Struct memflow_win32::win32::kernel::Kernel

pub struct Kernel<T, V> {
    pub phys_mem: T,
    pub vat: V,
    pub offsets: Win32Offsets,
    pub kernel_info: KernelInfo,
    pub sysproc_dtb: Address,
}

Fields

phys_mem: T

vat: V

offsets: Win32Offsets

kernel_info: KernelInfo

sysproc_dtb: Address

Implementations

impl<T: PhysicalMemory, V: VirtualTranslate> Kernel<T, V>

pub fn new(
    phys_mem: T,
    vat: V,
    offsets: Win32Offsets,
    kernel_info: KernelInfo
) -> Self

pub fn destroy(self) -> T

Consume the self object and return the containing memory connection

pub fn eprocess_list(&mut self) -> Result<Vec<Address>>

pub fn eprocess_list_extend<E: Extend<Address>>(
    &mut self,
    eprocs: &mut E
) -> Result<()>

pub fn kernel_process_info(&mut self) -> Result<Win32ProcessInfo>

pub fn process_info_from_eprocess(
    &mut self,
    eprocess: Address
) -> Result<Win32ProcessInfo>

pub fn process_info_list_extend<E: Extend<Win32ProcessInfo>>(
    &mut self,
    list: &mut E
) -> Result<()>

pub fn process_info_list(&mut self) -> Result<Vec<Win32ProcessInfo>>

Retrieves a list of Win32ProcessInfo structs for all processes that can be found on the target system.

pub fn process_info(&mut self, name: &str) -> Result<Win32ProcessInfo>

Finds a process by it's name and returns the Win32ProcessInfo struct. If no process with the specified name can be found this function will return an Error.

pub fn process_info_pid(&mut self, pid: PID) -> Result<Win32ProcessInfo>

Finds a process by it's process id and returns the Win32ProcessInfo struct. If no process with the specified PID can be found this function will return an Error.

If the specified PID is 0 the kernel process is returned.

pub fn kernel_process(
    &mut self
) -> Result<Win32Process<VirtualDMA<&mut T, &mut V, Win32VirtualTranslate>>>

Constructs a Win32Process struct for the targets kernel by borrowing this kernel instance.

This function can be useful for quickly accessing the kernel process.

pub fn process(
    &mut self,
    name: &str
) -> Result<Win32Process<VirtualDMA<&mut T, &mut V, Win32VirtualTranslate>>>

Finds a process by its name and constructs a Win32Process struct by borrowing this kernel instance. If no process with the specified name can be found this function will return an Error.

This function can be useful for quickly accessing a process.

pub fn process_pid(
    &mut self,
    pid: PID
) -> Result<Win32Process<VirtualDMA<&mut T, &mut V, Win32VirtualTranslate>>>

Finds a process by its process id and constructs a Win32Process struct by borrowing this kernel instance. If no process with the specified name can be found this function will return an Error.

This function can be useful for quickly accessing a process.

pub fn into_kernel_process(
    self
) -> Result<Win32Process<VirtualDMA<T, V, Win32VirtualTranslate>>>

Constructs a Win32Process struct by consuming this kernel struct and moving it into the resulting process.

If necessary the kernel can be retrieved back by calling destroy() on the process after use.

This function can be useful for quickly accessing a process.

pub fn into_process(
    self,
    name: &str
) -> Result<Win32Process<VirtualDMA<T, V, Win32VirtualTranslate>>>

Finds a process by its name and constructs a Win32Process struct by consuming the kernel struct and moving it into the process.

If necessary the kernel can be retrieved back by calling destroy() on the process after use.

If no process with the specified name can be found this function will return an Error.

This function can be useful for quickly accessing a process.

pub fn into_process_pid(
    self,
    pid: PID
) -> Result<Win32Process<VirtualDMA<T, V, Win32VirtualTranslate>>>

Finds a process by its process id and constructs a Win32Process struct by consuming the kernel struct and moving it into the process.

If necessary the kernel can be retrieved back by calling destroy() on the process again.

If no process with the specified name can be found this function will return an Error.

This function can be useful for quickly accessing a process.

impl<T: PhysicalMemory> Kernel<T, DirectTranslate>

pub fn builder(connector: T) -> KernelBuilder<T, T, DirectTranslate>

Trait Implementations

impl<T: Clone, V: Clone> Clone for Kernel<T, V>

pub fn clone(&self) -> Kernel<T, V>

Returns a copy of the value.

pub fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: PhysicalMemory, V: VirtualTranslate> Debug for Kernel<T, V>

pub fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: PhysicalMemory, V: VirtualTranslate> OperatingSystem for Kernel<T, V>