Struct StructReader

pub struct StructReader(/* private fields */);

A handler for reading structured data from guest memory.

Provides safe access to structured data (like C structs) read from guest memory, with proper bounds checking and endianness handling. It reads the data as a byte buffer and provides methods to safely access fields at specific offsets and sizes.

Examples

offsets! {
    #[derive(Debug)]
    pub struct Offsets {
        struct _UNICODE_STRING {
            Length: Field,          // USHORT
            MaximumLength: Field,   // USHORT
            Buffer: Field,          // PWSTR
        }
    }
}


let offsets = Offsets::new(profile)?;
let UNICODE_STRING = &offsets._UNICODE_STRING;

// Read the structure from memory.
let us = StructReader::new(vmi, ctx, UNICODE_STRING.effective_len())?;

// Access the field values.
let length = us.read(UNICODE_STRING.Length)?;
let buffer = us.read(UNICODE_STRING.Buffer)?;

Implementations

impl StructReader

pub fn new<Driver, Os>( vmi: &VmiState<'_, Driver, Os>, va: Va, len: usize, ) -> Result<Self, VmiError>

where Driver: VmiDriver, Os: VmiOs<Driver>,

Creates a new structure reader.

Reads len bytes from the guest memory at the specified address into a new StructReader instance. The data can then be accessed using the read method with appropriate field descriptors.

pub fn new_in<Driver>( vmi: &VmiCore<Driver>, ctx: impl Into<AccessContext>, len: usize, ) -> Result<Self, VmiError>

where Driver: VmiDriver,

Creates a new structure reader.

Reads len bytes from the guest memory at the specified address into a new StructReader instance. The data can then be accessed using the read method with appropriate field descriptors.

pub fn read(&self, field: Field) -> Result<u64, VmiError>

Reads a field value from the data buffer.

Extracts a value from the buffer using the provided field descriptor, which specifies the offset and size of the field. The value is interpreted as a little-endian integer of the appropriate size and returned as a u64.

Endianness

Values are always read as little-endian integers. The returned u64 will contain the zero-extended value.