vmi_os_windows/comps/
name_info.rs

1use vmi_core::{Architecture, Va, VmiDriver, VmiError, VmiState, VmiVa};
2
3use super::{WindowsObject, macros::impl_offsets};
4use crate::{ArchAdapter, WindowsOs, WindowsOsExt as _};
5
6/// A name information for a Windows object.
7///
8/// This structure stores the name and directory information
9/// associated with a named kernel object.
10///
11/// # Implementation Details
12///
13/// Corresponds to `_OBJECT_HEADER_NAME_INFO`.
14pub struct WindowsObjectHeaderNameInfo<'a, Driver>
15where
16    Driver: VmiDriver,
17    Driver::Architecture: Architecture + ArchAdapter<Driver>,
18{
19    /// The VMI state.
20    vmi: VmiState<'a, Driver, WindowsOs<Driver>>,
21
22    /// The virtual address of the `_OBJECT_HEADER_NAME_INFO` structure.
23    va: Va,
24}
25
26impl<Driver> VmiVa for WindowsObjectHeaderNameInfo<'_, Driver>
27where
28    Driver: VmiDriver,
29    Driver::Architecture: Architecture + ArchAdapter<Driver>,
30{
31    fn va(&self) -> Va {
32        self.va
33    }
34}
35
36impl<Driver> std::fmt::Debug for WindowsObjectHeaderNameInfo<'_, Driver>
37where
38    Driver: VmiDriver,
39    Driver::Architecture: Architecture + ArchAdapter<Driver>,
40{
41    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
42        let directory = self.directory();
43        let name = self.name();
44
45        f.debug_struct("WindowsObjectHeaderNameInfo")
46            .field("directory", &directory)
47            .field("name", &name)
48            .finish()
49    }
50}
51
52impl<'a, Driver> WindowsObjectHeaderNameInfo<'a, Driver>
53where
54    Driver: VmiDriver,
55    Driver::Architecture: Architecture + ArchAdapter<Driver>,
56{
57    impl_offsets!();
58
59    /// Creates a new Windows object header name info.
60    pub fn new(vmi: VmiState<'a, Driver, WindowsOs<Driver>>, va: Va) -> Self {
61        Self { vmi, va }
62    }
63
64    /// Returns the directory object associated with the object name.
65    ///
66    /// # Implementation Details
67    ///
68    /// Corresponds to `_OBJECT_HEADER_NAME_INFO.Directory`.
69    pub fn directory(&self) -> Result<Option<WindowsObject<'a, Driver>>, VmiError> {
70        let offsets = self.offsets();
71        let OBJECT_HEADER_NAME_INFO = &offsets._OBJECT_HEADER_NAME_INFO;
72
73        let directory = self
74            .vmi
75            .read_va_native(self.va + OBJECT_HEADER_NAME_INFO.Directory.offset())?;
76
77        if directory.is_null() {
78            return Ok(None);
79        }
80
81        Ok(Some(WindowsObject::new(self.vmi, directory)))
82    }
83
84    /// Returns the name of the object.
85    ///
86    /// # Implementation Details
87    ///
88    /// Corresponds to `_OBJECT_HEADER_NAME_INFO.Name`.
89    pub fn name(&self) -> Result<String, VmiError> {
90        let offsets = self.offsets();
91        let OBJECT_HEADER_NAME_INFO = &offsets._OBJECT_HEADER_NAME_INFO;
92
93        self.vmi
94            .os()
95            .read_unicode_string(self.va + OBJECT_HEADER_NAME_INFO.Name.offset())
96    }
97
98    /// Constructs the full path of a named object from its name information.
99    ///
100    /// # Implementation Details
101    pub fn full_path(&self) -> Result<String, VmiError> {
102        let mut path = String::new();
103
104        if let Some(directory) = self.directory()? {
105            if let Some(directory_path) = directory.full_path()? {
106                path.push_str(&directory_path);
107            }
108
109            if directory.va() != self.vmi.os().object_root_directory()?.va() {
110                path.push('\\');
111            }
112        }
113
114        path.push_str(&self.name()?);
115
116        Ok(path)
117    }
118}
vmi_os_windows/comps/name_info.rs

vmi_os_windows/comps/
name_info.rs
