GitHub PushEvent at 2014-07-09 16:27:13
Repository: libvmi
Actor: awsaba
Payload: {"shas":[["17e7db78ffa6b2f4dce9c8d1e66cfe737a377f9e","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Windows kpgd lookup method0 and method1 are _only_ functional if the CR3 value is returned by the driver. This fact has been a bit buried via the use of kv2p which falls back to the driver as well to get a dtb. It is however a very quirky setup where kernel memory accesses are sometimes translated via the CR3 value (while vmi->kpgd isn't know) and then by the kernel page table. This PR disallows the use kv2p while the real kernel pgd is unknown to provide a more consistent setup.","Tamas K Lengyel",true],["94a06fc28c9cb17567c20da3b3465824de0393cf","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","vmi_read_addr_* is only meaningful if the width of the addr is known. The existing setup always fell back on 32-bit addr width when the page mode is unknown, thus breaking file-mode on 64-bit memory dumps. This patch fixes this issue by employing heuristics during page mode detection in Windows to check if we have 32-bit or 64-bit addresses.","Tamas K Lengyel",true],["5b6d20cdd9ca3c12e68de1d9e08928b8dfdceebd","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Introduce generic memory access functions via the access_context_t structure","Tamas K Lengyel",true],["378eed0123fe73ea65b62ede63041aa1dce3a572","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Reduce code-duplication in read.c","Tamas K Lengyel",true],["2488f3930f59354368fe0192a75a5c0f9c9ee980","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Reduce code-duplication in write.c","Tamas K Lengyel",true],["0faceed659be6c43657e84c29c806d0dc3a2ca35","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Add example of using access_context_t and vmi_get_va_pages","Tamas K Lengyel",true],["d5d3decabb00575d0dece262a8c522ce8ed9cf1e","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Introduce vmi_write_addr_* functions","Tamas K Lengyel",true],["64d0171523dfbbe2da32e759637ab87c52c16682","1325848428a11d02d61e74c9fc70463b249798b7@tum.de","Extra debug/error output and formatting","Tamas K Lengyel",true],["a44ba6ddacad48e38f52410def88833cb3dc70e3","f36ca40c34247f32b94fba89a7093e7e2faf27a0@gmail.com","Merge pull request #168 from tklengyel/read_write2\n\nIntroduce generic memory access functions","Antony Saba",true]],"size":9,"ref":"refs/heads/master","head":"a44ba6ddacad48e38f52410def88833cb3dc70e3"}