Examples:

// Initialize MemProcFS on Linux targeting a live Windows system
// by reading memory using a PCILeech PCIe FPGA hardware device.
// After initialization list all processes.
let mut args = ["-printf", "-device", "fpga"].to_vec();
let vmm = Vmm::new("/home/user/memprocfs/vmm.so", &args)?
if let Ok(process_all) = vmm.process_list() {
    for process in &*process_all {
        println!("{} : {}", process.pid, process.info()?.name);
    }
}
// Initialize MemProcFS on Windows - analyzing a memory dump file.
// Also trigger the forensic mode and scan for VMs.
// List all processes in the virtual file system directory /name/.
let mut args = ["-printf", "-forensic", "1", "-vm",
                "-device", "C:\\dumps\\memory.dmp"].to_vec();
let vmm = Vmm::new("C:\\MemProcFS\\vmm.dll", &args)?
if let Ok(vfs_all) = vmm.vfs_list("/name/") {
    println!("Number of files/directories: {}.", vfs_all.len());
    for vfs in &*vfs_all {
        println!("{vfs}");
    }
}
1
https://gitee.com/pelin0963/MemProcFS-wiki.git
git@gitee.com:pelin0963/MemProcFS-wiki.git
pelin0963
MemProcFS-wiki
MemProcFS.wiki
master

搜索帮助

53164aa7 5694891 3bd8fe86 5694891