Struct StructLayout32 

pub struct StructLayout32;

32-bit structure layout.

Trait Implementations

impl CurDir<StructLayout32> for CurDirLayout

const OFFSET_DOS_PATH: u64 = 0x00

Offset of the DosPath field.

impl LdrDataTableEntry<StructLayout32> for LdrDataTableEntryLayout

const OFFSET_IN_LOAD_ORDER_LINKS: u64 = 0x00

Offset of the InLoadOrderLinks field.

const OFFSET_IN_MEMORY_ORDER_LINKS: u64 = 0x08

Offset of the InMemoryOrderLinks field.

const OFFSET_IN_INITIALIZATION_ORDER_LINKS: u64 = 0x10

Offset of the InInitializationOrderLinks field.

impl ListEntry<StructLayout32> for ListEntryLayout

const OFFSET_FLINK: u64 = 0x00

Offset of the LIST_ENTRY::Flink field.

const OFFSET_BLINK: u64 = 0x04

Offset of the LIST_ENTRY::Blink field.

impl Peb<StructLayout32> for PebLayout

const OFFSET_LDR: u64 = 0x0c

Offset of the Ldr field.

const OFFSET_PROCESS_PARAMETERS: u64 = 0x10

Offset of the ProcessParameters field.

impl PebLdrData<StructLayout32> for PebLdrDataLayout

const OFFSET_IN_LOAD_ORDER_MODULE_LIST: u64 = 0x0c

Offset of the InLoadOrderModuleList field.

const OFFSET_IN_MEMORY_ORDER_MODULE_LIST: u64 = 0x14

Offset of the InMemoryOrderModuleList field.

const OFFSET_IN_INITIALIZATION_ORDER_MODULE_LIST: u64 = 0x1c

Offset of the InInitializationOrderModuleList field.

impl RtlUserProcessParameters<StructLayout32> for RtlUserProcessParametersLayout

const OFFSET_CURRENT_DIRECTORY: u64 = 0x24

Offset of the CurrentDirectory field.

const OFFSET_DLL_PATH: u64 = 0x30

Offset of the DllPath field.

const OFFSET_IMAGE_PATH_NAME: u64 = 0x38

Offset of the ImagePathName field.

const OFFSET_COMMAND_LINE: u64 = 0x40

Offset of the CommandLine field.

impl StructLayout for StructLayout32

const ADDRESS_WIDTH: u64 = 4

The address width (i.e. pointer size) in bytes.

fn read_va<Driver>( vmi: VmiState<'_, WindowsOs<Driver>>, ctx: impl Into<AccessContext>, ) -> Result<Va, VmiError>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

Reads a pointer-sized virtual address from guest memory.

fn read_unicode_string<Driver>( vmi: VmiState<'_, WindowsOs<Driver>>, ctx: impl Into<AccessContext>, ) -> Result<String, VmiError>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

Reads a UNICODE_STRING from guest memory.

impl Teb<StructLayout32> for TebLayout

const OFFSET_PROCESS_ENVIRONMENT_BLOCK: u64 = 0x30

Offset of the ProcessEnvironmentBlock field.

const OFFSET_LAST_ERROR_VALUE: u64 = 0x34

Offset of the LastErrorValue field.

const OFFSET_LAST_STATUS_VALUE: u64 = 0x0bf4

Offset of the LastStatusValue field.

const OFFSET_TLS_SLOTS: u64 = 0x0e10

Offset of the TlsSlots field.