Struct WindowsPeb 

pub struct WindowsPeb<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

PEB accessor with a runtime pointer width.

The PEB is a user-mode structure that stores process-wide information, such as loaded modules, heap data, and environment settings.

Implementation Details

Corresponds to _PEB.

Implementations

impl<'a, Driver> WindowsPeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new PEB accessor.

pub fn with_kind( vmi: VmiState<'a, WindowsOs<Driver>>, va: Va, root: Pa, kind: WindowsWow64Kind, ) -> Self

Creates a new PEB accessor with an explicit address space root and pointer width.

pub fn ldr(&self) -> Result<WindowsPebLdrData<'a, Driver>, VmiError>

Returns the PEB loader data.

The loader data contains the three module lists maintained by the Windows loader.

Implementation Details

Corresponds to _PEB.Ldr.

pub fn process_parameters( &self, ) -> Result<WindowsProcessParameters<'a, Driver>, VmiError>

Returns the process parameters of the process.

Implementation Details

Corresponds to _PEB.ProcessParameters.

pub fn current_directory(&self) -> Result<String, VmiError>

Returns the current directory.

Shortcut for self.process_parameters()?.current_directory().

pub fn dll_path(&self) -> Result<String, VmiError>

Returns the DLL search path.

Shortcut for self.process_parameters()?.dll_path().

pub fn image_path_name(&self) -> Result<String, VmiError>

Returns the full path of the executable image.

Shortcut for self.process_parameters()?.image_path_name().

pub fn command_line(&self) -> Result<String, VmiError>

Returns the command line used to launch the process.

Shortcut for self.process_parameters()?.command_line().

Trait Implementations

impl<Driver> Debug for WindowsPeb<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, Driver> From<WindowsPebBase<'a, Driver, StructLayout32>> for WindowsPeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsPebBase<'a, Driver, StructLayout32>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsPebBase<'a, Driver, StructLayout64>> for WindowsPeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsPebBase<'a, Driver, StructLayout64>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsPeb<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.