Windows kpgd lookup method0 and method1 are _only_ functional if the CR3 value is returned by the driver. This fact has been a bit buried via the use of kv2p which falls back to the driver as well to get a dtb. It is however a very quirky setup where kernel memory accesses are sometimes translated via the CR3 value (while vmi->kpgd isn't know) and then by the kernel page table. This PR disallows the use kv2p while the real kernel pgd is unknown to provide a more consistent setup.
vmi_read_addr_* is only meaningful if the width of the addr is known. The existing setup always fell back on 32-bit addr width when the page mode is unknown, thus breaking file-mode on 64-bit memory dumps. This patch fixes this issue by employing heuristics during page mode detection in Windows to check if we have 32-bit or 64-bit addresses.
Introduce generic memory access functions via the access_context_t structure
Reduce code-duplication in read.c
Reduce code-duplication in write.c
Add example of using access_context_t and vmi_get_va_pages
Introduce vmi_write_addr_* functions