| Name |
Description |
| Analyze |
|
| CODEVIEW_HEADER |
|
| ConfigOptions |
|
| DetectedProc |
|
| Dump |
|
| EPTP |
EPTP for SLAT configuration hypervisors 64-ia-32-architectures-software-developer-system-programming-manual-325384.pdf Section 24.6.11 |
| EnvLimits |
|
| ExtendedPageNotFoundException |
|
| GUEST_PHYSICAL_ADDRESS |
Maybe just use VIRTUAL_ADDRESS above, pretty much identical EPT: PML4 table is located at the physical address specified in bits 51:12 of the EPTP - PML4 entry is then selected from Bits 11:3 are bits 47:39 of the guest-physical address Physical addresses as long |
| HARDWARE_ADDRESS_ENTRY |
|
| MagicNumbers |
|
| Mem |
Physical to Virtual and Physical to Hypervisor Guest Virtual memory dump class Convienent generic interfaces for extracting preferred types * Type has to be a value/struct type and is expected to be 64 bits width * TODO: Adjust for other size structs & values stradling page boundries |
| MemException |
|
| MemSection |
|
| MemoryDescriptor |
|
| MemoryMapWindowFailedException |
|
| MemoryRun |
|
| MemoryRunMismatchException |
|
| Misc |
|
| PFN |
|
| PageNotFoundException |
|
| PageTable |
|
| PageTableRoot |
|
| PhysicalMemoryStream |
Stream overlaid the block interface of Mem |
| SLAT_ENTRY |
|
| Scan |
|
| ScanTypeScanTypeCompletionSource |
|
| Scanner |
|
| UnsafeHelp |
|
| VIRTUAL_ADDRESS |
|
| VMCS |
|
| VirtualScanner |
|
| Vtero |
Moving things around to support save state If it turns out that we are to parse the input aggressivly, it may make sence to not have to waste time doing the same analysis over again Rooting everything off of a main class helps the structure a bit |
| quickdumps |
|
| quickdumps.OSPicker |
|