关于 rhai-memflow

此软件包提供了内存内省库 Memflow，用于 Rhai，Rust 的嵌入式脚本语言和评估引擎。

Memflow 是一个允许对运行中的系统和它们的快照进行实时内存内省的库。

用法

Cargo.toml

[dependencies]
rhai-memflow = "0.1"
# `rhai-memflow` uses version `^0.2.0-beta`, this .
memflow = { version = "^0.2.0-beta", features = ["plugins"] }

Rhai 脚本

let calc_proc = OS.process("CalculatorApp.exe");
let mod_base = calc_proc.mod("CalculatorApp.dll").base;

// Our native!
native COFFHeader {
    ^ 6, // Pad 6 bytes.
    sections: UInt16,
    timestamp: UInt32
};

let coff_header = calc_proc.read(COFFHeader, mod_base + 0x40);
print(coff_header);

Rust 源代码

use memflow::prelude::v1::*;
use rhai::{packages::Package, Engine, Scope};

// Create our inventory and OS.
let inventory = Inventory::scan();
let os = inventory.builder().os_chain(chain).build()?;

// Register our memflow package.
let mut engine = Engine::new();
let package = MemflowPackage::new();
package.register_into_engine(&mut engine);

// Add our OS to rhai scope.
let mut scope = Scope::new();
let shared_os: SharedOs = RefCell::new(os);
scope.push_constant("OS", shared_os);

// Run our script.
engine
    .eval_with_scope::<()>(&mut scope, include_str!("script.rhai"))
    .expect("eval failed");