Only grab 4mb page when pse is set
Fix using non-existent xc function
Merge pull request #162 from tklengyel/pse

Only grab 4mb page when pse is set
Merge pull request #164 from tklengyel/event_fix

Fix using non-existent xc functions in events
Install x86.h to help interpret Intel specific paging flags when inspecting the paging structures
Move Windows unicode read-code into the OS specific layer
Merge pull request #165 from tklengyel/intel_page_bits

Install x86.h to help interpret Intel specific paging flags when inspect...
Merge pull request #166 from tklengyel/unicode

Move Windows unicode read-code into the OS specific layer
Minor compile-time fix for SHM snapshot mode that wasn't caught when vmi_get_va_pages switched to page_info_t
Address XSA-99 issue: the event ring is still accessible by the guest
Merge pull request #170 from tklengyel/xsa99

Address XSA-99 issue: the event ring is still accessible by the guest
Merge pull request #169 from tklengyel/shm_fix

Minor compile-time fix for SHM snapshot mode that wasn't caught when vmi...
Switch dom_info structure from being malloced to be on the stack so we need less logic to keep track of its memory
Checking pre-conditions for find_page_mode.
Prevent VMI_ERROR for FILE mode.

The methods for finding config values that require
virtual translations will not work for FILE mode,
so skips them to prevent the VMI_ERROR from being
printed.

Also prevents the suggestion for setting win_kdvb
from being printed in some cases where it is
present in the config, but was not enough to be
useful because of FILE mode or some other value
was missing.

Attempts to clear up how various combinations
of config values can be used and sanity checks
them against each other as much as possible.
Merge pull request #171 from tklengyel/switch_dom_info

Switch dom_info structure from being malloced to be on the stack so we n...
Merge pull request #172 from awsaba/arch_init_file_mode_fix

Prevent a VMI ERROR from being printed when using FILE mode
Windows kpgd lookup method0 and method1 are _only_ functional if the CR3 value is returned by the driver. This fact has been a bit buried via the use of kv2p which falls back to the driver as well to get a dtb. It is however a very quirky setup where kernel memory accesses are sometimes translated via the CR3 value (while vmi->kpgd isn't know) and then by the kernel page table. This PR disallows the use kv2p while the real kernel pgd is unknown to provide a more consistent setup.
vmi_read_addr_* is only meaningful if the width of the addr is known. The existing setup always fell back on 32-bit addr width when the page mode is unknown, thus breaking file-mode on 64-bit memory dumps. This patch fixes this issue by employing heuristics during page mode detection in Windows to check if we have 32-bit or 64-bit addresses.
Introduce generic memory access functions via the access_context_t structure