Struct memprocfs::VmmPdb

pub struct VmmPdb<'a> {
    pub module: String,
    /* private fields */
}

Debug Symbol API.

The PDB sub-system requires that MemProcFS supporting DLLs/.SO’s for debugging and symbol server are put alongside vmm.dll. Also it’s recommended that the file info.db is put alongside vmm.dll.

Created By

• vmmprocess.pdb_from_module_address()
• vmm.kernel().pdb()

Examples

// Retrieve the PDB struct associated with the kernel (nt).
let kernel = vmm.kernel();
let pdb = kernel.pdb();

// Retrieve the PDB struct associated with a process module.
let pdb = vmmprocess.pdb("ntdll.dll")?;

Fields

module: String

Implementations

impl VmmPdb<'_>

pub fn symbol_name_from_address( &self, va_or_offset: u64 ) -> ResultEx<(String, u32)>

Retrieve a symbol name and a displacement given a module offset or virtual address.

Arguments

• va_or_offset - Virtual address or offset from module base.

Examples

if let Ok(r) = pdb.symbol_name_from_address(va_symbol) {
    println!("va_o: {:x} name: '{}' displacement: {:x}", va_symbol, r.0, r.1);
}

pub fn symbol_address_from_name(&self, symbol_name: &str) -> ResultEx<u64>

Lookup a symbol address given its name.

Arguments

• symbol_name

Examples

let va = pdb_nt.symbol_address_from_name("MiMapContiguousMemory")?;

pub fn type_size(&self, type_name: &str) -> ResultEx<u32>

Retrieve the size of a struct/type.

Arguments

• type_name

Examples

let size_eprocess = pdb_nt.type_size("_EPROCESS")?;

pub fn type_child_offset( &self, type_name: &str, type_child_name: &str ) -> ResultEx<u32>

Retrieve offset of a struct child member.

Arguments

• type_name
• type_child_name

Examples

let offet_vadroot = pdb_nt.type_child_offset("_EPROCESS", "VadRoot")?

Trait Implementations

impl<'a> Debug for VmmPdb<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VmmPdb<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.