Functions — github.com/MemNixFS/MemNixFS

CodeHub MCPcopy Create free account

hub / github.com/MemNixFS/MemNixFS / functions

Functions777 in github.com/MemNixFS/MemNixFS

⨍ Functions 777◇ Types & classes 234

↓ 2 callersFunctionfind_symbol

src/symbols/kallsyms.cpp:867

↓ 2 callersFunctionfmt_addr

src/os/linux/csv_export.cpp:54

↓ 2 callersFunctionfmt_addr

src/os/linux/json_export.cpp:41

↓ 2 callersFunctionformat_one

src/os/linux/netstat.cpp:345

↓ 2 callersFunctionformat_socket_csv

src/os/linux/csv_export.cpp:89

↓ 2 callersFunctionformat_sockets_json

src/os/linux/json_export.cpp:75

↓ 2 callersFunctionformat_timeline_domain_csv

src/os/linux/timeline.cpp:666

↓ 2 callersFunctiongen_path_for_struct_path

src/os/linux/task_files.cpp:476

↓ 2 callersFunctiongeneric_command_candidate

src/os/linux/bash_history.cpp:499

↓ 2 callersFunctionget_dmesg_source

src/os/linux/crash_journal.cpp:129

↓ 2 callersFunctionget_mm_offsets

src/os/linux/vma.cpp:73

↓ 2 callersFunctionhas_prefix

tests/unit/shell_history_test.cpp:40

↓ 2 callersFunctionhigh_confidence_history

src/os/linux/bash_history.cpp:539

↓ 2 callersFunctioninode_is_dying

I_WILL_FREE (bit 4) | I_FREEING (bit 5) — set during inode teardown. Used as a "deleted" heuristic: when a file is unlink()'d while still referenced,

src/os/linux/pagecache.h:111

↓ 2 callersFunctioninode_is_orphan

Heuristic for "no global path resolvable" — covers anonymous inodes (sockets/pipes/anon_inode), deleted-but-cached files whose dentry is gone, and ino

src/os/linux/pagecache.h:118

↓ 2 callersFunctioninode_to_path

Resolve a path for this inode by walking `i_dentry.first` (a dentry that aliases the inode). When there's no alias (anonymous inodes), return "". If `

src/os/linux/pagecache.cpp:332

↓ 2 callersFunctionis_heap_va

src/os/linux/bash_history.cpp:125

↓ 2 callersFunctionis_journald_path

src/os/linux/crash_journal.cpp:85

↓ 2 callersFunctionis_text_log_path

src/os/linux/crash_journal.cpp:57

↓ 2 callersFunctioniso_utc

Unix seconds → "YYYY-MM-DD HH:MM:SS UTC" (matches the shell-history format so wall-clock rows from every source sort and read consistently).

src/os/linux/timeline.cpp:35

↓ 2 callersFunctionkernel_va_to_pa_static

Static (no KASLR) kernel-vaddr -> paddr for the kernel text mapping. Always: paddr = vaddr - 0xffffffff80000000 + kaslr_phys_shift

src/os/linux/kernel_resolver.h:37

↓ 2 callersFunctionkflag_of

src/symbols/btf_to_isf.cpp:76

↓ 2 callersFunctionkread

src/os/linux/fdtable.cpp:42

↓ 2 callersFunctionlist_processes

src/os/linux/process_list.cpp:127

↓ 2 callersFunctionlmpfs_open

src/mount/fuse_mount.cpp:92

↓ 2 callersFunctionlmpfs_plugin_add_file

src/api/lmpfs.cpp:443

↓ 2 callersFunctionlmpfs_process_find_by_name

src/api/lmpfs.cpp:185

↓ 2 callersFunctionlmpfs_vfs_list

src/api/lmpfs.cpp:236

↓ 2 callersFunctionlmpfs_vfs_list_free

src/api/lmpfs.cpp:274

↓ 2 callersFunctionlmpfs_vfs_read

src/api/lmpfs.cpp:291

↓ 2 callersFunctionlmpfs_vfs_size

src/api/lmpfs.cpp:278

↓ 2 callersFunctionload_plugins_from

Try to load + initialise plugins from one directory.

src/api/lmpfs.cpp:515

↓ 2 callersFunctionlooks_like_isf

Returns true if path is a regular file with a JSON-ish extension we'd accept.

src/symbols/symbol_resolver.cpp:28

↓ 2 callersFunctionopen_best_memory_source

Try mmap first; on failure, fall back to file-based source. Use this from the engine — it gets the fast path for free.

src/io/memory_source.h:34

↓ 2 callersFunctionopen_physical_layer

src/formats/format_factory.cpp:14

↓ 2 callersFunctionparse_hex_name

Parse a directory-component name as a hex address. Accepts: 0x-prefixed: "0xffffffffa7fb3580" Bare hex: "ffffffffa7fb3580" With trailing ".txt" (

src/os/linux/v2p_misc.cpp:25

↓ 2 callersFunctionparse_history_file

Stateful, format-aware parser for a recovered on-disk history file. Unlike a line-at-a-time scan, this pairs each command with the timestamp line that

src/os/linux/bash_history.cpp:391

↓ 2 callersFunctionparse_passwd

Parse a whole /etc/passwd blob into a uid → entry map.

src/os/linux/users.cpp:65

↓ 2 callersFunctionparse_sock

src/os/linux/netstat.cpp:129

↓ 2 callersFunctionparse_zsh_extended

src/os/linux/bash_history.cpp:232

↓ 2 callersFunctionplausible_comm

A comm field looks like a process name: 2+ printable bytes followed by NUL padding to 16. Real comm strings start with [a-zA-Z0-9_] and use the restri

src/os/linux/findevil.cpp:245

↓ 2 callersFunctionplausible_pid

src/os/linux/process_list.cpp:21

↓ 2 callersFunctionplausible_symlink_target

src/os/linux/pagecache.cpp:1417

↓ 2 callersFunctionprobe_btf_all

src/os/linux/btf_probe.cpp:49

↓ 2 callersFunctionrange_covers_offset

src/os/linux/crash_journal.cpp:381

↓ 2 callersMethodread

src/arch/x86_64/paging.cpp:45

↓ 2 callersFunctionread_candidate_text

src/os/linux/crash_journal.cpp:238

↓ 2 callersFunctionread_cmdline

Read a process's cmdline. NUL-separated argv → spaces. Empty for kernel threads (no mm). Falls back to `[comm]` (bracketed, like `ps` does for kernel

src/os/linux/process_views.cpp:20

↓ 2 callersFunctionread_kernel_strp

Read a `char *` field's string content from a kernel struct.

src/os/linux/mountinfo.cpp:68

↓ 2 callersFunctionread_kstr

Read a NUL-terminated kernel string of up to maxlen bytes (used for s_id inline char arrays and file_system_type.name pointer chases).

src/os/linux/pagecache.cpp:316

↓ 2 callersFunctionread_kstr

Read a NUL-terminated C string at `va`, max `maxlen`, kernel-VA.

src/os/linux/integrity_checks.cpp:136

↓ 2 callersFunctionread_string

src/os/linux/kernel_resolver.cpp:57

↓ 2 callersFunctionread_user_range

Read user-space bytes via a process's own PGD.

src/os/linux/task_files.cpp:37

↓ 2 callersFunctionread_vma

src/os/linux/vma.cpp:95

↓ 2 callersFunctionread_whole_uncompressed

src/symbols/isf_symbols.cpp:28

↓ 2 callersFunctionrecover_file_internal

src/os/linux/pagecache.cpp:1153

↓ 2 callersFunctionrecover_file_size

Canonical file size — must agree with what recover_file's output buffer length will be, otherwise WinFsp/HxD see a "stream read error" when they try t

src/os/linux/pagecache.cpp:1135

↓ 2 callersFunctionrender_timeline_csv

src/os/linux/timeline.cpp:269

↓ 2 callersFunctionrender_timeline_txt

src/os/linux/timeline.cpp:244

↓ 2 callersFunctionresolve_dentry_path

src/os/linux/task_files.cpp:435

↓ 2 callersFunctionscan_and_load_plugins

src/api/lmpfs.cpp:580

↓ 2 callersFunctionscan_banner_candidates

src/os/linux/banner_scan.cpp:79

↓ 2 callersFunctionscan_crash_events

src/os/linux/crash_journal.cpp:216

↓ 2 callersFunctionscan_process

Scan a single process. Walks every readable VMA, reads in 64 KiB chunks via the user PGD, and calls yr_rules_scan_mem on each chunk. VMAs > 256 MiB ar

src/os/linux/yara_search.cpp:546

↓ 2 callersFunctionscore_banner

src/os/linux/banner_scan.cpp:45

↓ 2 callersFunctionsearch_dir_for_release

Look in `dir` for an ISF whose metadata.kernel_release == `release`.

src/symbols/symbol_resolver.cpp:103

↓ 2 callersMethodset_cost

src/vfs/vfs.h:76

↓ 2 callersFunctionshell_quote

src/symbols/symbol_cache_http.cpp:197

↓ 2 callersFunctionsocket_proto

src/os/linux/timeline.cpp:177

↓ 2 callersFunctionsplit_lines

src/os/linux/bash_history.cpp:358

↓ 2 callersFunctionstate_name

src/os/linux/threads.cpp:14

↓ 2 callersFunctionstate_name

src/os/linux/modules.cpp:51

↓ 2 callersFunctionstatic_text_pa

Static (pre-KASLR) PA of a kernel-text-mapping symbol.

src/os/linux/dtb_resolver.cpp:18

↓ 2 callersFunctionstatus_str

src/os/linux/integrity_checks.cpp:125

↓ 2 callersFunctionstrip_quals

Strip qualifiers (CONST/VOLATILE/RESTRICT/TYPE_TAG) and return the underlying type id we should render in JSON. Bounded recursion depth. Always return

src/symbols/btf_to_isf.cpp:238

↓ 2 callersFunctionsummarise_consistency

src/os/linux/crash_journal.cpp:300

↓ 2 callersFunctiontcp_state_name

src/os/linux/netstat.cpp:319

↓ 2 callersFunctiontrim_trailing_nuls

Trim trailing NULs so cmdline-style buffers don't include the slack at the end of the page where the kernel zero-pads.

src/os/linux/task_files.cpp:69

↓ 2 callersFunctiontry_add_file

src/os/linux/yara_search.cpp:274

↓ 2 callersFunctiontry_fetch

Attempts to generate `release`.json.xz into `out_dir` via the bundled script. Returns the produced ISF path on success. If `vmlinux` is non-empty the

src/symbols/symbol_resolver.cpp:207

↓ 2 callersFunctiontype_ref

Build a JSON "type" object referring to type `id`. Recurses into PTR/ARRAY. Recursion is bounded by `depth` because typedef chains and pointer cycles

src/symbols/btf_to_isf.cpp:253

↓ 2 callersFunctiontype_to_string

src/symbols/isf_symbols.cpp:14

↓ 2 callersFunctionv2p_readme

Helper: build the README that lives at /misc/virt2phys/README.txt and /misc/phys2virt/README.txt.

src/os/linux/v2p_misc.cpp:132

↓ 2 callersFunctionvalidate_dtb_via_banner

src/os/linux/dtb_resolver.cpp:32

↓ 2 callersFunctionvma_scan_priority

Forensic-interest ordering for per-process string extraction. The budget is finite, so scan the regions an analyst actually cares about FIRST: heap, s

src/os/linux/strings_search.cpp:35

↓ 2 callersFunctionwalk_dentry_tree_for_inodes

Recursively walk the dentry cache tree DOWNWARD from a set of seed root dentries, collecting every dentry's d_inode. This is the high-coverage symbol

src/os/linux/pagecache.cpp:661

↓ 2 callersFunctionwalk_fdtables_for_inodes

Last-ditch enumeration path: walk every running process's open fd table and collect inode VAs. This is the ONLY view that works on a BTF-only ISF — in

src/os/linux/pagecache.cpp:543

↓ 2 callersFunctionxa_is_internal

xarray entry encoding (mirrors pagecache.cpp's walker — kept local so we don't entangle modules).

src/os/linux/ebpf.cpp:16

↓ 2 callersFunctionxa_is_internal

xarray entry tagging — bits 0..1 form an enum: 00 → leaf (real pointer to a folio) 01 → "value" entry — not used for page cache, skip 10 → internal po

src/os/linux/pagecache.cpp:192

↓ 2 callersFunctionxa_is_internal

src/os/linux/sysinfo_more.cpp:107

↓ 2 callersFunctionxa_is_value

src/os/linux/ebpf.cpp:17

↓ 2 callersFunctionxa_is_value

src/os/linux/pagecache.cpp:193

↓ 2 callersFunctionxa_is_value

src/os/linux/sysinfo_more.cpp:108

↓ 2 callersFunctionxz_decompress_file

src/symbols/xz_decompress.cpp:60

↓ 1 callersFunctionCreateLmpfs

src/mount/winfsp_mount.cpp:323

↓ 1 callersFunctionU

src/mount/winfsp_mount.cpp:49

↓ 1 callersFunctionVMMDLL_Close

src/api/vmmdll_compat.cpp:99

↓ 1 callersFunctionVMMDLL_CloseAll

src/api/vmmdll_compat.cpp:105

↓ 1 callersFunctionVMMDLL_MemRead

src/api/vmmdll_compat.cpp:187

↓ 1 callersFunctionVMMDLL_MemReadEx

src/api/vmmdll_compat.cpp:198

← previous next →201–300 of 777, ranked by callers