Struct WindowsProcessParameters

pub struct WindowsProcessParameters<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows process parameters structure.

Process parameters contain command-line arguments, environment variables, and other startup information for a process. This structure supports both 32-bit and 64-bit structures.

Implementations

impl<'a, Driver> WindowsProcessParameters<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn current_directory(&self) -> Result<String, VmiError>

Returns the current directory.

This method returns the full path of the current directory for the process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.CurrentDirectory.

pub fn dll_path(&self) -> Result<String, VmiError>

Returns the DLL search path.

This method returns the list of directories that the system searches when loading DLLs for the process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.DllPath.

pub fn image_path_name(&self) -> Result<String, VmiError>

Returns the full path of the executable image.

This method retrieves the full file system path of the main executable that was used to create the process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.ImagePathName.

pub fn command_line(&self) -> Result<String, VmiError>

Returns the command line used to launch the process.

This method retrieves the full command line string, including the executable path and any arguments, used to start the process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.CommandLine.

Trait Implementations

impl<Driver> Debug for WindowsProcessParameters<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<Driver> VmiVa for WindowsProcessParameters<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.