Functions — github.com/Velocidex/WinPmem

CodeHub MCPcopy Create free account

hub / github.com/Velocidex/WinPmem / functions

Functions176 in github.com/Velocidex/WinPmem

⨍ Functions 176◇ Types & classes 35

↓ 23 callersMethodInfo

(format string, args ...interface{})

src/golang/logger.go:9

↓ 17 callersFunctionread_pci_config

src/NotInUse/pci.c:4

↓ 16 callersMethodClose

go-winpmem/imager.go:339

↓ 16 callersMethodWrite

go-winpmem/sparse.go:24

↓ 13 callersMethodWrite

src/golang/sparse.go:24

↓ 12 callersFunctionread_pci_config_16

src/NotInUse/pci.c:31

↓ 9 callersMethodClose

src/golang/imager.go:193

↓ 9 callersMethodInfo

(format string, args ...interface{})

go-winpmem/logger.go:9

↓ 9 callersMethodProgress

src/golang/logger.go:12

↓ 8 callersFunctionwrite_pci_config

src/NotInUse/pci.c:12

↓ 6 callersMethodSeek

(offset int64, whence int)

go-winpmem/sparse.go:20

↓ 6 callersFunctionget_base_register_size

src/NotInUse/pci.c:39

↓ 6 callersFunctionwrite_pci_config_16

src/NotInUse/pci.c:18

↓ 5 callersFunctionprint_pte_contents

Parse a 64 bit page table entry and print it.

src/pte_mmap.c:103

↓ 4 callersFunctionCTL_CODE

(device_type, function, method, access uint32)

go-winpmem/api.go:10

↓ 4 callersFunctionCTL_CODE

(device_type, function, method, access uint32)

src/golang/api.go:10

↓ 4 callersFunctionInsertMemoryHole

src/NotInUse/pci.c:123

↓ 3 callersMethodSeek

(offset int64, whence int)

src/golang/sparse.go:20

↓ 2 callersMethodDebug

(format string, args ...interface{})

src/golang/logger.go:10

↓ 2 callersFunctionDeviceRead

↓ 2 callersFunctionDumpBaseAddressRegister

Advances the offset depending on the size of the base address register.

src/NotInUse/pci.c:230

↓ 2 callersFunctionDumpConfigSpace

src/NotInUse/pci.c:98

↓ 2 callersFunctionIoUnload

src/winpmem.c:50

↓ 2 callersFunctiondump_interesting_fields

src/NotInUse/pci.c:66

↓ 2 callersMethodinstall_driver

src/executable/winpmem.cpp:625

↓ 2 callersFunctioninstall_sig_handler

go-winpmem/cmd/utils.go:10

↓ 2 callersFunctionpte_remap_rogue_page

src/pte_mmap.c:68

↓ 2 callersFunctionread_pci_config_byte

src/NotInUse/pci.c:23

↓ 2 callersMethodset_acquisition_mode

src/executable/winpmem.cpp:287

↓ 2 callersMethodset_driver_filename

src/executable/winpmem.cpp:603

↓ 2 callersMethoduninstall_driver

src/executable/winpmem.cpp:715

↓ 2 callersFunctionvirt_find_pte

Traverses the page tables to find the pte for a given virtual address. Args: _In_ VIRT_ADDR vaddr: The virtual address to resolve the pte for. _Out_

src/pte_mmap.c:151

↓ 1 callersFunctionAddMemoryRanges

src/winpmem.c:91

↓ 1 callersFunctionDumpBaseAddressRegister32

src/NotInUse/pci.c:176

↓ 1 callersFunctionDumpBaseAddressRegister64

src/NotInUse/pci.c:197

↓ 1 callersFunctionDumpPCIBridge

src/NotInUse/pci.c:280

↓ 1 callersFunctionDumpStandardHeader

src/NotInUse/pci.c:267

↓ 1 callersFunctionGetKPCR

↓ 1 callersMethodInfo

go-winpmem/api.go:67

↓ 1 callersMethodInfo

src/golang/api.go:61

↓ 1 callersFunctionKernelGetModuleBaseByPtr

Rather default queryinfo routine., requires passive level.

↓ 1 callersFunctionMapIOPagePartialRead

Method II. This method is thread-safe and does not need protection of a mutex. It can work at higher IRQL but doesn't. Read a single page using MmMapI

↓ 1 callersFunctionPTEMmapPartialRead

Method III. !! This method is not thread-safe and crucially requires protection of a mutex. Read a single page using direct PTE mapping. General purpo

↓ 1 callersFunctionPhysicalMemoryPartialRead

Method I. This method is thread-safe and does not need protection of a mutex. This routine requires PASSIVE LEVEL and can't work under a mutex. Genera

↓ 1 callersMethodSetMode

(mode PmemMode)

go-winpmem/imager.go:139

↓ 1 callersMethodSetMode

(mode PmemMode)

src/golang/imager.go:21

↓ 1 callersMethodSetProgress

(pages_per_dot int)

go-winpmem/logger.go:13

↓ 1 callersMethodSetProgress

(pages_per_dot int)

src/golang/logger.go:13

↓ 1 callersMethodSetSparse

go-winpmem/imager.go:175

↓ 1 callersMethodStats

go-winpmem/imager.go:149

↓ 1 callersMethodStats

src/golang/imager.go:31

↓ 1 callersMethodToYaml

go-winpmem/api.go:107

↓ 1 callersMethodToYaml

src/golang/api.go:101

↓ 1 callersFunctionUninstallDriver

( driver_path, service_name string, logger Logger)

go-winpmem/install.go:12

↓ 1 callersFunctionUninstallDriver

( driver_path, service_name string, logger Logger)

src/golang/install.go:12

↓ 1 callersFunctionWinPmemFactory

Create the corrent WinPmem object. Currently this selects between 32/64 bit implementations. */

src/executable/main.cpp:51

↓ 1 callersMethodWriteTo

(ctx context.Context, w io.Writer)

go-winpmem/imager.go:304

↓ 1 callersMethodWriteTo

src/golang/imager.go:162

↓ 1 callersMethod_progress

go-winpmem/logger.go:54

↓ 1 callersMethod_progress

src/golang/logger.go:54

↓ 1 callersFunctionaddHeaderAnchors

docs/js/scripts.min.1237ff71925bb8625c97a9af8db4c54525258bedfd7c47493daaff723bea755e.js:6

↓ 1 callersFunctionanchorForId

docs/js/scripts.min.1237ff71925bb8625c97a9af8db4c54525258bedfd7c47493daaff723bea755e.js:6

↓ 1 callersFunctionasprintf

src/executable/winpmem.cpp:888

↓ 1 callersFunctioncheckServiceExists

go-winpmem/install.go:74

↓ 1 callersFunctioncheckServiceExists

src/golang/install.go:74

↓ 1 callersFunctioncontrolService

(name string, c svc.Cmd, to svc.State)

go-winpmem/install.go:160

↓ 1 callersFunctioncontrolService

(name string, c svc.Cmd, to svc.State)

src/golang/install.go:160

↓ 1 callersMethodcopyRange

copyRange copies a range from the base_addr to the writer. We assume size is a multiple of PAGE_SIZE

go-winpmem/imager.go:224

↓ 1 callersMethodcopyRange

copyRange copies a range from the base_addr to the writer. We assume size is a multiple of PAGE_SIZE

src/golang/imager.go:89

↓ 1 callersMethodcreate_output_file

src/executable/winpmem.cpp:318

↓ 1 callersFunctiondoAcquire

go-winpmem/cmd/acquire.go:32

↓ 1 callersFunctiondoDecompress

go-winpmem/cmd/decompress.go:20

↓ 1 callersFunctiondoInstall

go-winpmem/cmd/install.go:29

↓ 1 callersFunctiondoPhysicalReadFromWinpmem

src/testing/testapp.c:208

↓ 1 callersFunctiondoPhysicalReadFromWinpmem

src/testing/testapp3.c:162

↓ 1 callersFunctiondoPhysicalReadFromWinpmem

src/testing/testapp1.c:188

↓ 1 callersFunctiondoPhysicalReadFromWinpmem

src/testing/testapp2.c:194

↓ 1 callersFunctiondoRun

src/golang/cmd/main.go:41

↓ 1 callersFunctiondoSave

go-winpmem/cmd/save.go:17

↓ 1 callersFunctiondoUninstall

go-winpmem/cmd/install.go:69

↓ 1 callersFunctiondump_bar

src/NotInUse/pci.c:75

↓ 1 callersMethodextract_driver

src/executable/winpmem.cpp:807

↓ 1 callersMethodgetRun

go-winpmem/imager.go:29

↓ 1 callersMethodgetStats

go-winpmem/imager.go:153

↓ 1 callersMethodgetStats

src/golang/imager.go:35

↓ 1 callersFunctionhelp

src/executable/main.cpp:23

↓ 1 callersFunctioninstallService

( service_name string, executable string, logger Logger)

go-winpmem/install.go:89

↓ 1 callersFunctioninstallService

( service_name string, executable string, logger Logger)

src/golang/install.go:89

↓ 1 callersFunctionopenDevice

src/testing/testapp.c:169

↓ 1 callersFunctionopenDevice

src/testing/testapp3.c:123

↓ 1 callersFunctionopenDevice

src/testing/testapp1.c:149

↓ 1 callersFunctionopenDevice

src/testing/testapp2.c:155

↓ 1 callersMethodpad

( ctx context.Context, size uint64, w io.Writer)

go-winpmem/imager.go:182

↓ 1 callersMethodpad

(size uint64, w io.Writer)

src/golang/imager.go:57

↓ 1 callersMethodreadAt

(buf []byte, offset int64)

go-winpmem/imager.go:62

↓ 1 callersFunctionremoveService

go-winpmem/install.go:140

↓ 1 callersFunctionremoveService

src/golang/install.go:140

↓ 1 callersFunctionrestoreOriginalRoguePage

src/pte_mmap.c:329

↓ 1 callersFunctionreverseQuery

src/testing/testapp.c:152

↓ 1 callersFunctionreverseQuery

src/testing/testapp1.c:132

next →1–100 of 176, ranked by callers