Struct WindowsPebLdrData 

pub struct WindowsPebLdrData<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

PEB loader data accessor with a runtime pointer width.

Implementation Details

Corresponds to _PEB_LDR_DATA.

Implementations

impl<'a, Driver> WindowsPebLdrData<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new PEB loader data accessor.

pub fn with_kind( vmi: VmiState<'a, WindowsOs<Driver>>, va: Va, root: Pa, kind: WindowsWow64Kind, ) -> Self

Creates a new PEB loader data accessor with an explicit address space root and pointer width.

pub fn in_load_order_modules( &self, ) -> Result<impl Iterator<Item = Result<WindowsUserModule<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Returns an iterator over modules in load order.

Implementation Details

Corresponds to _PEB_LDR_DATA.InLoadOrderModuleList.

pub fn in_memory_order_modules( &self, ) -> Result<impl Iterator<Item = Result<WindowsUserModule<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Returns an iterator over modules in memory order.

Implementation Details

Corresponds to _PEB_LDR_DATA.InMemoryOrderModuleList.

pub fn in_initialization_order_modules( &self, ) -> Result<impl Iterator<Item = Result<WindowsUserModule<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Returns an iterator over modules in initialization order.

Implementation Details

Corresponds to _PEB_LDR_DATA.InInitializationOrderModuleList.

Trait Implementations

impl<'a, Driver> From<WindowsPebLdrDataBase<'a, Driver, StructLayout32>> for WindowsPebLdrData<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsPebLdrDataBase<'a, Driver, StructLayout32>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsPebLdrDataBase<'a, Driver, StructLayout64>> for WindowsPebLdrData<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsPebLdrDataBase<'a, Driver, StructLayout64>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsPebLdrData<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.