0vercl0k / kdmp-parser

A Windows kernel dump C++ parser library with Python 3 bindings.
MIT License
193 stars 29 forks source link

Build abstraction to allow users to parse dumps directly from the file #25

Closed 0vercl0k closed 4 months ago

0vercl0k commented 10 months ago

Build an abstraction that let the user be able to read the dump file the way they want:

cc @neitsa for testing it once it's ready for a test-drive

0vercl0k commented 10 months ago

@neitsa I hacked up a small prototype in https://github.com/0vercl0k/kdmp-parser/tree/fbl_fileread - do you mind giving it a shot and reporting what you're seeing?

Running the tests, I am not seeing any real differences (at least on dump files <= 1gb) - but your experiments might be different.

Basically, I rewrote the parsing logic to call out to a Reader_t class which can be reading directly from a memory mapping or a file on the disk (FileReader_t).

Also cc'ing @hugsy as he might be interested.

Cheers

0vercl0k commented 4 months ago

Closing this as it's been stale