Struct StructLayout64 

pub struct StructLayout64;

64-bit structure layout.

Trait Implementations

impl CurDir<StructLayout64> for CurDirLayout

const OFFSET_DOS_PATH: u64 = 0x00

Offset of the DosPath field.

impl LdrDataTableEntry<StructLayout64> for LdrDataTableEntryLayout

const OFFSET_IN_LOAD_ORDER_LINKS: u64 = 0x00

Offset of the InLoadOrderLinks field.

const OFFSET_IN_MEMORY_ORDER_LINKS: u64 = 0x10

Offset of the InMemoryOrderLinks field.

const OFFSET_IN_INITIALIZATION_ORDER_LINKS: u64 = 0x20

Offset of the InInitializationOrderLinks field.

impl ListEntry<StructLayout64> for ListEntryLayout

const OFFSET_FLINK: u64 = 0x00

Offset of the LIST_ENTRY::Flink field.

const OFFSET_BLINK: u64 = 0x08

Offset of the LIST_ENTRY::Blink field.

impl Peb<StructLayout64> for PebLayout

const OFFSET_LDR: u64 = 0x18

Offset of the Ldr field.

const OFFSET_PROCESS_PARAMETERS: u64 = 0x20

Offset of the ProcessParameters field.

impl PebLdrData<StructLayout64> for PebLdrDataLayout

const OFFSET_IN_LOAD_ORDER_MODULE_LIST: u64 = 0x10

Offset of the InLoadOrderModuleList field.

const OFFSET_IN_MEMORY_ORDER_MODULE_LIST: u64 = 0x20

Offset of the InMemoryOrderModuleList field.

const OFFSET_IN_INITIALIZATION_ORDER_MODULE_LIST: u64 = 0x30

Offset of the InInitializationOrderModuleList field.

impl RtlUserProcessParameters<StructLayout64> for RtlUserProcessParametersLayout

const OFFSET_CURRENT_DIRECTORY: u64 = 0x38

Offset of the CurrentDirectory field.

const OFFSET_DLL_PATH: u64 = 0x50

Offset of the DllPath field.

const OFFSET_IMAGE_PATH_NAME: u64 = 0x60

Offset of the ImagePathName field.

const OFFSET_COMMAND_LINE: u64 = 0x70

Offset of the CommandLine field.

impl StructLayout for StructLayout64

const ADDRESS_WIDTH: u64 = 8

The address width (i.e. pointer size) in bytes.

fn read_va<Driver>( vmi: VmiState<'_, WindowsOs<Driver>>, ctx: impl Into<AccessContext>, ) -> Result<Va, VmiError>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

Reads a pointer-sized virtual address from guest memory.

fn read_unicode_string<Driver>( vmi: VmiState<'_, WindowsOs<Driver>>, ctx: impl Into<AccessContext>, ) -> Result<String, VmiError>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

Reads a UNICODE_STRING from guest memory.

impl Teb<StructLayout64> for TebLayout

const OFFSET_PROCESS_ENVIRONMENT_BLOCK: u64 = 0x60

Offset of the ProcessEnvironmentBlock field.

const OFFSET_LAST_ERROR_VALUE: u64 = 0x68

Offset of the LastErrorValue field.

const OFFSET_LAST_STATUS_VALUE: u64 = 0x1250

Offset of the LastStatusValue field.

const OFFSET_TLS_SLOTS: u64 = 0x1480

Offset of the TlsSlots field.