lixksym.h File Reference

#include "introcore.h"

Go to the source code of this file.

Functions
INTSTATUS	IntKsymInit (void)
	Initialize the kallsyms subsystem based on the os info provided by LIX_FIELD(Info, HasKsym*). More...
QWORD	IntKsymFindByName (const char *Name, QWORD *SymEnd)
	Searches the given Name in kallsyms and returns the Start & End offset. More...
INTSTATUS	IntKsymFindByAddress (QWORD Gva, DWORD Length, char *SymName, QWORD *SymStart, QWORD *SymEnd)
	Finds the symbol which is located at the given address. More...
void	IntKsymUninit (void)

Function Documentation

IntKsymFindByAddress()

INTSTATUS IntKsymFindByAddress	(	QWORD	Gva,
		DWORD	Length,
		char *	SymName,
		QWORD *	SymStart,
		QWORD *	SymEnd
	)

Finds the symbol which is located at the given address.

If there are multiple symbols starting at the same address only the last one will be taken into account.

Parameters

[in]	Gva	The address of the searched symbol.
[in]	Length	SymName buffer size.
[out]	SymName	Buffer which will store the symbol name.
[out]	SymStart	The symbol start address.
[out]	SymEnd	The symbol end address (makes sense only for function names).

Returns

INT_STATUS_SUCCESS if the symbol was found

INT_STATUS_NOT_FOUND if the symbol was not found

INT_STATUS_UNSUCCESSFUL if any error occurred

INT_STATUS_INVALID_PARAMETER if and invalid parameter was given.

INT_STATUS_INVALID_INTERNAL_STATE if the active OS type is not Linux.

INT_STATUS_NOT_INITIALIZED if this function is called before IntKsymInit or after IntKsymUninit.

Definition at line 1283 of file lixksym.c.

Referenced by DbgFindKsym(), IntDisasmBuffer(), IntDisasmGva(), IntExceptKernelLogLinuxInformation(), IntExceptPrintMsrInfo(), IntLixAgentError(), IntLixAgentThreadError(), IntLixDrvSendViolationEvent(), IntLixDumpStacktrace(), IntLixGuestAgentContentHandler(), IntLixGuestDetourDataHandler(), IntLixKernelHandleRead(), and IntLixPatchSwapgs().

IntKsymFindByName()

QWORD IntKsymFindByName	(	const char *	Name,
		QWORD *	SymEnd
	)

Searches the given Name in kallsyms and returns the Start & End offset.

If the symbol represents a variable, then the SymEnd may be wrong (we return the address of the next symbol). Supports a very basic regex: '*' at the end means we will do a memcmp only until there.

Parameters

[in]	Name	The name of the symbol to be found
[out]	SymEnd	Upon successfully return will contain the address of the following symbol (if not NULL)

Returns

The GVA of the given symbol on success or 0 if the symbol was not found

Definition at line 1399 of file lixksym.c.

Referenced by DbgFindKsym(), IntDisasmLixFunction(), IntLixAgentResolveOffset(), IntLixApiHijackHook(), IntLixApiHook(), IntLixCrashFetchDmesgSymbol(), IntLixFindDataStart(), IntLixGetInitTask(), IntLixGuestAllocateDeploy(), IntLixGuestFindPgd(), IntLixGuestGetSystemState(), IntLixGuestInit(), IntLixGuestResolveExTableLimits(), IntLixGuestResolveSymbols(), IntLixMmGetInitMm(), IntLixPatchSwapgs(), IntLixResolveCurrentCpuOffset(), IntLixResolveCurrentProcessOffset(), IntLixResolveExeFileOffset(), IntLixResolveThreadStructOffset(), IntLixVdsoDynamicProtect(), IntLixVdsoResolveDynamicOffset(), and IntLixVdsoResolveImageAddress().

IntKsymInit()

INTSTATUS IntKsymInit

(

void

)

Initialize the kallsyms subsystem based on the os info provided by LIX_FIELD(Info, HasKsym*).

Before calling this function the following subsystem must be fully initialized.

• gGuest
• Linux kernel layout
• Mm subsystem
• CAMI subsystem

Returns

INT_STATUS_SUCCESS if the initialization completed without any errors.

INT_STATUS_INSUFFICIENT_RESOURCES if there is not enough available memory.

INT_STATUS_NOT_FOUND if any guest structures were not found.

INT_STATUS_INVALID_DATA_STATE if any structure was found in an unexpected state.

INT_STATUS_INVALID_INTERNAL_STATE if the active OS type is not Linux.

Definition at line 1046 of file lixksym.c.

Referenced by IntLixGuestInit().

IntKsymUninit()

void IntKsymUninit

(

void

)

Tries to free the kallsyms internal buffers if they are initialized.

Definition at line 1256 of file lixksym.c.

Referenced by IntLixGuestNew(), and IntLixGuestUninit().