vmi_read_addr_ksym

status_t
vmi_read_addr_ksym(
    vmi_instance_t vmi,
    const char *sym,
    addr_t *value)
{
    status_t ret = VMI_FAILURE;
 
#ifdef ENABLE_SAFETY_CHECKS
    if (!vmi) {
        dbprint(VMI_DEBUG_READ, "--%s: vmi passed as NULL, returning without read",
                __FUNCTION__);
        return VMI_FAILURE;
    }
#endif
 
    switch (vmi->page_mode) {
        case VMI_PM_AARCH64:// intentional fall-through
        case VMI_PM_IA32E:
            ret = vmi_read_ksym(vmi, sym, 8, value, NULL);
            break;
        case VMI_PM_AARCH32:// intentional fall-through
        case VMI_PM_LEGACY: // intentional fall-through
        case VMI_PM_PAE: {
            uint32_t tmp = 0;
            ret = vmi_read_ksym(vmi, sym, 4, &tmp, NULL);
            *value = 0;
            *value = (addr_t) tmp;
            break;
        }
        default:
            dbprint(VMI_DEBUG_READ,
                    "--%s: unknown page mode, can't read addr as width is unknown",
                    __FUNCTION__);
            break;
    }
 
    return ret;
}

status_t
vmi_read_ksym(
    vmi_instance_t vmi,
    const char *sym,
    size_t count,
    void *buf,
    size_t *bytes_read)
{
    ACCESS_CONTEXT(ctx,
                   .translate_mechanism = VMI_TM_KERNEL_SYMBOL,
                   .pm = vmi->page_mode,
                   .ksym = sym);
 
    return vmi_read(vmi, &ctx, count, buf, bytes_read);
}

---

🌱 Back to Garden