Struct Win32Process

pub struct Win32Process<T, V, D> {
    pub virt_mem: VirtualDma<T, V, D>,
    pub proc_info: Win32ProcessInfo,
    /* private fields */
}

Fields

virt_mem: VirtualDma<T, V, D>

proc_info: Win32ProcessInfo

Implementations

impl<T: PhysicalMemory, V: VirtualTranslate2> Win32Process<T, V, Win32VirtualTranslate>

pub fn with_kernel( kernel: Win32Kernel<T, V>, proc_info: Win32ProcessInfo, ) -> Self

pub fn into_inner(self) -> (T, V)

Consumes this process, returning the underlying memory and vat objects

impl<'a, T: PhysicalMemory, V: VirtualTranslate2> Win32Process<Fwd<&'a mut T>, Fwd<&'a mut V>, Win32VirtualTranslate>

pub fn with_kernel_ref( kernel: &'a mut Win32Kernel<T, V>, proc_info: Win32ProcessInfo, ) -> Self

Constructs a new process by borrowing a kernel object.

Internally this will create a VirtualDma object that also borrows the PhysicalMemory and Vat objects from the kernel.

The resulting process object is NOT cloneable due to the mutable borrowing.

When u need a cloneable Process u have to use the ::with_kernel function which will move the kernel object.

Trait Implementations

impl<T, V, D> AsMut<VirtualDma<T, V, D>> for Win32Process<T, V, D>

fn as_mut(&mut self) -> &mut VirtualDma<T, V, D>

Converts this type into a mutable reference of the (usually inferred) input type.

impl<T: Clone, V: Clone, D: Clone> Clone for Win32Process<T, V, D>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T, V, D> Debug for Win32Process<T, V, D>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: PhysicalMemory, V: VirtualTranslate2, D: VirtualTranslate3> MemoryView for Win32Process<T, V, D>

fn read_raw_iter(&mut self, data: ReadRawMemOps<'_, '_, '_, '_>) -> Result<()>

fn write_raw_iter(&mut self, data: WriteRawMemOps<'_, '_, '_, '_>) -> Result<()>

fn metadata(&self) -> MemoryViewMetadata

fn read_iter<'a, 'b>( &mut self, inp: impl Iterator<Item = CTup2<Address, CSliceMut<'a, u8>>>, out: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceMut<'a, u8>>>>, out_fail: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceMut<'a, u8>>>>, ) -> Result<(), Error>

Read arbitrary amount of data.

fn read_raw_list( &mut self, data: &mut [CTup2<Address, CSliceMut<'_, u8>>], ) -> Result<(), PartialError<()>>

fn read_raw_into( &mut self, addr: Address, out: &mut [u8], ) -> Result<(), PartialError<()>>

fn read_raw( &mut self, addr: Address, len: usize, ) -> Result<Vec<u8>, PartialError<Vec<u8>>>

fn read_into<T>( &mut self, addr: Address, out: &mut T, ) -> Result<(), PartialError<()>>

where T: Pod + ?Sized, Self: Sized,

fn read<T>(&mut self, addr: Address) -> Result<T, PartialError<T>>

where T: Pod, Self: Sized,

fn read_addr32( &mut self, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_addr64( &mut self, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_addr_arch( &mut self, arch: &'static dyn Architecture, addr: Address, ) -> Result<Address, PartialError<Address>>

where Self: Sized,

fn read_ptr_into<U, T>( &mut self, ptr: Pointer<U, T>, out: &mut T, ) -> Result<(), PartialError<()>>

where U: PrimitiveAddress, T: Pod + ?Sized, Self: Sized,

fn read_ptr<U, T>(&mut self, ptr: Pointer<U, T>) -> Result<T, PartialError<T>>

where U: PrimitiveAddress, T: Pod, Self: Sized,

fn write_iter<'a, 'b>( &mut self, inp: impl Iterator<Item = CTup2<Address, CSliceRef<'a, u8>>>, out: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceRef<'a, u8>>>>, out_fail: Option<&mut OpaqueCallback<'b, CTup2<Address, CSliceRef<'a, u8>>>>, ) -> Result<(), Error>

Write arbitrary amount of data.

fn write_raw_list( &mut self, data: &[CTup2<Address, CSliceRef<'_, u8>>], ) -> Result<(), PartialError<()>>

fn write_raw( &mut self, addr: Address, data: &[u8], ) -> Result<(), PartialError<()>>

fn write<T>(&mut self, addr: Address, data: &T) -> Result<(), PartialError<()>>

where T: Pod + ?Sized, Self: Sized,

fn write_ptr<U, T>( &mut self, ptr: Pointer<U, T>, data: &T, ) -> Result<(), PartialError<()>>

where U: PrimitiveAddress, T: Pod + ?Sized, Self: Sized,

fn read_char_array( &mut self, addr: Address, len: usize, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a fixed length string from the target.

fn read_char_string_n( &mut self, addr: Address, n: usize, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a variable length string with a length of up to specified amount from the target.

fn read_char_string( &mut self, addr: Address, ) -> Result<String, PartialError<String>>

👎Deprecated: please use read_utf8 or read_utf8_lossy instead

Reads a variable length string with up to 4kb length from the target.

fn read_utf8( &mut self, addr: Address, max_length: usize, ) -> Result<String, PartialError<String>>

Reads a string at the given position with a length of up to max_length characters.

fn read_utf8_lossy( &mut self, addr: Address, max_length: usize, ) -> Result<String, PartialError<String>>

Reads a string at the given position with a length of up to max_length characters.

fn cursor(&mut self) -> MemoryCursor<Fwd<&mut Self>>

where Self: Sized,

Returns a cursor over this memory view. See MemoryCursor for more details.

fn into_cursor(self) -> MemoryCursor<Self>

where Self: Sized,

Converts this memory view into a cursor. See MemoryCursor for more details.

fn cursor_at(&mut self, address: Address) -> MemoryCursor<Fwd<&mut Self>>

where Self: Sized,

Returns a cursor over this memory view at the specified address. See MemoryCursor for more details.

fn into_cursor_at(self, address: Address) -> MemoryCursor<Self>

where Self: Sized,

Converts this memory view into a cursor at the specified address. See MemoryCursor for more details.

fn batcher(&mut self) -> MemoryViewBatcher<'_, Self>

where Self: Sized,

fn into_overlay_arch( self, arch: &'static dyn Architecture, ) -> ArchOverlayView<Self>

where Self: Sized,

fn overlay_arch( &mut self, arch: &'static dyn Architecture, ) -> ArchOverlayView<Fwd<&mut Self>>

where Self: Sized,

fn into_overlay_arch_parts( self, arch_bits: u8, little_endian: bool, ) -> ArchOverlayView<Self>

where Self: Sized,

fn overlay_arch_parts( &mut self, arch_bits: u8, little_endian: bool, ) -> ArchOverlayView<Fwd<&mut Self>>

where Self: Sized,

fn into_remap_view(self, mem_map: MemoryMap<(Address, u64)>) -> RemapView<Self>

where Self: Sized,

fn remap_view( &mut self, mem_map: MemoryMap<(Address, u64)>, ) -> RemapView<Fwd<&mut Self>>

where Self: Sized,

fn into_phys_mem(self) -> PhysicalMemoryOnView<Self>

where Self: Sized,

fn phys_mem(&mut self) -> PhysicalMemoryOnView<Fwd<&mut Self>>

where Self: Sized,

impl<T: PhysicalMemory, V: VirtualTranslate2> Process for Win32Process<T, V, Win32VirtualTranslate>

fn state(&mut self) -> ProcessState

Retrieves virtual address translator for the process (if applicable) Retrieves the state of the process

fn set_dtb(&mut self, dtb1: Address, _dtb2: Address) -> Result<()>

Changes the dtb this process uses for memory translations

Remarks

For memflow-win32 the second parameter should be set to Address::invalid().

fn module_address_list_callback( &mut self, target_arch: Option<&ArchitectureIdent>, callback: ModuleAddressCallback<'_>, ) -> Result<()>

Walks the process’ module list and calls the provided callback for each module

fn module_by_address( &mut self, address: Address, architecture: ArchitectureIdent, ) -> Result<ModuleInfo>

Retrieves a module by its structure address and architecture

Arguments

• address - address where module’s information resides in
• architecture - architecture of the module. Should be either ProcessInfo::proc_arch, or ProcessInfo::sys_arch.

fn primary_module_address(&mut self) -> Result<Address>

Retrieves address of the primary module structure of the process

This will be the module of the executable that is being run, and whose name is stored in _EPROCESS::IMAGE_FILE_NAME

fn info(&self) -> &ProcessInfo

Retrieves the process info

fn module_import_list_callback( &mut self, info: &ModuleInfo, callback: ImportCallback<'_>, ) -> Result<()>

Retrieves a list of all imports of a given module

fn module_export_list_callback( &mut self, info: &ModuleInfo, callback: ExportCallback<'_>, ) -> Result<()>

Retrieves a list of all exports of a given module

fn module_section_list_callback( &mut self, info: &ModuleInfo, callback: SectionCallback<'_>, ) -> Result<()>

Retrieves a list of all sections of a given module

fn mapped_mem_range( &mut self, gap_size: imem, start: Address, end: Address, out: MemoryRangeCallback<'_>, )

fn module_list_callback( &mut self, target_arch: Option<&ArchitectureIdent>, callback: OpaqueCallback<'_, ModuleInfo>, ) -> Result<(), Error>

Walks the process’ module list and calls the provided callback for each module

fn module_by_name_arch( &mut self, name: &str, architecture: Option<&ArchitectureIdent>, ) -> Result<ModuleInfo, Error>

Finds a process module by its name under specified architecture

fn module_by_name(&mut self, name: &str) -> Result<ModuleInfo, Error>

Finds any architecture process module by its name

fn module_list_arch( &mut self, target_arch: Option<&ArchitectureIdent>, ) -> Result<Vec<ModuleInfo>, Error>

Retrieves a module list for the process

fn module_list(&mut self) -> Result<Vec<ModuleInfo>, Error>

Retrieves a module list for the process

fn primary_module(&mut self) -> Result<ModuleInfo, Error>

Retrieves information for the primary module of the process

fn module_import_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<ImportInfo>, Error>

Retrieves a list of all imports of a given module

fn module_export_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<ExportInfo>, Error>

Retrieves a list of all exports of a given module

fn module_section_list( &mut self, info: &ModuleInfo, ) -> Result<Vec<SectionInfo>, Error>

Retrieves a list of all sections of a given module

fn module_import_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<ImportInfo, Error>

Finds a single import of a given module by its name

fn module_export_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<ExportInfo, Error>

Finds a single export of a given module by its name

fn module_section_by_name( &mut self, info: &ModuleInfo, name: &str, ) -> Result<SectionInfo, Error>

Finds a single section of a given module by its name

fn mapped_mem_range_vec( &mut self, gap_size: i64, start: Address, end: Address, ) -> Vec<CTup3<Address, u64, PageType>>

fn mapped_mem( &mut self, gap_size: i64, out: OpaqueCallback<'_, CTup3<Address, u64, PageType>>, )

fn mapped_mem_vec( &mut self, gap_size: i64, ) -> Vec<CTup3<Address, u64, PageType>>

impl<T: PhysicalMemory, V: VirtualTranslate2, D: VirtualTranslate3> VirtualTranslate for Win32Process<T, V, D>

fn virt_to_phys_list( &mut self, addrs: &[VtopRange], out: VirtualTranslationCallback<'_>, out_fail: VirtualTranslationFailCallback<'_>, )

Translate a list of address ranges into physical address space.

fn virt_to_phys_range( &mut self, start: Address, end: Address, out: OpaqueCallback<'_, VirtualTranslation>, )

Translate a single virtual address range into physical address space.

fn virt_translation_map_range( &mut self, start: Address, end: Address, out: OpaqueCallback<'_, VirtualTranslation>, )

Translate a single virtual address range into physical address space and coalesce nearby regions.

fn virt_page_map_range( &mut self, gap_size: i64, start: Address, end: Address, out: OpaqueCallback<'_, CTup3<Address, u64, PageType>>, )

Retrieves mapped virtual pages in the specified range.

fn virt_to_phys(&mut self, address: Address) -> Result<PhysicalAddress, Error>

Translate a single virtual address into a single physical address.

fn virt_page_info(&mut self, addr: Address) -> Result<Page, Error>

Retrieve page information at virtual address.

fn virt_page_map_range_vec( &mut self, gap_size: i64, start: Address, end: Address, ) -> Vec<CTup3<Address, u64, PageType>>

Retrieve a vector of physical pages within given range.

fn virt_translation_map(&mut self, out: OpaqueCallback<'_, VirtualTranslation>)

Get virtual translation map over entire address space.

fn virt_translation_map_vec(&mut self) -> Vec<VirtualTranslation>

Get virtual translation map over entire address space and return it as a vector.

fn phys_to_virt(&mut self, phys: Address) -> Option<Address>

Attempt to translate a physical address into a virtual one.

fn phys_to_virt_vec(&mut self, phys: Address) -> Vec<Address>

Retrieve all virtual address that map into a given physical address.

fn virt_page_map( &mut self, gap_size: i64, out: OpaqueCallback<'_, CTup3<Address, u64, PageType>>, )

Retrieves all mapped virtual pages.

fn virt_page_map_vec( &mut self, gap_size: i64, ) -> Vec<CTup3<Address, u64, PageType>>

Returns a Vec of all mapped virtual pages.