Struct MemoryImage

pub struct MemoryImage {
    pub data: Vec<u8>,
    pub load_address: u64,
    pub original_image_base: u64,
    pub relocation_delta: i64,
}

Captured memory image of running bootloader

This struct holds a captured PE image along with metadata needed to reverse relocations and create a bootable disk image.

Fields

data: Vec<u8>

Raw image data (as loaded by UEFI)

load_address: u64

Base address where image is loaded

original_image_base: u64

Original ImageBase from PE header (before UEFI modified it)

relocation_delta: i64

Relocation delta (load_address - original_image_base)

Implementations

impl MemoryImage

pub fn capture_from_memory( _image_base: *const u8, _image_size: usize, ) -> Result<Self, PeError>

Capture running bootloader from UEFI LoadedImage protocol

Arguments

• image_base - Pointer to loaded image (from LoadedImageProtocol.image_base)
• image_size - Size of loaded image (from LoadedImageProtocol.image_size)

Returns

Captured image with relocation information

Note

Not yet implemented. See bootloader/src/installer/operations.rs for the current working implementation.

pub fn create_bootable_image(&self) -> Result<Vec<u8>, PeError>

Create bootable disk image by reversing relocations

Note

Not yet implemented. See PeHeaders::unrelocate_image() and PeHeaders::rva_to_file_layout() for the current working implementation.