Struct WindowsDirectoryObject 

pub struct WindowsDirectoryObject<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

A Windows directory object.

A directory object is a kernel-managed container that stores named objects such as events, mutexes, symbolic links, and device objects.

Implementation Details

Corresponds to _OBJECT_DIRECTORY.

Implementations

impl<'a, Driver> WindowsDirectoryObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows directory object.

pub fn iter( &self, ) -> Result<impl Iterator<Item = Result<WindowsObject<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Iterates over the objects in the directory.

pub fn lookup( &self, path: impl AsRef<str>, ) -> Result<Option<WindowsObject<'a, Driver>>, VmiError>

Resolves a relative path to a descendant object.

Splits path on \\ and descends one component at a time. Empty segments are ignored. Name comparison is ASCII-case-insensitive. Each intermediate component must resolve to a Directory object.

Returns Ok(None) if a component does not exist or an intermediate is some other object type. The final component may be any type. An empty path returns this directory.

Does not follow SymbolicLink objects.

pub fn child( &self, name: impl AsRef<str>, ) -> Result<Option<WindowsObject<'a, Driver>>, VmiError>

Returns the direct entry with the given name, if any.

name is treated as a single component. It is not split on \\, so child("Device\\HarddiskVolume4") will never match a real entry - use lookup for path traversal.

Walks every hash bucket and matches names with ASCII-case-insensitive comparison.

Per-bucket read errors do not abort the search. A paged-out bucket head or chain-link page would otherwise mask matches in other buckets. Errors are skipped.

Trait Implementations

impl<'a, Driver> From<WindowsDirectoryObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsDirectoryObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> FromWindowsObject<'a, Driver> for WindowsDirectoryObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from_object( object: WindowsObject<'a, Driver>, ) -> Result<Option<Self>, VmiError>

Attempts to convert a WindowsObject into a specific object type.

impl<Driver> VmiVa for WindowsDirectoryObject<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.