vmi-os-windows 0.7.0

Windows OS specific code for VMI
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

use isr_macros::{Bitfield, Field, offsets};

offsets! {
    /// Windows 7 kernel offsets used by the [`WindowsOs`] implementation.
    ///
    /// [`WindowsOs`]: crate::WindowsOs
    #[derive(Debug)]
    pub struct Offsets {

        struct _SECTION_OBJECT {
            StartingVa: Field,
            EndingVa: Field,
            Segment: Field,
        }

        struct _SEGMENT_OBJECT {
            BaseAddress: Field,
            SizeOfSegment: Field,
            ControlArea: Field,
            MmSectionFlags: Field,
        }

        struct _HANDLE_TABLE_ENTRY {
            Object: Field,
            ObAttributes: Field,
            GrantedAccess: Field,
        }

        struct _MM_AVL_TABLE {
            BalancedRoot: Field,            // _MMADDRESS_NODE
            NumberGenericTableElements: Bitfield, // ULONG_PTR
            NodeHint: Field,                // PVOID
        }

        struct _MMADDRESS_NODE {
            Parent: Field,                  // _MMADDRESS_NODE*
            LeftChild: Field,               // _MMADDRESS_NODE*
            RightChild: Field,              // _MMADDRESS_NODE*
        }

    }
}