Bitdefender Hypervisor Memory Introspection
|
Data Fields | |
LIST_ENTRY | Link |
List entry element. More... | |
QWORD | Cr3 |
Virtual address space from where we read memory. More... | |
QWORD | VirtualAddress |
Guest virtual address to be read. More... | |
QWORD | PhysicalAddress |
Guest physical address, once we get a translation. More... | |
PBYTE | Data |
memory will be read. More... | |
DWORD | DataMaxSize |
Maximum data size to be read. More... | |
DWORD | DataCurrentSize |
How much we've read so far. More... | |
DWORD | Flags |
Transaction flags. Take a look at SWAPMEM_FLAG* for more info. More... | |
DWORD | Options |
Transaction options. Take a look at SWAPMEM_OPT* for more info. More... | |
DWORD | ContextTag |
freed. More... | |
void * | Context |
Options context to be passed to the callbacks. More... | |
BOOLEAN | IsEnqueued |
transactions list. More... | |
BOOLEAN | IsCanceled |
True if the transaction has been canceled. More... | |
LIST_HEAD | Pages |
List of pages to be read (list of SWAPMEM_PAGE). More... | |
PFUNC_PagesReadCallback | Callback |
Callback called as soon as all the requested data is available. More... | |
PFUNC_PreInjectCallback | PreInject |
returns INT_STATUS_NOT_NEEDED_HINT, the PF will be canceled. More... | |
This context is used only internally. It represents a swapmem transaction. A transaction is a request to read a contiguous portion of guest virtual memory, parts of which may not be present in physical memory.
PFUNC_PagesReadCallback _SWAPMEM_TRANSACTION::Callback |
Callback called as soon as all the requested data is available.
Definition at line 66 of file swapmem.c.
Referenced by IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
void* _SWAPMEM_TRANSACTION::Context |
Options context to be passed to the callbacks.
Definition at line 61 of file swapmem.c.
Referenced by IntSwapMemCleanupCallback(), IntSwapMemInjectPendingPF(), IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
DWORD _SWAPMEM_TRANSACTION::ContextTag |
freed.
If tag is not zero, on transactions cleanup, the context will be
Definition at line 59 of file swapmem.c.
Referenced by IntSwapMemCleanupCallback(), IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
QWORD _SWAPMEM_TRANSACTION::Cr3 |
Virtual address space from where we read memory.
Definition at line 50 of file swapmem.c.
Referenced by IntSwapMemCancelPendingPF(), IntSwapMemDump(), IntSwapMemFindPendingPage(), IntSwapMemInjectPendingPF(), IntSwapMemPageSwappedIn(), IntSwapMemReadData(), IntSwapMemReinjectFailedPF(), and IntSwapMemRemoveTransactionsForVaSpace().
PBYTE _SWAPMEM_TRANSACTION::Data |
memory will be read.
Pointer to a region of Introcore memory where the guest memory
Definition at line 53 of file swapmem.c.
Referenced by IntSwapMemCleanupCallback(), IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
DWORD _SWAPMEM_TRANSACTION::DataCurrentSize |
How much we've read so far.
Definition at line 56 of file swapmem.c.
Referenced by IntSwapMemDump(), IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
DWORD _SWAPMEM_TRANSACTION::DataMaxSize |
Maximum data size to be read.
Definition at line 55 of file swapmem.c.
Referenced by IntSwapMemDump(), IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
DWORD _SWAPMEM_TRANSACTION::Flags |
Transaction flags. Take a look at SWAPMEM_FLAG* for more info.
Definition at line 57 of file swapmem.c.
Referenced by IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
BOOLEAN _SWAPMEM_TRANSACTION::IsCanceled |
True if the transaction has been canceled.
Definition at line 64 of file swapmem.c.
Referenced by IntSwapMemPageSwappedIn().
BOOLEAN _SWAPMEM_TRANSACTION::IsEnqueued |
transactions list.
True if the transaction has been inserted in the global
Definition at line 62 of file swapmem.c.
Referenced by IntSwapMemPageSwappedIn(), IntSwapMemReadData(), IntSwapMemRemoveTransaction(), and IntSwapMemRemoveTransactionsForVaSpace().
LIST_ENTRY _SWAPMEM_TRANSACTION::Link |
List entry element.
Definition at line 49 of file swapmem.c.
Referenced by IntSwapMemCancelTransaction(), IntSwapMemDump(), IntSwapMemFindPendingPage(), IntSwapMemInjectPendingPF(), IntSwapMemPageSwappedIn(), IntSwapMemReadData(), IntSwapMemRemoveTransaction(), and IntSwapMemRemoveTransactionsForVaSpace().
DWORD _SWAPMEM_TRANSACTION::Options |
Transaction options. Take a look at SWAPMEM_OPT* for more info.
Definition at line 58 of file swapmem.c.
Referenced by IntSwapMemDump(), IntSwapMemInjectPendingPF(), and IntSwapMemReadData().
LIST_HEAD _SWAPMEM_TRANSACTION::Pages |
List of pages to be read (list of SWAPMEM_PAGE).
Definition at line 65 of file swapmem.c.
Referenced by IntSwapMemDump(), IntSwapMemFindPendingPage(), IntSwapMemInjectPendingPF(), and IntSwapMemReadData().
QWORD _SWAPMEM_TRANSACTION::PhysicalAddress |
Guest physical address, once we get a translation.
Definition at line 52 of file swapmem.c.
Referenced by IntSwapMemPageSwappedIn(), and IntSwapMemReadData().
PFUNC_PreInjectCallback _SWAPMEM_TRANSACTION::PreInject |
returns INT_STATUS_NOT_NEEDED_HINT, the PF will be canceled.
Callback called before injecting a PF inside the guest. If this
Definition at line 67 of file swapmem.c.
Referenced by IntSwapMemInjectPendingPF(), and IntSwapMemReadData().
QWORD _SWAPMEM_TRANSACTION::VirtualAddress |
Guest virtual address to be read.
Definition at line 51 of file swapmem.c.
Referenced by IntSwapMemDump(), IntSwapMemPageSwappedIn(), IntSwapMemReadData(), and IntSwapMemRemoveTransactionsForVaSpace().