vmi_os_windows/iter/
handle.rs

1use std::iter::FusedIterator;
2
3use vmi_core::{Architecture, VmiDriver, VmiError};
4
5use crate::{ArchAdapter, WindowsHandleTable, WindowsHandleTableEntry};
6
7/// An iterator for traversing entries in a Windows handle table.
8///
9/// The functionality is similar to the Windows kernel's internal
10/// `ExpSnapShotHandleTables()` function.
11pub struct HandleTableEntryIterator<'a, Driver>
12where
13    Driver: VmiDriver,
14    Driver::Architecture: Architecture + ArchAdapter<Driver>,
15{
16    /// VMI state.
17    handle_table: &'a WindowsHandleTable<'a, Driver>,
18
19    /// Current handle value.
20    current: u64,
21}
22
23impl<'a, Driver> HandleTableEntryIterator<'a, Driver>
24where
25    Driver: VmiDriver,
26    Driver::Architecture: Architecture + ArchAdapter<Driver>,
27{
28    /// Creates a new handle table entry iterator.
29    pub fn new(handle_table: &'a WindowsHandleTable<'a, Driver>) -> Self {
30        Self {
31            handle_table,
32            current: 0,
33        }
34    }
35
36    /// Walks to the next handle table entry.
37    fn walk_next(
38        &mut self,
39    ) -> Result<Option<(u64, WindowsHandleTableEntry<'a, Driver>)>, VmiError> {
40        const HANDLE_VALUE_INC: u64 = 4;
41
42        while let Some(entry) = self.handle_table.lookup(self.current)? {
43            let handle = self.current;
44            self.current += HANDLE_VALUE_INC;
45
46            if entry.object()?.is_some() {
47                return Ok(Some((handle, entry)));
48            }
49        }
50
51        Ok(None)
52    }
53}
54
55impl<'a, Driver> Iterator for HandleTableEntryIterator<'a, Driver>
56where
57    Driver: VmiDriver,
58    Driver::Architecture: Architecture + ArchAdapter<Driver>,
59{
60    type Item = Result<(u64, WindowsHandleTableEntry<'a, Driver>), VmiError>;
61
62    fn next(&mut self) -> Option<Self::Item> {
63        self.walk_next().transpose()
64    }
65}
66
67impl<Driver> FusedIterator for HandleTableEntryIterator<'_, Driver>
68where
69    Driver: VmiDriver,
70    Driver::Architecture: Architecture + ArchAdapter<Driver>,
71{
72}
vmi_os_windows/iter/handle.rs

vmi_os_windows/iter/
handle.rs
