Struct WindowsHandleTable

pub struct WindowsHandleTable<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows handle table.

A handle table in Windows tracks handles to kernel objects for a specific process, allowing access control and management.

Implementation Details

Corresponds to _HANDLE_TABLE.

Implementations

impl<'a, Driver> WindowsHandleTable<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, Driver, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows module object.

pub fn table_code(&self) -> Result<u64, VmiError>

Returns the table code of the handle table.

Notes

This value is cached after the first read.

Implementation Details

Corresponds to _HANDLE_TABLE.TableCode.

pub fn next_handle_needing_pool(&self) -> Result<u64, VmiError>

Returns the next handle needing pool.

This value tracks the next handle slot that requires additional pool allocation.

Notes

This value is cached after the first read.

Implementation Details

Corresponds to _HANDLE_TABLE.NextHandleNeedingPool.

pub fn iter(&'a self) -> Result<HandleTableEntryIterator<'a, Driver>, VmiError>

Iterates over all handle table entries.

Returns an iterator over all handle table entries that have a valid object pointer. The iterator yields a tuple containing the handle value and the handle table entry.

Implementation Details

The functionality is similar to the Windows kernel’s internal ExpSnapShotHandleTables() function.

pub fn lookup( &self, handle: u64, ) -> Result<Option<WindowsHandleTableEntry<'a, Driver>>, VmiError>

Performs a lookup in the handle table to find the address of a handle table entry.

Implements the multi-level handle table lookup algorithm used by Windows. Returns the virtual address of the handle table entry.

Implementation Details

The functionality is similar to the Windows kernel’s internal ExpLookupHandleTableEntry() function.

Trait Implementations

impl<Driver> VmiVa for WindowsHandleTable<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.