Unify vmicore

GDATASoftwareAG · Sep 20, 2023 · 6c6ec11 · 6c6ec11
1 parent 8d3df4a
commit 6c6ec11
Show file tree

Hide file tree

Showing 14 changed files with 77 additions and 87 deletions.
diff --git a/vmicore/src/include/vmicore/vmi/IBreakpoint.h b/vmicore/src/include/vmicore/vmi/IBreakpoint.h
@@ -14,7 +14,7 @@ namespace VmiCore
       public:
         virtual ~IBreakpoint() = default;
 
-        virtual addr_t getTargetPA() const = 0;
+        [[nodiscard]] virtual addr_t getTargetPA() const = 0;
 
         virtual void remove() = 0;
 

diff --git a/vmicore/src/include/vmicore/vmi/IIntrospectionAPI.h b/vmicore/src/include/vmicore/vmi/IIntrospectionAPI.h
@@ -17,28 +17,28 @@ namespace VmiCore
       public:
         virtual ~IIntrospectionAPI() = default;
 
-        virtual uint8_t read8PA(addr_t pyhsicalAddress) = 0;
+        [[nodiscard]] virtual uint8_t read8PA(addr_t pyhsicalAddress) = 0;
 
-        virtual uint64_t read64PA(const addr_t physicalAddress) = 0;
+        [[nodiscard]] virtual uint64_t read64PA(addr_t physicalAddress) = 0;
 
-        virtual uint8_t read8VA(addr_t virtualAddress, addr_t cr3) = 0;
+        [[nodiscard]] virtual uint8_t read8VA(addr_t virtualAddress, addr_t cr3) = 0;
 
-        virtual uint32_t read32VA(addr_t virtualAddress, addr_t cr3) = 0;
+        [[nodiscard]] virtual uint32_t read32VA(addr_t virtualAddress, addr_t cr3) = 0;
 
-        virtual uint64_t read64VA(addr_t virtualAddress, addr_t cr3) = 0;
+        [[nodiscard]] virtual uint64_t read64VA(addr_t virtualAddress, addr_t cr3) = 0;
 
-        virtual uint64_t readVA(addr_t virtualAddress, addr_t dtb, std::size_t size) = 0;
+        [[nodiscard]] virtual uint64_t readVA(addr_t virtualAddress, addr_t dtb, std::size_t size) = 0;
 
-        virtual bool
-        readXVA(const addr_t virtualAddress, const addr_t cr3, std::vector<uint8_t>& content, std::size_t size) = 0;
+        [[nodiscard]] virtual bool
+        readXVA(addr_t virtualAddress, addr_t cr3, std::vector<uint8_t>& content, std::size_t size) = 0;
 
         [[nodiscard]] virtual uint64_t getCurrentVmId() = 0;
 
         [[nodiscard]] virtual uint getNumberOfVCPUs() const = 0;
 
-        virtual addr_t translateKernelSymbolToVA(const std::string& kernelSymbolName) = 0;
+        [[nodiscard]] virtual addr_t translateKernelSymbolToVA(const std::string& kernelSymbolName) = 0;
 
-        virtual addr_t
+        [[nodiscard]] virtual addr_t
         translateUserlandSymbolToVA(addr_t moduleBaseAddress, addr_t dtb, const std::string& userlandSymbolName) = 0;
 
         [[nodiscard]] virtual addr_t convertVAToPA(addr_t virtualAddress, addr_t cr3Register) = 0;
@@ -49,12 +49,12 @@ namespace VmiCore
 
         [[nodiscard]] virtual std::optional<std::string> extractWStringAtVA(addr_t stringVA, addr_t cr3) = 0;
 
-        virtual std::unique_ptr<std::string> extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3) = 0;
+        [[nodiscard]] virtual std::unique_ptr<std::string> extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3) = 0;
 
-        [[nodiscard]] virtual std::optional<std::unique_ptr<std::string>>
-        tryExtractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3) = 0;
+        [[nodiscard]] virtual std::optional<std::unique_ptr<std::string>> tryExtractUnicodeStringAtVA(addr_t stringVA,
+                                                                                                      addr_t cr3) = 0;
 
-        virtual std::unique_ptr<std::string> extractStringAtVA(addr_t virtualAddress, addr_t cr3) = 0;
+        [[nodiscard]] virtual std::unique_ptr<std::string> extractStringAtVA(addr_t virtualAddress, addr_t cr3) = 0;
 
         [[nodiscard]] virtual OperatingSystem getOsType() = 0;
 

diff --git a/vmicore/src/lib/io/ILogging.h b/vmicore/src/lib/io/ILogging.h
@@ -17,9 +17,9 @@ namespace VmiCore
 
         virtual void stop(const uint64_t& timeoutMillis) = 0;
 
-        virtual std::unique_ptr<ILogger> newLogger() = 0;
+        [[nodiscard]] virtual std::unique_ptr<ILogger> newLogger() = 0;
 
-        virtual std::unique_ptr<ILogger> newNamedLogger(std::string_view name) = 0;
+        [[nodiscard]] virtual std::unique_ptr<ILogger> newNamedLogger(std::string_view name) = 0;
 
         virtual void setLogLevel(::logging::Level level) = 0;
 

diff --git a/vmicore/src/lib/io/console/ConsoleLoggerBuilder.h b/vmicore/src/lib/io/console/ConsoleLoggerBuilder.h
@@ -16,9 +16,9 @@ namespace VmiCore
 
         void stop(const uint64_t&) override {}
 
-        std::unique_ptr<ILogger> newLogger() override;
+        [[nodiscard]] std::unique_ptr<ILogger> newLogger() override;
 
-        std::unique_ptr<ILogger> newNamedLogger(std::string_view name) override;
+        [[nodiscard]] std::unique_ptr<ILogger> newNamedLogger(std::string_view name) override;
 
         void setLogLevel(::logging::Level level) override;
 

diff --git a/vmicore/src/lib/io/grpc/GRPCServer.h b/vmicore/src/lib/io/grpc/GRPCServer.h
@@ -21,9 +21,9 @@ namespace VmiCore
 
         void stop(const uint64_t& timeoutMillis) override;
 
-        std::unique_ptr<ILogger> newLogger() override;
+        [[nodiscard]] std::unique_ptr<ILogger> newLogger() override;
 
-        std::unique_ptr<ILogger> newNamedLogger(std::string_view name) override;
+        [[nodiscard]] std::unique_ptr<ILogger> newNamedLogger(std::string_view name) override;
 
         void setLogLevel(::logging::Level level) override;
 

diff --git a/vmicore/src/lib/os/linux/SystemEventSupervisor.h b/vmicore/src/lib/os/linux/SystemEventSupervisor.h
@@ -30,11 +30,11 @@ namespace VmiCore::Linux
 
         void initialize() override;
 
-        BpResponse procForkConnectorCallback(IInterruptEvent& event);
+        [[nodiscard]] BpResponse procForkConnectorCallback(IInterruptEvent& event);
 
-        BpResponse procExecConnectorCallback(IInterruptEvent& event);
+        [[nodiscard]] BpResponse procExecConnectorCallback(IInterruptEvent& event);
 
-        BpResponse procExitConnectorCallback(IInterruptEvent& event);
+        [[nodiscard]] BpResponse procExitConnectorCallback(IInterruptEvent& event);
 
         void teardown() override;
 

diff --git a/vmicore/src/lib/os/windows/SystemEventSupervisor.h b/vmicore/src/lib/os/windows/SystemEventSupervisor.h
@@ -30,9 +30,9 @@ namespace VmiCore::Windows
 
         void initialize() override;
 
-        BpResponse pspCallProcessNotifyRoutinesCallback(IInterruptEvent& event);
+        [[nodiscard]] BpResponse pspCallProcessNotifyRoutinesCallback(IInterruptEvent& event);
 
-        BpResponse keBugCheck2Callback(IInterruptEvent& event);
+        [[nodiscard]] BpResponse keBugCheck2Callback(IInterruptEvent& event);
 
         void teardown() override;
 

diff --git a/vmicore/src/lib/plugins/PluginSystem.h b/vmicore/src/lib/plugins/PluginSystem.h
@@ -93,7 +93,7 @@ namespace VmiCore
         void registerProcessTerminationEvent(
             const std::function<void(std::shared_ptr<const ActiveProcessInformation>)>& terminationCallback) override;
 
-        std::shared_ptr<IBreakpoint>
+        [[nodiscard]] std::shared_ptr<IBreakpoint>
         createBreakpoint(uint64_t targetVA,
                          const ActiveProcessInformation& processInformation,
                          const std::function<BpResponse(IInterruptEvent&)>& callbackFunction) override;

diff --git a/vmicore/src/lib/vmi/InterruptEventSupervisor.cpp b/vmicore/src/lib/vmi/InterruptEventSupervisor.cpp
@@ -195,7 +195,8 @@ namespace VmiCore
             if (breakpointsAtEventPA != breakpointsAtEventGFN->second.Breakpoints.end())
             {
                 event->interrupt_event.reinject = DONT_REINJECT_INTERRUPT;
-                interruptEventSupervisor->interruptCallback(eventPA, event->vcpu_id, breakpointsAtEventPA->second);
+                return interruptEventSupervisor->interruptCallback(
+                    eventPA, event->vcpu_id, breakpointsAtEventPA->second);
             }
         }
 

diff --git a/vmicore/src/lib/vmi/InterruptEventSupervisor.h b/vmicore/src/lib/vmi/InterruptEventSupervisor.h
@@ -28,7 +28,7 @@ namespace VmiCore
 
         virtual void teardown() = 0;
 
-        virtual std::shared_ptr<IBreakpoint>
+        [[nodiscard]] virtual std::shared_ptr<IBreakpoint>
         createBreakpoint(uint64_t targetVA,
                          const ActiveProcessInformation& processInformation,
                          const std::function<BpResponse(IInterruptEvent&)>& callbackFunction,
@@ -56,7 +56,7 @@ namespace VmiCore
 
         void teardown() override;
 
-        std::shared_ptr<IBreakpoint>
+        [[nodiscard]] std::shared_ptr<IBreakpoint>
         createBreakpoint(uint64_t targetVA,
                          const ActiveProcessInformation& processInformation,
                          const std::function<BpResponse(IInterruptEvent&)>& callbackFunction,
@@ -66,9 +66,9 @@ namespace VmiCore
 
         static event_response_t _defaultInterruptCallback(vmi_instance_t vmi, vmi_event_t* event);
 
-        event_response_t interruptCallback(addr_t interruptPA,
-                                           uint32_t vcpuId,
-                                           const std::vector<std::shared_ptr<Breakpoint>>& breakpoints);
+        [[nodiscard]] event_response_t interruptCallback(addr_t interruptPA,
+                                                         uint32_t vcpuId,
+                                                         const std::vector<std::shared_ptr<Breakpoint>>& breakpoints);
 
         void singleStepCallback(__attribute__((unused)) vmi_event_t* singleStepEvent);
 

diff --git a/vmicore/src/lib/vmi/LibvmiInterface.cpp b/vmicore/src/lib/vmi/LibvmiInterface.cpp
@@ -83,7 +83,7 @@ namespace VmiCore
         }
     }
 
-    uint8_t LibvmiInterface::read8PA(const addr_t physicalAddress)
+    uint8_t LibvmiInterface::read8PA(addr_t physicalAddress)
     {
         uint8_t extractedValue = 0;
         auto accessContext = createPhysicalAddressAccessContext(physicalAddress);
@@ -95,7 +95,7 @@ namespace VmiCore
         return extractedValue;
     }
 
-    uint64_t LibvmiInterface::read64PA(const addr_t physicalAddress)
+    uint64_t LibvmiInterface::read64PA(addr_t physicalAddress)
     {
         uint64_t extractedValue = 0;
         auto accessContext = createPhysicalAddressAccessContext(physicalAddress);
@@ -107,7 +107,7 @@ namespace VmiCore
         return extractedValue;
     }
 
-    uint8_t LibvmiInterface::read8VA(const addr_t virtualAddress, const addr_t cr3)
+    uint8_t LibvmiInterface::read8VA(addr_t virtualAddress, addr_t cr3)
     {
         uint8_t extractedValue = 0;
         auto accessContext = createVirtualAddressAccessContext(virtualAddress, cr3);
@@ -119,7 +119,7 @@ namespace VmiCore
         return extractedValue;
     }
 
-    uint32_t LibvmiInterface::read32VA(const addr_t virtualAddress, const addr_t cr3)
+    uint32_t LibvmiInterface::read32VA(addr_t virtualAddress, addr_t cr3)
     {
         uint32_t extractedValue = 0;
         auto accessContext = createVirtualAddressAccessContext(virtualAddress, cr3);
@@ -131,7 +131,7 @@ namespace VmiCore
         return extractedValue;
     }
 
-    uint64_t LibvmiInterface::read64VA(const addr_t virtualAddress, const addr_t cr3)
+    uint64_t LibvmiInterface::read64VA(addr_t virtualAddress, addr_t cr3)
     {
         uint64_t extractedValue = 0;
         auto accessContext = createVirtualAddressAccessContext(virtualAddress, cr3);
@@ -165,10 +165,7 @@ namespace VmiCore
         return result;
     }
 
-    bool LibvmiInterface::readXVA(const addr_t virtualAddress,
-                                  const addr_t cr3,
-                                  std::vector<uint8_t>& content,
-                                  std::size_t size)
+    bool LibvmiInterface::readXVA(addr_t virtualAddress, addr_t cr3, std::vector<uint8_t>& content, std::size_t size)
     {
         if (size > content.size())
         {
@@ -185,7 +182,7 @@ namespace VmiCore
         return true;
     }
 
-    void LibvmiInterface::write8PA(const addr_t physicalAddress, uint8_t value)
+    void LibvmiInterface::write8PA(addr_t physicalAddress, uint8_t value)
     {
         auto accessContext = createPhysicalAddressAccessContext(physicalAddress);
         std::scoped_lock<std::mutex> lock(libvmiLock);
@@ -371,7 +368,7 @@ namespace VmiCore
         return pending;
     }
 
-    std::unique_ptr<std::string> LibvmiInterface::extractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3)
+    std::unique_ptr<std::string> LibvmiInterface::extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3)
     {
         auto extractedString = tryExtractUnicodeStringAtVA(stringVA, cr3);
 
@@ -382,7 +379,7 @@ namespace VmiCore
         return std::move(extractedString.value());
     }
 
-    std::optional<std::string> LibvmiInterface::extractWStringAtVA(const addr_t stringVA, const addr_t cr3)
+    std::optional<std::string> LibvmiInterface::extractWStringAtVA(addr_t stringVA, addr_t cr3)
     {
         auto accessContext = createVirtualAddressAccessContext(stringVA, cr3);
         std::scoped_lock<std::mutex> lock(libvmiLock);
@@ -399,8 +396,8 @@ namespace VmiCore
         return result;
     }
 
-    std::optional<std::unique_ptr<std::string>> LibvmiInterface::tryExtractUnicodeStringAtVA(const addr_t stringVA,
-                                                                                             const addr_t cr3)
+    std::optional<std::unique_ptr<std::string>> LibvmiInterface::tryExtractUnicodeStringAtVA(addr_t stringVA,
+                                                                                             addr_t cr3)
     {
         auto accessContext = createVirtualAddressAccessContext(stringVA, cr3);
         std::scoped_lock<std::mutex> lock(libvmiLock);
@@ -418,7 +415,7 @@ namespace VmiCore
         return result;
     }
 
-    std::unique_ptr<std::string> LibvmiInterface::extractStringAtVA(const addr_t virtualAddress, const addr_t cr3)
+    std::unique_ptr<std::string> LibvmiInterface::extractStringAtVA(addr_t virtualAddress, addr_t cr3)
     {
         auto accessContext = createVirtualAddressAccessContext(virtualAddress, cr3);
         std::scoped_lock<std::mutex> lock(libvmiLock);

diff --git a/vmicore/src/lib/vmi/LibvmiInterface.h b/vmicore/src/lib/vmi/LibvmiInterface.h
@@ -43,7 +43,7 @@ namespace VmiCore
 
         virtual void resumeVm() = 0;
 
-        virtual bool areEventsPending() = 0;
+        [[nodiscard]] virtual bool areEventsPending() = 0;
 
         virtual void stopSingleStepForVcpu(vmi_event_t* event, uint vcpuId) = 0;
 
@@ -64,22 +64,20 @@ namespace VmiCore
 
         void clearEvent(vmi_event_t& event, bool deallocate) override;
 
-        uint8_t read8PA(addr_t pyhsicalAddress) override;
+        [[nodiscard]] uint8_t read8PA(addr_t pyhsicalAddress) override;
 
-        uint64_t read64PA(const addr_t physicalAddress) override;
+        [[nodiscard]] uint64_t read64PA(addr_t physicalAddress) override;
 
-        uint8_t read8VA(addr_t virtualAddress, addr_t cr3) override;
+        [[nodiscard]] uint8_t read8VA(addr_t virtualAddress, addr_t cr3) override;
 
-        uint32_t read32VA(addr_t virtualAddress, addr_t cr3) override;
+        [[nodiscard]] uint32_t read32VA(addr_t virtualAddress, addr_t cr3) override;
 
-        uint64_t read64VA(addr_t virtualAddress, addr_t cr3) override;
+        [[nodiscard]] uint64_t read64VA(addr_t virtualAddress, addr_t cr3) override;
 
-        uint64_t readVA(addr_t virtualAddress, addr_t dtb, std::size_t size) override;
+        [[nodiscard]] uint64_t readVA(addr_t virtualAddress, addr_t dtb, std::size_t size) override;
 
-        bool readXVA(const addr_t virtualAddress,
-                     const addr_t cr3,
-                     std::vector<uint8_t>& content,
-                     std::size_t size) override;
+        [[nodiscard]] bool
+        readXVA(addr_t virtualAddress, addr_t cr3, std::vector<uint8_t>& content, std::size_t size) override;
 
         void write8PA(addr_t physicalAddress, uint8_t value) override;
 
@@ -91,11 +89,11 @@ namespace VmiCore
 
         [[nodiscard]] uint getNumberOfVCPUs() const override;
 
-        addr_t translateKernelSymbolToVA(const std::string& kernelSymbolName) override;
+        [[nodiscard]] addr_t translateKernelSymbolToVA(const std::string& kernelSymbolName) override;
 
-        addr_t translateUserlandSymbolToVA(addr_t moduleBaseAddress,
-                                           addr_t dtb,
-                                           const std::string& userlandSymbolName) override;
+        [[nodiscard]] addr_t translateUserlandSymbolToVA(addr_t moduleBaseAddress,
+                                                         addr_t dtb,
+                                                         const std::string& userlandSymbolName) override;
 
         [[nodiscard]] addr_t convertVAToPA(addr_t virtualAddress, addr_t processCr3) override;
 
@@ -111,10 +109,10 @@ namespace VmiCore
 
         [[nodiscard]] std::unique_ptr<std::string> extractUnicodeStringAtVA(addr_t stringVA, addr_t cr3) override;
 
-        [[nodiscard]] std::optional<std::string> extractWStringAtVA(const addr_t stringVA, const addr_t cr3) override;
+        [[nodiscard]] std::optional<std::string> extractWStringAtVA(addr_t stringVA, addr_t cr3) override;
 
-        [[nodiscard]] std::optional<std::unique_ptr<std::string>>
-        tryExtractUnicodeStringAtVA(const addr_t stringVA, const addr_t cr3) override;
+        [[nodiscard]] std::optional<std::unique_ptr<std::string>> tryExtractUnicodeStringAtVA(addr_t stringVA,
+                                                                                              addr_t cr3) override;
 
         [[nodiscard]] std::unique_ptr<std::string> extractStringAtVA(addr_t virtualAddress, addr_t cr3) override;
 
@@ -124,7 +122,7 @@ namespace VmiCore
 
         [[nodiscard]] uint16_t getWindowsBuild() override;
 
-        template <typename T> std::unique_ptr<T> readVa(const addr_t virtualAddress, const addr_t cr3)
+        template <typename T> std::unique_ptr<T> readVa(addr_t virtualAddress, addr_t cr3)
         {
             auto accessContext = createVirtualAddressAccessContext(virtualAddress, cr3);
             auto exctractedValue = std::make_unique<T>();
@@ -160,13 +158,13 @@ namespace VmiCore
         std::mutex libvmiLock{};
         std::mutex eventsListenLock{};
 
-        static std::unique_ptr<std::string> createConfigString(const std::string& offsetsFile);
+        [[nodiscard]] static std::unique_ptr<std::string> createConfigString(const std::string& offsetsFile);
 
         static void freeEvent(vmi_event_t* event, status_t rc);
 
-        static access_context_t createPhysicalAddressAccessContext(addr_t physicalAddress);
+        [[nodiscard]] static access_context_t createPhysicalAddressAccessContext(addr_t physicalAddress);
 
-        static access_context_t createVirtualAddressAccessContext(addr_t virtualAddress, addr_t cr3);
+        [[nodiscard]] static access_context_t createVirtualAddressAccessContext(addr_t virtualAddress, addr_t cr3);
 
         void flushV2PCache(addr_t pt) override;
 

diff --git a/vmicore/test/include/vmicore_test/vmi/mock_IntrospectionAPI.h b/vmicore/test/include/vmicore_test/vmi/mock_IntrospectionAPI.h
@@ -39,10 +39,7 @@ namespace VmiCore
 
         MOCK_METHOD(std::unique_ptr<std::string>, extractUnicodeStringAtVA, (addr_t, addr_t), (override));
 
-        MOCK_METHOD(std::optional<std::string>,
-                    extractWStringAtVA,
-                    (const addr_t stringVA, const addr_t cr3),
-                    (override));
+        MOCK_METHOD(std::optional<std::string>, extractWStringAtVA, (addr_t stringVA, addr_t cr3), (override));
 
         MOCK_METHOD(std::optional<std::unique_ptr<std::string>>,
                     tryExtractUnicodeStringAtVA,