Struct vmread::WinContext

pub struct WinContext {
    pub process_list: Vec<WinProcess>,
    pub kmod_list: Vec<WinDll>,
    // some fields omitted
}

Context describing a particular VM instance

This structure provides interfaces to parse windows process information and to perform reads and writes to memory of the VM.

There is no new implementation, use create_context to retrieve an initialized context.

Fields

process_list: Vec<WinProcess>

kmod_list: Vec<WinDll>

Methods

impl WinContext

pub fn rwlist(&self) -> RWList

Get a read/write list for physical VM memory

If multiple RW operations are to be performed at the same time, it is more efficient to use RWList for the task

pub fn read<T>(self, address: u64) -> T

Read physical VM memory

Returns a value of type T at a given VM's physical address

Arguments

• address - address to read the data from

pub fn write<T>(&self, address: u64, value: &T) -> &WinContext

Write physical VM memory

Write value into a given VM's physical address

Arguments

• address - address to write the data to
• value - reference to the value that is to be written

pub fn refresh_processes(&mut self) -> &mut Self

Refresh the process list

pub fn refresh_kmods(&mut self) -> &mut Self

Refresh the kernel module list

Remarks

The kernel modules are not loaded into all processes, and not all of them are loaded into the system process either.

Trait Implementations

impl Drop for WinContext

fn drop(&mut self)

Executes the destructor for this type.