Struct WindowsProcess

pub struct WindowsProcess<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows process.

A process in Windows is represented by the _EPROCESS structure, which contains metadata about its execution state, memory layout, and handles.

Implementation Details

Corresponds to _EPROCESS.

Implementations

impl<'a, Driver> WindowsProcess<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new( vmi: VmiState<'a, Driver, WindowsOs<Driver>>, process: ProcessObject, ) -> Self

Creates a new Windows process.

pub fn peb(&self) -> Result<Option<WindowsPeb<'a, Driver>>, VmiError>

Returns the process environment block (PEB).

Implementation Details

The function first reads the _EPROCESS.WoW64Process field to determine if the process is a 32-bit process. If the field is NULL, the process is 64-bit. Otherwise, the function reads the _EWOW64PROCESS.Peb field to get the 32-bit PEB.

pub fn session(&self) -> Result<Option<WindowsSession<'a, Driver>>, VmiError>

Returns the session of the process.

pub fn handle_table( &self, ) -> Result<Option<WindowsHandleTable<'a, Driver>>, VmiError>

Returns the handle table of the process.

Implementation Details

Corresponds to _EPROCESS.ObjectTable.

pub fn vad_root(&self) -> Result<Option<WindowsRegion<'a, Driver>>, VmiError>

Returns the root of the virtual address descriptor (VAD) tree.

Implementation Details

Corresponds to _EPROCESS.VadRoot->BalancedRoot for Windows 7 and _EPROCESS.VadRoot->Root for Windows 8.1 and later.

pub fn vad_hint(&self) -> Result<Option<WindowsRegion<'a, Driver>>, VmiError>

Returns the VAD hint node.

The VAD hint is an optimization used by Windows to speed up VAD lookups. This method returns the address of the hint node in the VAD tree.

Implementation Details

Corresponds to _EPROCESS.VadRoot->NodeHint for Windows 7 and _EPROCESS.VadRoot->Hint for Windows 8.1 and later.

Trait Implementations

impl<'a, Driver> From<WindowsProcess<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsProcess<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> VmiOsProcess<'a, Driver> for WindowsProcess<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn id(&self) -> Result<ProcessId, VmiError>

Returns the process ID.

Implementation Details

Corresponds to _EPROCESS.UniqueProcessId.

fn object(&self) -> Result<ProcessObject, VmiError>

Returns the process object.

fn name(&self) -> Result<String, VmiError>

Returns the name of the process.

Implementation Details

Corresponds to _EPROCESS.ImageFileName.

fn parent_id(&self) -> Result<ProcessId, VmiError>

Returns the parent process ID.

Implementation Details

Corresponds to _EPROCESS.InheritedFromUniqueProcessId.

fn architecture(&self) -> Result<VmiOsImageArchitecture, VmiError>

Returns the architecture of the process.

Implementation Details

The function reads the _EPROCESS.WoW64Process field to determine if the process is a 32-bit process. If the field is NULL, the process is 64-bit. Otherwise, the process is 32-bit.

fn translation_root(&self) -> Result<Pa, VmiError>

Returns the process’s page table translation root.

Implementation Details

Corresponds to _KPROCESS.DirectoryTableBase.

fn user_translation_root(&self) -> Result<Pa, VmiError>

Returns the user-mode page table translation root.

If KPTI is disabled, this function will return the same value as translation_root.

Implementation Details

Corresponds to _KPROCESS.UserDirectoryTableBase.

fn image_base(&self) -> Result<Va, VmiError>

Returns the base address of the process image.

Implementation Details

Corresponds to _EPROCESS.SectionBaseAddress.

fn regions( &self, ) -> Result<impl Iterator<Item = Result<WindowsRegion<'a, Driver>, VmiError>>, VmiError>

Returns an iterator over the process’s memory regions (VADs).

Implementation Details

The function iterates over the VAD tree of the process.

fn find_region( &self, address: Va, ) -> Result<Option<WindowsRegion<'a, Driver>>, VmiError>

Finds the memory region (VAD) containing the given address.

This method efficiently searches the VAD tree to find the VAD node that corresponds to the given virtual address within the process’s address space.

Returns the matching VAD if found, or None if the address is not within any VAD.

Implementation Details

The functionality is similar to the Windows kernel’s internal MiLocateAddress() function.

fn threads( &self, ) -> Result<impl Iterator<Item = Result<<Self::Os as VmiOs<Driver>>::Thread<'a>, VmiError>>, VmiError>

Returns an iterator over the threads in the process.

Notes

Both _EPROCESS and _KPROCESS structures contain the same list of threads.

Implementation Details

Corresponds to _EPROCESS.ThreadListHead.

fn is_valid_address(&self, address: Va) -> Result<Option<bool>, VmiError>

Checks whether the given virtual address is valid in the process.

This method checks if page-faulting on the address would result in a successful access.

type Os = WindowsOs<Driver>

The VMI OS type.

impl<Driver> VmiVa for WindowsProcess<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.