vmi-os-windows 0.7.0

Windows OS specific code for VMI
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

use isr_macros::{Bitfield, Field, offsets};

offsets! {
    /// Windows 10+ kernel offsets used by the [`WindowsOs`] implementation.
    ///
    /// [`WindowsOs`]: crate::WindowsOs
    #[derive(Debug)]
    pub struct Offsets {

        struct _SECTION {
            StartingVpn: Field,
            EndingVpn: Field,
            ControlArea: Field,
            Flags: Field,
            SizeOfSection: Field,
        }

        struct _HANDLE_TABLE_ENTRY {
            Attributes: Bitfield,
            ObjectPointerBits: Bitfield,
            GrantedAccessBits: Bitfield,
        }

        struct _EWOW64PROCESS {
            Peb: Field,                     // PVOID
        }

        struct _RTL_AVL_TREE {
            Root: Field,                    // _RTL_BALANCED_NODE*
        }

        struct _RTL_BALANCED_NODE {
            Left: Field,                    // _RTL_BALANCED_NODE*
            Right: Field,                   // _RTL_BALANCED_NODE*
            ParentValue: Field,             // ULONG_PTR
        }

        struct _MMVAD_FLAGS1 {
            CommitCharge: Bitfield,         // ULONG : 31
            MemCommit: Bitfield,            // ULONG : 1
        }

    }
}