Memflow

Latest version: v0.2.0

Safety actively analyzes 701836 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 3

0.2.0beta5

- Cleaned up plugin search paths and matched them with memflowup
- Improved error messages
- Plugins are resolved to their canonical path before adding
- Added VirtualTranslate as optional trait on Os
- Updated to latest cglue

0.2.0beta4

- Added missing functions to retrieve exports/imports/sections from kernel modules
- Added functions to retrieve primary kernel module

0.2.0beta3

- Allow for PhysicalMemoryView to fill in gaps with zeros

0.2.0beta2

- Memory API and Address rework

0.2.0beta1

- Entirely new cglue based plugin architecture and various other major improvements

0.1.5

- Added memflow::prelude::v1 and memflow_win32::prelude::v1 modules
- Added new fields to FFI
- Improved consistency of these function names in C FFI: `phys_read_raw` -> `phys_read_raw_into`, `page_size` -> `arch_page_size`.
- Added C++ bindings for the FFI
- Fixed core errors not displaying the full error message when wrapped in a win32 error
- Changed windows inventory search path from [user]/.local/lib/memflow to [user]/Documents/memflow
- Added {PWD} to inventory search path

Transitioning from C FFI to C++ FFI:
- `memflow.h`, and `memflow_win32.h` become `memflow_cpp.h`, and `memflow_win32_cpp.h`.
- The headers still depend on `memflow.h`, and `memflow_win32.h`. They are just wrappers for safety, and ergonomics.
- Types transition from `Type *` to `CType`. Every `CType` include automatic object destruction, so there is no need for the `type_free` methods.
- `CType` contains a `Type *` inside. The pointer can still be `null`. Checking whether object is valid is still the same: `if (CType != NULL)`
- Methods are implemented as class members. Most methods loose their prefix. The change looks like this: `process_module_info(Win32Process *process, const char *name)` becomes `CWin32Process::module_info(this, const char *name)`.
- Calling methods changes into calling a function on the object, instead of with the object. Example: `process_module_info(proc, "ntdll.dll")` becomes `proc.module_info("ntdll.dll")`.
- Exception to this are `virt`, and `phys` read/write functions. They do not loose their prefix, because they do have the prefix in the Rust library. So, `virt_read_u64(mem, addr)` becomes `mem.virt_read_u64(addr)`.
- There are extra convenience functions that utilize STL's `string`, and `vector` containers. Getting process/module names, and lists becomes much simpler.

Page 2 of 3

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.