Functions — github.com/MemNixFS/MemNixFS

CodeHub MCPcopy Create free account

hub / github.com/MemNixFS/MemNixFS / functions

Functions777 in github.com/MemNixFS/MemNixFS

⨍ Functions 777◇ Types & classes 234

↓ 1 callersFunctionlmpfs_kernel_direct_map_base

src/api/lmpfs.cpp:367

↓ 1 callersFunctionlmpfs_kernel_kaslr_phys_shift

src/api/lmpfs.cpp:373

↓ 1 callersFunctionlmpfs_mem_read_kva

src/api/lmpfs.cpp:323

↓ 1 callersFunctionlmpfs_process_find_by_pid

src/api/lmpfs.cpp:201

↓ 1 callersFunctionlmpfs_version

src/api/lmpfs.cpp:90

↓ 1 callersFunctionload_lib

src/api/lmpfs.cpp:488

↓ 1 callersFunctionlooks_like_kernel_release

src/os/linux/banner_scan.cpp:20

↓ 1 callersFunctionlower_str

src/os/linux/bash_history.cpp:281

↓ 1 callersFunctionmake_info_txt

src/vfs/proc_module.cpp:45

↓ 1 callersFunctionmake_memmap_txt

src/vfs/proc_module.cpp:62

↓ 1 callersFunctionmake_ops

src/mount/fuse_mount.cpp:179

↓ 1 callersFunctionmatch_swapper

src/os/linux/kernel_resolver.cpp:24

↓ 1 callersFunctionmode_to_perm_string

src/os/linux/pagecache.cpp:300

↓ 1 callersFunctionmode_to_type

src/os/linux/pagecache.cpp:287

↓ 1 callersFunctionname_contains_any

src/os/linux/findevil.cpp:615

↓ 1 callersFunctionname_is_syscall_handler

Recognize the kernel's syscall-handler naming conventions. On x86_64 kernels with the per-arch wrapper macros, every entry resolves to one of these pr

src/os/linux/check_syscall.cpp:61

↓ 1 callersFunctionnearest_sym

Resolve nearest kallsyms symbol below addr (returns nullptr if none).

src/os/linux/tracing.cpp:37

↓ 1 callersFunctionnetwork_tool_comm

src/os/linux/findevil.cpp:644

↓ 1 callersFunctionnormalize_path

src/mount/fuse_mount.cpp:36

↓ 1 callersFunctionone_line_text

src/os/linux/findevil.cpp:599

↓ 1 callersFunctionopen_avml_physical

src/formats/avml_format.cpp:286

↓ 1 callersFunctionopen_file_memory_source

src/io/file_memory_source.cpp:60

↓ 1 callersFunctionopen_kdump_physical

src/formats/kdump_format.cpp:211

↓ 1 callersFunctionopen_lime_physical

src/formats/lime_format.cpp:117

↓ 1 callersFunctionopen_raw_physical

src/formats/raw_format.cpp:41

↓ 1 callersFunctionp2v_readme

src/os/linux/v2p_misc.cpp:152

↓ 1 callersFunctionpagecache_path_is_pseudo_fs

src/os/linux/pagecache.cpp:173

↓ 1 callersFunctionparse_argv

Parse MemProcFS-style argv. Returns (dump_path, symbol_path). Unrecognised flags are silently skipped — matches MemProcFS leniency.

src/api/vmmdll_compat.cpp:50

↓ 1 callersFunctionparse_distro

src/os/linux/banner_scan.cpp:170

↓ 1 callersFunctionparse_fish_cmd

src/os/linux/bash_history.cpp:246

↓ 1 callersFunctionparse_line

Parse a /etc/passwd line: name:x:uid:gid:gecos:home:shell

src/os/linux/users.cpp:43

↓ 1 callersFunctionparse_types

Walk the type section and produce one Decoded per type. Type ids are 1-based (id 0 is reserved for VOID).

src/symbols/btf_to_isf.cpp:101

↓ 1 callersFunctionpath_is_etc_passwd

src/os/linux/users.cpp:81

↓ 1 callersFunctionperm_string

Map our Vma flags bitfield back to the rwxp string used by /proc/PID/maps.

src/os/linux/task_files.cpp:91

↓ 1 callersFunctionplausible

Sanity-check a candidate BTF header read at `pa`. We require: magic == 0xEB9F version == 1 type_off + type_len <= str_off + str_len (sections fit) tot

src/os/linux/btf_probe.cpp:33

↓ 1 callersFunctionplausible_comm

src/os/linux/process_list.cpp:25

↓ 1 callersFunctionplausible_token_index

Returns true if the 512-byte window at `buf` looks like a kallsyms_token_index. Constraints on the real article (validated against multiple kernels):

src/symbols/kallsyms.cpp:63

↓ 1 callersFunctionplugin_name_from_path

Compute the canonical plugin name: file stem without extension. `foo.plugin.dll` → `foo.plugin`; `core.dll` → `core`.

src/api/lmpfs.cpp:510

↓ 1 callersFunctionpreload_winfsp_dll

src/mount/winfsp_mount.cpp:298

↓ 1 callersFunctionprint_tree

src/cli/main.cpp:181

↓ 1 callersFunctionprintable_journal_fields

src/os/linux/crash_journal.cpp:339

↓ 1 callersFunctionprobe_btf

src/os/linux/btf_probe.cpp:86

↓ 1 callersFunctionproc_cmdline

src/os/linux/findevil.cpp:651

↓ 1 callersFunctionptrace_flags_str

Decode task.ptrace bit field into a string. The kernel header include/linux/ptrace.h defines: PT_PTRACED = 0x00000001 PT_DTRACE = 0x0

src/os/linux/task_extras.cpp:40

↓ 1 callersMethodranges

src/formats/raw_format.cpp:17

↓ 1 callersMethodread

src/arch/x86_64/page_cache.cpp:58

↓ 1 callersMethodread

src/formats/raw_format.cpp:22

↓ 1 callersMethodread

src/formats/lime_format.cpp:48

↓ 1 callersFunctionread_argv0

Read the first argv element of a process (the exe path) as a single UTF-8 string. Empty on failure or kernel thread.

src/os/linux/av_edr.cpp:148

↓ 1 callersFunctionread_banner_at

src/os/linux/banner_scan.cpp:69

↓ 1 callersFunctionread_btf

src/os/linux/btf_probe.cpp:92

↓ 1 callersFunctionread_cmdline_oneline

Internal helper to read cmdline as a single-line string (NULs → spaces).

src/os/linux/csv_export.cpp:35

↓ 1 callersFunctionread_cmdline_oneline

Same cmdline-as-string reader as csv_export.cpp. Could be hoisted to task_files.h, but keeping it local avoids cross-file coupling for a 12-line helpe

src/os/linux/json_export.cpp:24

↓ 1 callersFunctionread_dentry_name

src/os/linux/task_files.cpp:419

↓ 1 callersFunctionread_dentry_name

Read a dentry's leaf name. Tries qstr.name (long names, kmalloc'd buffer) first; falls back to the inline shortname union (d_shortname/d_iname).

src/os/linux/dentry_path.cpp:14

↓ 1 callersFunctionread_dm_comm

src/os/linux/process_list.cpp:66

↓ 1 callersFunctionread_fs_file

Read a small file from the reconstructed root filesystem (/fs/...) via the VFS. Returns empty bytes on any failure (file missing, dentry path broken,

src/os/linux/sysinfo_more.cpp:32

↓ 1 callersFunctionread_inode_mac_times

src/os/linux/pagecache.cpp:1556

↓ 1 callersFunctionread_kernel_string

Read a NUL-terminated string from a kernel VA via the kernel page table. Returns empty string if the read fails or the area is unmapped.

src/vfs/sys_module.cpp:39

↓ 1 callersFunctionread_kernel_u64_var

Read a kernel u64 variable (e.g. vmemmap_base) addressed by its symbol.

src/os/linux/pagecache.cpp:280

↓ 1 callersFunctionread_passwd_file

Try to read the entire `/fs/etc/passwd` content via the VFS. Returns empty on any failure (file missing from page cache, dentry path not resolvable, e

src/os/linux/users.cpp:21

↓ 1 callersFunctionread_process_heap

src/os/linux/bash_history.cpp:189

↓ 1 callersFunctionread_vsz_kb

Sum of VMA sizes — equivalent to `ps`'s VSZ column (in KiB).

src/os/linux/process_views.cpp:40

↓ 1 callersFunctionread_whole_file

src/symbols/xz_decompress.cpp:11

↓ 1 callersFunctionrecover_file

src/os/linux/pagecache.cpp:1402

↓ 1 callersFunctionrecover_symlink_target

src/os/linux/pagecache.cpp:1441

↓ 1 callersFunctionregister_handle

src/api/vmmdll_compat.cpp:38

↓ 1 callersFunctionrekey_legacy_event

Re-key an event that another module built with the legacy scheme ("0000-boot+<sec>.<usec>" for boot-relative, anything else = undated) onto the unifie

src/os/linux/timeline.cpp:153

↓ 1 callersFunctionrelease_is_below_support_floor

src/symbols/symbol_resolver.cpp:66

↓ 1 callersFunctionrender_node

src/os/linux/process_views.cpp:82

↓ 1 callersFunctionrender_phys2virt

Builds the per-query result text for /misc/phys2virt/<name>.

src/os/linux/v2p_misc.cpp:88

↓ 1 callersFunctionrender_template

Expand {KEY} and {KEY:0:2} placeholders in a URL template.

src/symbols/symbol_cache_http.cpp:118

↓ 1 callersFunctionrender_virt2phys

Builds the per-query result text for /misc/virt2phys/<name>.

src/os/linux/v2p_misc.cpp:48

↓ 1 callersFunctionresolve_dtb

src/os/linux/dtb_resolver.cpp:52

↓ 1 callersFunctionresolve_kernel

src/os/linux/kernel_resolver.cpp:118

↓ 1 callersFunctionresolve_kernel_sym

src/os/linux/timeline.cpp:44

↓ 1 callersFunctionresolve_off

src/os/linux/ebpf.cpp:35

↓ 1 callersFunctionresolve_offsets

src/os/linux/mountinfo.cpp:40

↓ 1 callersFunctionresolve_sym

src/api/lmpfs.cpp:491

↓ 1 callersFunctionresolve_symbols

src/symbols/symbol_resolver.cpp:279

↓ 1 callersFunctionresolve_text_bounds

src/os/linux/pscallstack.cpp:46

↓ 1 callersFunctionresolve_tp_func_offset_func

src/os/linux/tracepoints.cpp:59

↓ 1 callersFunctionresolve_tracepoint_offsets

Read `struct tracepoint` at `tp_va`. We read just the two fields we care about: `name` (pointer) and `funcs` (pointer to handler array). The struct's

src/os/linux/tracepoints.cpp:28

↓ 1 callersFunctionrun_fuse_mount

src/mount/fuse_mount.cpp:209

↓ 1 callersFunctionrun_winfsp_mount

src/mount/winfsp_mount.cpp:369

↓ 1 callersFunctionsanitize

src/vfs/proc_module.cpp:76

↓ 1 callersFunctionscan_bash_history

src/os/linux/bash_history.cpp:564

↓ 1 callersFunctionscan_swapper

src/os/linux/kernel_resolver.cpp:35

↓ 1 callersFunctionscan_token_index

src/symbols/kallsyms.cpp:85

↓ 1 callersFunctionselect_passwd

A snapshot can hold several /etc/passwd inodes — overlayfs upper/lower layers, per-container roots, or an old + rewritten copy. Trusting the first one

src/os/linux/users.cpp:100

↓ 1 callersFunctionset_user_yara_paths

src/os/linux/yara_search.cpp:30

↓ 1 callersFunctionshannon_entropy

src/os/linux/entropy.cpp:18

↓ 1 callersFunctionshell_like_comm

src/os/linux/findevil.cpp:629

↓ 1 callersFunctionshell_like_process

src/os/linux/bash_history.cpp:145

↓ 1 callersFunctionshell_name

src/os/linux/bash_history.cpp:310

↓ 1 callersFunctionsocket_state

src/os/linux/timeline.cpp:187

↓ 1 callersFunctionsort_findings

src/os/linux/findevil.cpp:670

↓ 1 callersFunctionsource_origin

The `source` column is "<shell>/<origin>" where origin is "heap" or a real history filename (e.g. "bash/.bash_history", "zsh/heap").

src/os/linux/bash_history.cpp:534

↓ 1 callersFunctionsplit_dmesg_line

src/os/linux/timeline.cpp:123

↓ 1 callersFunctionsplit_https_url

Parse an https URL into (host, path). Crude but enough for the mirrors we use.

src/symbols/symbol_cache_http.cpp:134

← previous next →501–600 of 777, ranked by callers