Functions — github.com/MemNixFS/MemNixFS

CodeHub MCPcopy Create free account

hub / github.com/MemNixFS/MemNixFS / functions

Functions777 in github.com/MemNixFS/MemNixFS

⨍ Functions 777◇ Types & classes 234

↓ 390 callersMethodsize

kernel VA of struct file, 0 = anonymous

src/os/linux/vma.h:18

↓ 288 callersMethodfield_offset

src/symbols/isf_symbols.cpp:147

↓ 177 callersFunctionkva_read_pod

src/os/linux/kva_reader.h:39

↓ 160 callersMethodadd

src/vfs/vfs.h:128

↓ 151 callersMethodsize

src/vfs/vfs.cpp:15

↓ 122 callersFunctiondebug

src/core/log.h:26

↓ 94 callersMethodfind

find() handles synthesised "<hex>" / "<hex>.txt" children; everything else (including README.txt) falls through to DirNode::find().

src/os/linux/v2p_misc.cpp:168

↓ 90 callersFunctionwarn

src/core/log.h:38

↓ 74 callersFunctioninfo

src/core/log.h:30

↓ 70 callersFunctionthrow_error

src/core/error.h:14

↓ 44 callersMethodread

src/os/linux/kern_va_stream.cpp:10

↓ 42 callersMethodfind_symbol

src/symbols/isf_symbols.cpp:143

↓ 39 callersFunctionread_struct_u64

Read a u64 from a kernel struct that lives in the direct map (e.g. mm_struct).

src/os/linux/task_files.cpp:52

↓ 33 callersMethodget

Returns pointer to decompressed bytes for the frame keyed by frame_index. The pointer is valid until the next get() that triggers eviction; callers sh

src/formats/avml_format.cpp:56

↓ 33 callersFunctionkva_read

src/os/linux/kva_reader.cpp:71

↓ 30 callersMethodfind

src/vfs/vfs.cpp:12

↓ 28 callersMethodmax_address

src/formats/raw_format.cpp:14

↓ 26 callersMethodsize

src/formats/phys_raw_stream.h:26

↓ 24 callersMethodread_pod

src/arch/x86_64/paging.h:22

↓ 23 callersFunctioncsv_quote

src/os/linux/csv_export.cpp:16

↓ 21 callersFunctioncontains_ci

src/os/linux/banner_scan.cpp:13

↓ 21 callersFunctionset_last_error

src/api/lmpfs.cpp:52

↓ 17 callersMethodread

src/vfs/vfs.cpp:18

↓ 17 callersFunctionvalidate_recovered_fs_path

src/os/linux/pagecache.cpp:1066

↓ 16 callersFunctionkread_pod

src/os/linux/dmesg.cpp:93

↓ 15 callersFunctionfind_cmd

tests/unit/shell_history_test.cpp:33

↓ 15 callersMethodis_dir

src/vfs/vfs.h:70

↓ 14 callersFunctionkread_pod

src/os/linux/fdtable.cpp:46

↓ 13 callersFunctionerror

src/core/log.h:42

↓ 13 callersFunctionnote

src/core/log.h:34

↓ 12 callersFunctioncheck

src/api/lmpfs.cpp:79

↓ 12 callersFunctionclear_last_error

src/api/lmpfs.cpp:51

↓ 12 callersFunctionemit

src/core/log.cpp:39

↓ 12 callersFunctionset_last_error_fmt_what

src/api/lmpfs.cpp:56

↓ 12 callersFunctionseverity_rank

src/os/linux/findevil.cpp:682

↓ 11 callersFunctionread_struct_u32

src/os/linux/task_files.cpp:59

↓ 10 callersFunctionenumerate_cached_inodes

src/os/linux/pagecache.cpp:776

↓ 10 callersFunctionenumerate_vmas

src/os/linux/vma.cpp:151

↓ 10 callersFunctionformat_warm_duration

src/vfs/forensic_warmer.cpp:17

↓ 10 callersMethodis_file

src/vfs/vfs.h:71

↓ 10 callersFunctionread_dm

src/os/linux/vma.cpp:27

↓ 10 callersFunctiontrim

src/os/linux/bash_history.cpp:129

↓ 10 callersFunctionwarm_bit

Bitmask over FileCost::Category, used by the forensic warmer to decide which categories to warm. Bit N == category (int)N enabled.

src/vfs/vfs.h:53

↓ 9 callersMethodcomplete

src/os/linux/pagecache.h:79

↓ 9 callersFunctionfind_malfind

src/os/linux/findevil.cpp:55

↓ 9 callersFunctionkva_read_cstr

src/os/linux/kva_reader.cpp:116

↓ 9 callersFunctionresolve

src/vfs/vfs.cpp:101

↓ 9 callersFunctionto_lmpfs

src/api/vmmdll_compat.cpp:24

↓ 8 callersFunctioncontains_any

src/os/linux/crash_journal.cpp:50

↓ 8 callersFunctioncprint

src/cli/main.cpp:206

↓ 8 callersFunctiongen_cmdline

src/os/linux/task_files.cpp:101

↓ 8 callersFunctionkread_pod

src/os/linux/modules.cpp:41

↓ 8 callersMethodlist

src/vfs/vfs.cpp:9

↓ 8 callersFunctionto_buf

src/os/linux/crash_journal.cpp:335

↓ 8 callersFunctionto_lower

src/os/linux/crash_journal.cpp:44

↓ 8 callersMethodwritable

src/os/linux/vma.h:20

↓ 7 callersFunctioncontains

tests/unit/shell_history_test.cpp:44

↓ 7 callersFunctiondescribe_recovered_file_state

src/os/linux/pagecache.cpp:1483

↓ 7 callersMethodexecutable

src/os/linux/vma.h:21

↓ 7 callersFunctionfmt_addr

src/os/linux/netstat.cpp:339

↓ 7 callersFunctionkind_of

src/symbols/btf_to_isf.cpp:74

↓ 7 callersFunctionlevel

src/core/log.cpp:37

↓ 7 callersMethodload

src/symbols/isf_symbols.cpp:38

↓ 7 callersFunctionparse_history_bytes

src/os/linux/bash_history.cpp:556

↓ 7 callersMethodreadable

src/os/linux/vma.h:19

↓ 7 callersFunctionresolve_kallsym

Find a kallsyms symbol by exact name. Returns 0 if absent.

src/os/linux/sysinfo.cpp:21

↓ 7 callersFunctionresolve_user_pgd

src/os/linux/vma.cpp:201

↓ 6 callersFunctionaudit_idt

src/os/linux/integrity_checks.cpp:445

↓ 6 callersFunctionaudit_modules_cross

src/os/linux/integrity_checks.cpp:790

↓ 6 callersFunctioncheck_syscall_table

src/os/linux/check_syscall.cpp:80

↓ 6 callersFunctionerr

src/os/linux/dmesg.cpp:116

↓ 6 callersFunctionmake_env

Fake environment from a fixed map (nullptr for missing/empty keys).

tests/unit/app_paths_test.cpp:24

↓ 6 callersFunctionparse_kernel_release

src/os/linux/banner_scan.cpp:159

↓ 6 callersFunctionread_dm

src/os/linux/task_files.cpp:30

↓ 6 callersFunctionrecover_file_with_stats

src/os/linux/pagecache.cpp:1406

↓ 6 callersFunctionscan_for_tasks

src/os/linux/findevil.cpp:275

↓ 6 callersMethodtype_size

src/symbols/isf_symbols.cpp:161

↓ 6 callersFunctionyara_text_preview

src/os/linux/yara_search.cpp:46

↓ 5 callersFunctionbuild_addr_index

src/os/linux/integrity_checks.cpp:27

↓ 5 callersFunctionclassify_ptr

Classify a single kernel function pointer.

src/os/linux/integrity_checks.cpp:76

↓ 5 callersFunctioncollect_findevil_indicators

src/os/linux/findevil.cpp:689

↓ 5 callersFunctioncontains

tests/unit/recovered_file_stats_test.cpp:23

↓ 5 callersFunctioncontains_icase

src/os/linux/bash_history.cpp:136

↓ 5 callersFunctioncsv_field

src/os/linux/yara_search.cpp:641

↓ 5 callersFunctiondated_keys

Sort key + display for a DATED wall-clock event (absolute Unix seconds, with optional sub-second nsec for ordering kernel events within a second). All

src/os/linux/timeline.cpp:112

↓ 5 callersFunctiondm_pa

Translate a kernel-direct-map VA. Returns true if VA falls in [base, base+max).

src/os/linux/process_list.cpp:48

↓ 5 callersFunctionenumerate_bpf_programs

src/os/linux/ebpf.cpp:95

↓ 5 callersFunctionenumerate_modules

src/os/linux/modules.cpp:62

↓ 5 callersFunctionenumerate_mounts

src/os/linux/mountinfo.cpp:150

↓ 5 callersFunctionenumerate_tcp_sockets

src/os/linux/netstat.cpp:209

↓ 5 callersFunctionenumerate_udp_sockets

src/os/linux/netstat.cpp:259

↓ 5 callersFunctionjson_field

src/os/linux/yara_search.cpp:651

↓ 5 callersFunctionlmpfs_last_error

src/api/lmpfs.cpp:99

↓ 5 callersFunctionlooks_like_command

src/os/linux/bash_history.cpp:80

↓ 5 callersFunctionlower_copy

src/os/linux/findevil.cpp:609

↓ 5 callersMethodread

src/formats/avml_format.cpp:147

↓ 5 callersFunctionread_dm_u32

src/os/linux/process_list.cpp:56

↓ 5 callersFunctionread_dm_u64

src/os/linux/process_list.cpp:61

↓ 5 callersFunctionresolve_text_bounds

"Kernel-image" bounds — wide enough to include .init.text (e.g. `early_idt_handler_array` that the IDT keeps pointing at even at runtime), .rodata, an

src/os/linux/integrity_checks.cpp:52

↓ 5 callersFunctionscan_entropy

src/os/linux/entropy.cpp:33

next →1–100 of 777, ranked by callers