Struct udmp_parser::Thread

pub struct Thread<'a> {
    pub id: u32,
    pub suspend_count: u32,
    pub priority_class: u32,
    pub priority: u32,
    pub teb: u64,
    /* private fields */
}

A thread that was running when the dump was generated.

Fields

id: u32

The thread ID.

suspend_count: u32

The suspend count counter cf Freezing and Suspending Threads.

priority_class: u32

The priority class cf Priority Class.

priority: u32

Thread priority cf Priority level.

teb: u64

The thread environment block address.

Implementations

impl<'a> Thread<'a>

pub fn context(&self) -> &ThreadContext<'_>

Get a reference to the ThreadContext.

Examples found in repository

examples/parser.rs (line 252)

fn main() -> Result<(), String> {
    // If we don't have any arguments, display the help.
    if env::args().len() == 1 {
        help();
        return Ok(());
    }

    // Parse the command line arguments.
    let cli = parse_args()?;

    // Let's try to parse the dump file specified by the user.
    let dump = UserDumpParser::new(cli.dump_path).map_err(|e| e.to_string())?;

    // Do we want to display modules?
    if cli.show_mods || cli.show_all {
        println!("Loaded modules:");

        // Iterate through the module and display their base address and path.
        for (base, module) in dump.modules() {
            println!("{:016x}: {}", base, module.path.display());
        }
    }

    // Do we want the memory map?
    if cli.show_memmap || cli.show_all {
        println!("Memory map:");

        // Iterate over the memory blocks.
        for block in dump.mem_blocks().values() {
            // Grab the string representation about its state, type, protection.
            let state = block.state_as_str();
            let type_ = block.type_as_str();
            let protect = block.protect_as_str();

            // Print it all out.
            print!(
                "{:016x} {:016x} {:016x} {:11} {:11} {:22}",
                block.range.start,
                block.range.end,
                block.len(),
                type_,
                state,
                protect
            );

            // Do we have a module that exists at this address?
            let module = dump.get_module(block.range.start);

            // If we do, then display its name / path.
            if let Some(module) = module {
                print!(
                    " [{}; \"{}\"]",
                    module.file_name().unwrap(),
                    module.path.display()
                );
            }

            // Do we have data with this block? If so display the first few
            // bytes.
            if block.data.len() >= 4 {
                print!(
                    " {:02x} {:02x} {:02x} {:02x}...",
                    block.data[0], block.data[1], block.data[2], block.data[3]
                );
            }

            println!();
        }
    }

    // Do we want threads?
    if cli.show_threads || cli.show_all {
        println!("Threads:");

        // Grab the foreground tid.
        let foreground_tid = dump.foreground_tid;

        // Iterate through all the threads.
        for (tid, thread) in dump.threads() {
            // If the user specified a pid..
            if let Some(wanted_tid) = cli.thread {
                // .. skip an threads that don't match what the user wants..
                if *tid != wanted_tid {
                    continue;
                }

                // Otherwise we keep going.
            }

            // If the user only wants the main thread, and we haven't found it,
            // skip this thread until we find it.
            if cli.show_foreground_thread
                && *tid != foreground_tid.expect("no foreground thread id in dump")
            {
                continue;
            }

            // Print out the thread info.
            println!("TID {}, TEB {:016x}", tid, thread.teb);
            println!("Context:");
            println!("{}", thread.context());
        }
    }

    // Do we want to dump memory?
    if let Some(address) = cli.address {
        println!("Memory:");

        // Try to find a block that contains `address`.
        let block = dump.get_mem_block(address);

        // If we have one..
        if let Some(block) = block {
            // .. and it has data, dump it..
            if let Some(data) = block.data_from(address) {
                println!("{:016x} -> {:016x}", address, block.end_addr());
                hexdump(address, data.iter().take(0x1_00).copied());
            }
            // .. otherwise, inform the user..
            else {
                println!(
                    "The memory at {:016x} (from block {:016x} -> {:016x}) has no backing data",
                    address, block.range.start, block.range.end
                );
            }
        }
        // .. otherwise, inform he user.
        else {
            println!("No memory block were found for {:016x}", address);
        }
    }

    // All right, enough for today.
    Ok(())
}

Trait Implementations

impl<'a> Debug for Thread<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.