Struct WindowsObject

pub struct WindowsObject<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows object.

A Windows object is a kernel-managed entity that can be referenced by handles or pointers. It includes processes, threads, files, and other system resources managed by the Windows Object Manager.

Implementation Details

Corresponds to _OBJECT_HEADER.Body.

Implementations

impl<'a, Driver> WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, Driver, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows object.

pub fn header(&self) -> Va

Returns the virtual address of the _OBJECT_HEADER structure.

Implementation Details

_OBJECT_HEADER is always at the beginning of the object.

pub fn name_info( &self, ) -> Result<Option<WindowsObjectHeaderNameInfo<'a, Driver>>, VmiError>

Returns the name information of the object.

pub fn directory(&self) -> Result<Option<WindowsObject<'a, Driver>>, VmiError>

Returns the directory object associated with the object name.

Shortcut for self.name_info()?.directory().

pub fn name(&self) -> Result<Option<String>, VmiError>

Returns the name of the object.

Shortcut for self.name_info()?.name().

pub fn full_path(&self) -> Result<Option<String>, VmiError>

Constructs the full path of a named object from its name information.

Shortcut for self.name_info()?.full_path().

pub fn object_type(&self) -> Result<WindowsObjectType<'a, Driver>, VmiError>

Returns the type of a Windows kernel object.

This method analyzes the object header of a kernel object and returns its type object (_OBJECT_TYPE). It handles the obfuscation introduced by the object header cookie, ensuring accurate type identification even on systems with this security feature enabled.

pub fn type_name(&self) -> Result<String, VmiError>

Returns the object type name.

Shortcut for self.object_type()?.name().

pub fn type_kind(&self) -> Result<Option<WindowsObjectTypeKind>, VmiError>

Returns the object type kind.

Shortcut for self.object_type()?.kind().

pub fn kind(&self) -> Result<Option<WindowsObjectKind<'a, Driver>>, VmiError>

Returns the specific kind of this object.

pub fn as_directory( &self, ) -> Result<Option<WindowsDirectoryObject<'a, Driver>>, VmiError>

Returns the object as a directory (_OBJECT_DIRECTORY).

pub fn as_file(&self) -> Result<Option<WindowsFileObject<'a, Driver>>, VmiError>

Returns the object as a file (_FILE_OBJECT).

pub fn as_key(&self) -> Result<Option<WindowsKey<'a, Driver>>, VmiError>

Returns the object as a key (_CM_KEY_BODY).

pub fn as_process(&self) -> Result<Option<WindowsProcess<'a, Driver>>, VmiError>

Returns the object as a process (_EPROCESS).

pub fn as_section( &self, ) -> Result<Option<WindowsSectionObject<'a, Driver>>, VmiError>

Returns the object as a section (_SECTION_OBJECT).

pub fn as_thread(&self) -> Result<Option<WindowsThread<'a, Driver>>, VmiError>

Returns the object as a thread (_ETHREAD).

pub fn as_type(&self) -> Result<Option<WindowsObjectType<'a, Driver>>, VmiError>

Returns the object as an object type (_OBJECT_TYPE).

Trait Implementations

impl<Driver> Debug for WindowsObject<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, Driver> From<WindowsDirectoryObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsDirectoryObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsFileObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsFileObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsObjectType<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsObjectType<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsProcess<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsProcess<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsSectionObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsSectionObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsSession<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsSession<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsThread<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsThread<'a, Driver>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsObject<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.