Struct Win32Kernel

pub struct Win32Kernel<T, V> {
    pub virt_mem: VirtualDma<T, V, Win32VirtualTranslate>,
    pub offsets: Win32Offsets,
    pub kernel_info: Win32KernelInfo,
    pub sysproc_dtb: Address,
    pub kernel_modules: Option<Win32ModuleListInfo>,
}

Fields

virt_mem: VirtualDma<T, V, Win32VirtualTranslate>

offsets: Win32Offsets

kernel_info: Win32KernelInfo

sysproc_dtb: Address

kernel_modules: Option<Win32ModuleListInfo>

Implementations

impl<T: 'static + PhysicalMemory + Clone, V: 'static + VirtualTranslate2 + Clone> Win32Kernel<T, V>

pub fn new( phys_mem: T, vat: V, offsets: Win32Offsets, kernel_info: Win32KernelInfo, ) -> Self

pub fn kernel_modules(&mut self) -> Result<Win32ModuleListInfo>

pub fn into_inner(self) -> (T, V)

Consumes this kernel and return the underlying owned memory and vat objects

pub fn kernel_process_info(&mut self) -> Result<Win32ProcessInfo>

pub fn process_info_from_base_info( &mut self, base_info: ProcessInfo, ) -> Result<Win32ProcessInfo>

impl<T: PhysicalMemory> Win32Kernel<T, DirectTranslate>

pub fn builder(connector: T) -> Win32KernelBuilder<T, T, DirectTranslate>

Trait Implementations

impl<T: PhysicalMemory, V: VirtualTranslate2> AsMut<T> for Win32Kernel<T, V>

fn as_mut(&mut self) -> &mut T

Converts this type into a mutable reference of the (usually inferred) input type.

impl<T: PhysicalMemory, V: VirtualTranslate2> AsMut<VirtualDma<T, V, Win32VirtualTranslate>> for Win32Kernel<T, V>

fn as_mut(&mut self) -> &mut VirtualDma<T, V, Win32VirtualTranslate>

Converts this type into a mutable reference of the (usually inferred) input type.

impl<T: Clone, V: Clone> Clone for Win32Kernel<T, V>

fn clone(&self) -> Win32Kernel<T, V>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: PhysicalMemory, V: VirtualTranslate2> Debug for Win32Kernel<T, V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: PhysicalMemory, V: VirtualTranslate2> MemoryView for Win32Kernel<T, V>

fn read_raw_iter(&mut self, data: ReadRawMemOps<'_, '_, '_, '_>) -> Result<()>

fn write_raw_iter(&mut self, data: WriteRawMemOps<'_, '_, '_, '_>) -> Result<()>

fn metadata(&self) -> MemoryViewMetadata

fn read_iter<'a, 'b>( &mut self, inp: impl Iterator<Item = CTup2<Address, CSliceMut<'a, u8>>>, out: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceMut<'a, u8>>>>, out_fail: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceMut<'a, u8>>>>, ) -> Result<(), Error>

Read arbitrary amount of data.

fn read_raw_list( &mut self, data: &mut [CTup2<Address, CSliceMut<'_, u8>>], ) -> Result<(), PartialError<()>>

fn read_raw_into( &mut self, addr: Address, out: &mut [u8], ) -> Result<(), PartialError<()>>

fn read_raw( &mut self, addr: Address, len: usize, ) -> Result<Vec<u8>, PartialError<Vec<u8>>>

fn read_into<T>( &mut self, addr: Address, out: &mut T, ) -> Result<(), PartialError<()>>

where T: Pod + ?Sized, Self: Sized,

fn read<T>(&mut self, addr: Address) -> Result<T, PartialError<T>>

where T: Pod, Self: Sized,

fn read_addr32( &mut self, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_addr64( &mut self, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_addr_arch( &mut self, arch: &'static dyn Architecture, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_ptr_into<U, T>( &mut self, ptr: Pointer<U, T>, out: &mut T, ) -> Result<(), PartialError<()>>

where U: PrimitiveAddress, T: Pod + ?Sized, Self: Sized,

fn read_ptr<U, T>(&mut self, ptr: Pointer<U, T>) -> Result<T, PartialError<T>>

where U: PrimitiveAddress, T: Pod, Self: Sized,

fn write_iter<'a, 'b>( &mut self, inp: impl Iterator<Item = CTup2<Address, CSliceRef<'a, u8>>>, out: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceRef<'a, u8>>>>, out_fail: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceRef<'a, u8>>>>, ) -> Result<(), Error>

Write arbitrary amount of data.

fn write_raw_list( &mut self, data: &[CTup2<Address, CSliceRef<'_, u8>>], ) -> Result<(), PartialError<()>>

fn write_raw( &mut self, addr: Address, data: &[u8], ) -> Result<(), PartialError<()>>

fn write<T>(&mut self, addr: Address, data: &T) -> Result<(), PartialError<()>>

where T: Pod + ?Sized, Self: Sized,

fn write_ptr<U, T>( &mut self, ptr: Pointer<U, T>, data: &T, ) -> Result<(), PartialError<()>>

where U: PrimitiveAddress, T: Pod + ?Sized, Self: Sized,

fn read_char_array( &mut self, addr: Address, len: usize, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a fixed length string from the target.

fn read_char_string_n( &mut self, addr: Address, n: usize, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a variable length string with a length of up to specified amount from the target.

fn read_char_string( &mut self, addr: Address, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a variable length string with up to 4kb length from the target.

fn read_utf8( &mut self, addr: Address, max_length: usize, ) -> Result<String, PartialError<String>>

Reads a string at the given position with a length of up to max_length characters.

fn read_utf8_lossy( &mut self, addr: Address, max_length: usize, ) -> Result<String, PartialError<String>>

Reads a string at the given position with a length of up to max_length characters.

fn cursor(&mut self) -> MemoryCursor<Fwd<&mut Self>>

where Self: Sized,

Returns a cursor over this memory view. See MemoryCursor for more details.

fn into_cursor(self) -> MemoryCursor<Self>

where Self: Sized,

Converts this memory view into a cursor. See MemoryCursor for more details.

fn cursor_at(&mut self, address: Address) -> MemoryCursor<Fwd<&mut Self>>

where Self: Sized,

Returns a cursor over this memory view at the specified address. See MemoryCursor for more details.

fn into_cursor_at(self, address: Address) -> MemoryCursor<Self>

where Self: Sized,

Converts this memory view into a cursor at the specified address. See MemoryCursor for more details.

fn batcher(&mut self) -> MemoryViewBatcher<'_, Self>

where Self: Sized,

fn into_overlay_arch( self, arch: &'static dyn Architecture, ) -> ArchOverlayView<Self>

where Self: Sized,

fn overlay_arch( &mut self, arch: &'static dyn Architecture, ) -> ArchOverlayView<Fwd<&mut Self>>

where Self: Sized,

fn into_overlay_arch_parts( self, arch_bits: u8, little_endian: bool, ) -> ArchOverlayView<Self>

where Self: Sized,

fn overlay_arch_parts( &mut self, arch_bits: u8, little_endian: bool, ) -> ArchOverlayView<Fwd<&mut Self>>

where Self: Sized,

fn into_remap_view(self, mem_map: MemoryMap<(Address, u64)>) -> RemapView<Self>

where Self: Sized,

fn remap_view( &mut self, mem_map: MemoryMap<(Address, u64)>, ) -> RemapView<Fwd<&mut Self>>

where Self: Sized,

fn into_phys_mem(self) -> PhysicalMemoryOnView<Self>

where Self: Sized,

fn phys_mem(&mut self) -> PhysicalMemoryOnView<Fwd<&mut Self>>

where Self: Sized,

impl<T: 'static + PhysicalMemory + Clone, V: 'static + VirtualTranslate2 + Clone> Os for Win32Kernel<T, V>

fn process_address_list_callback( &mut self, callback: AddressCallback<'_>, ) -> Result<()>

Walks a process list and calls a callback for each process structure address

The callback is fully opaque. We need this style so that C FFI can work seamlessly.

fn process_info_by_address(&mut self, address: Address) -> Result<ProcessInfo>

Find process information by its internal address

fn process_by_info( &mut self, info: ProcessInfo, ) -> Result<Self::ProcessType<'_>>

Creates a process by its internal address

It will share the underlying memory resources

fn into_process_by_info( self, info: ProcessInfo, ) -> Result<Self::IntoProcessType>

Creates a process by its internal address

It will consume the kernel and not affect memory usage

If no process with the specified address can be found this function will return an Error.

This function can be useful for quickly accessing a process.

fn module_address_list_callback( &mut self, callback: AddressCallback<'_>, ) -> Result<()>

Walks the kernel module list and calls the provided callback for each module structure address

Arguments

• callback - where to pass each matching module to. This is an opaque callback.

fn module_by_address(&mut self, address: Address) -> Result<ModuleInfo>

Retrieves a module by its structure address

Arguments

• address - address where module’s information resides in

fn primary_module_address(&mut self) -> Result<Address>

Retrieves address of the primary module structure of the process

This will generally be for the initial executable that was run

fn primary_module(&mut self) -> Result<ModuleInfo>

Retrieves information for the primary module of the process

This will generally be the initial executable that was run

fn module_import_list_callback( &mut self, info: &ModuleInfo, callback: ImportCallback<'_>, ) -> Result<()>

Retrieves a list of all imports of a given module

fn module_export_list_callback( &mut self, info: &ModuleInfo, callback: ExportCallback<'_>, ) -> Result<()>

Retrieves a list of all exports of a given module

fn module_section_list_callback( &mut self, info: &ModuleInfo, callback: SectionCallback<'_>, ) -> Result<()>

Retrieves a list of all sections of a given module

fn info(&self) -> &OsInfo

Retrieves the kernel info

type ProcessType<'a> = Win32Process<Fwd<&'a mut T>, Fwd<&'a mut V>, Win32VirtualTranslate>

type IntoProcessType = Win32Process<T, V, Win32VirtualTranslate>

fn process_address_list(&mut self) -> Result<Vec<Address>, Error>

Retrieves a process address list

fn process_info_list_callback( &mut self, callback: OpaqueCallback<'_, ProcessInfo>, ) -> Result<(), Error>

Walks a process list and calls a callback for each process

fn process_info_list(&mut self) -> Result<Vec<ProcessInfo>, Error>

Retrieves a process list

fn process_info_by_name(&mut self, name: &str) -> Result<ProcessInfo, Error>

Find process information by its name

fn process_info_by_pid(&mut self, pid: u32) -> Result<ProcessInfo, Error>

Find process information by its ID

fn process_by_address( &mut self, addr: Address, ) -> Result<Self::ProcessType<'_>, Error>

Creates a process by its internal address, borrowing the OS

fn process_by_name( &mut self, name: &str, ) -> Result<Self::ProcessType<'_>, Error>

Creates a process by its name, borrowing the OS

fn process_by_pid(&mut self, pid: u32) -> Result<Self::ProcessType<'_>, Error>

Creates a process by its ID, borrowing the OS

fn into_process_by_address( self, addr: Address, ) -> Result<Self::IntoProcessType, Error>

where Self: Sized,

Creates a process by its internal address, consuming the OS

fn into_process_by_name( self, name: &str, ) -> Result<Self::IntoProcessType, Error>

where Self: Sized,

Creates a process by its name, consuming the OS

fn into_process_by_pid(self, pid: u32) -> Result<Self::IntoProcessType, Error>

where Self: Sized,

Creates a process by its ID, consuming the OS

fn module_list_callback( &mut self, callback: OpaqueCallback<'_, ModuleInfo>, ) -> Result<(), Error>

Walks the OS module list and calls the provided callback for each module

fn module_by_name(&mut self, name: &str) -> Result<ModuleInfo, Error>

Finds a OS module by its name

fn module_list(&mut self) -> Result<Vec<ModuleInfo>, Error>

Retrieves a module list for the OS

fn module_import_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<ImportInfo>, Error>

Retrieves a list of all imports of a given module

fn module_export_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<ExportInfo>, Error>

Retrieves a list of all exports of a given module

fn module_section_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<SectionInfo>, Error>

Retrieves a list of all sections of a given module

fn module_import_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<ImportInfo, Error>

Finds a single import of a given module by its name

fn module_export_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<ExportInfo, Error>

Finds a single export of a given module by its name

fn module_section_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<SectionInfo, Error>

Finds a single section of a given module by its name

impl<T: 'static + PhysicalMemory + Clone, V: 'static + VirtualTranslate2 + Clone> OsKeyboard for Win32Kernel<T, V>

type KeyboardType<'a> = Win32Keyboard<VirtualDma<Fwd<&'a mut T>, Fwd<&'a mut V>, Win32VirtualTranslate>>

type IntoKeyboardType = Win32Keyboard<VirtualDma<T, V, Win32VirtualTranslate>>

fn keyboard(&mut self) -> Result<Self::KeyboardType<'_>>

fn into_keyboard(self) -> Result<Self::IntoKeyboardType>

impl<T: PhysicalMemory, V: VirtualTranslate2> PhysicalMemory for Win32Kernel<T, V>

fn phys_read_raw_iter( &mut self, data: PhysicalReadMemOps<'_, '_, '_, '_>, ) -> Result<()>

fn phys_write_raw_iter( &mut self, data: PhysicalWriteMemOps<'_, '_, '_, '_>, ) -> Result<()>

fn metadata(&self) -> PhysicalMemoryMetadata

Retrieve metadata about the physical memory

fn set_mem_map(&mut self, mem_map: &[PhysicalMemoryMapping])

Sets the memory mapping for the physical memory

fn phys_read_into<T>( &mut self, addr: PhysicalAddress, out: &mut T, ) -> Result<(), Error>

where T: Pod + ?Sized, Self: Sized,

fn phys_write<T>( &mut self, addr: PhysicalAddress, data: &T, ) -> Result<(), Error>

where T: Pod + ?Sized, Self: Sized,

fn into_phys_view(self) -> PhysicalMemoryView<Self>

where Self: Sized,

fn phys_view(&mut self) -> PhysicalMemoryView<Fwd<&mut Self>>

where Self: Sized,

fn into_mem_view(self) -> PhysicalMemoryView<Self>

where Self: Sized,

fn mem_view(&mut self) -> PhysicalMemoryView<Fwd<&mut Self>>

where Self: Sized,

impl<T: PhysicalMemory, V: VirtualTranslate2> VirtualTranslate for Win32Kernel<T, V>

fn virt_to_phys_list( &mut self, addrs: &[VtopRange], out: VirtualTranslationCallback<'_>, out_fail: VirtualTranslationFailCallback<'_>, )

Translate a list of address ranges into physical address space.

fn virt_to_phys_range( &mut self, start: Address, end: Address, out: OpaqueCallback<'_, VirtualTranslation>, )

Translate a single virtual address range into physical address space.

fn virt_translation_map_range( &mut self, start: Address, end: Address, out: OpaqueCallback<'_, VirtualTranslation>, )

Translate a single virtual address range into physical address space and coalesce nearby regions.

fn virt_page_map_range( &mut self, gap_size: i64, start: Address, end: Address, out: OpaqueCallback<'_, CTup3<Address, u64, PageType>>, )

Retrieves mapped virtual pages in the specified range.

fn virt_to_phys(&mut self, address: Address) -> Result<PhysicalAddress, Error>

Translate a single virtual address into a single physical address.

fn virt_page_info(&mut self, addr: Address) -> Result<Page, Error>

Retrieve page information at virtual address.

fn virt_page_map_range_vec( &mut self, gap_size: i64, start: Address, end: Address, ) -> Vec<CTup3<Address, u64, PageType>>

Retrieve a vector of physical pages within given range.

fn virt_translation_map(&mut self, out: OpaqueCallback<'_, VirtualTranslation>)

Get virtual translation map over entire address space.

fn virt_translation_map_vec(&mut self) -> Vec<VirtualTranslation>

Get virtual translation map over entire address space and return it as a vector.

fn phys_to_virt(&mut self, phys: Address) -> Option<Address>

Attempt to translate a physical address into a virtual one.

fn phys_to_virt_vec(&mut self, phys: Address) -> Vec<Address>

Retrieve all virtual address that map into a given physical address.

fn virt_page_map( &mut self, gap_size: i64, out: OpaqueCallback<'_, CTup3<Address, u64, PageType>>, )

Retrieves all mapped virtual pages.

fn virt_page_map_vec( &mut self, gap_size: i64, ) -> Vec<CTup3<Address, u64, PageType>>

Returns a Vec of all mapped virtual pages.