Struct WindowsProcessParameters 

pub struct WindowsProcessParameters<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

Process parameters accessor with a runtime pointer width.

Contains command-line arguments, environment variables, and other startup information for a process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.

Implementations

impl<'a, Driver> WindowsProcessParameters<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new process parameters accessor.

pub fn with_kind( vmi: VmiState<'a, WindowsOs<Driver>>, va: Va, root: Pa, kind: WindowsWow64Kind, ) -> Self

Creates a new process parameters accessor with an explicit address space root and pointer width.

pub fn current_directory(&self) -> Result<String, VmiError>

Returns the current directory.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.CurrentDirectory.DosPath.

pub fn dll_path(&self) -> Result<String, VmiError>

Returns the DLL search path.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.DllPath.

pub fn image_path_name(&self) -> Result<String, VmiError>

Returns the full path of the executable image.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.ImagePathName.

pub fn command_line(&self) -> Result<String, VmiError>

Returns the command line used to launch the process.

Implementation Details

Corresponds to _RTL_USER_PROCESS_PARAMETERS.CommandLine.

Trait Implementations

impl<Driver> Debug for WindowsProcessParameters<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, Driver> From<WindowsProcessParametersBase<'a, Driver, StructLayout32>> for WindowsProcessParameters<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsProcessParametersBase<'a, Driver, StructLayout32>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsProcessParametersBase<'a, Driver, StructLayout64>> for WindowsProcessParameters<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsProcessParametersBase<'a, Driver, StructLayout64>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsProcessParameters<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.