Struct WindowsSession

pub struct WindowsSession<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows session space.

The session space is a kernel structure that contains the session-specific data for a process.

Each logon session (e.g., when a user connects via Remote Desktop) gets a separate instance of _MM_SESSION_SPACE.

Implementation Details

Corresponds to _MM_SESSION_SPACE.

Implementations

impl<'a, Driver> WindowsSession<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, Driver, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows session space.

pub fn id(&self) -> Result<u32, VmiError>

Returns the session ID.

Implementation Details

Corresponds to _MM_SESSION_SPACE.SessionId.

pub fn processes( &'a self, ) -> Result<impl Iterator<Item = Result<WindowsProcess<'a, Driver>, VmiError>>, VmiError>

Returns the list of processes in the session.

Implementation Details

Corresponds to _MM_SESSION_SPACE.ProcessList.

Trait Implementations

impl<'a, Driver> From<WindowsSession<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsSession<'a, Driver>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsSession<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.