Struct WindowsSectionObject 

pub struct WindowsSectionObject<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

A Windows section object.

A section object in Windows is a kernel structure used for memory mapping and shared memory management. It allows multiple processes to share memory regions or map files into their address space.

Implementation Details

Corresponds to _SECTION_OBJECT or _SECTION.

Implementations

impl<'a, Driver> WindowsSectionObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows section object.

pub fn start(&self) -> Result<Va, VmiError>

Returns the starting address of the section.

Implementation Details

Corresponds to _SECTION_OBJECT.StartingVa or _SECTION.StartingVpn shifted left by 12 bits.

pub fn end(&self) -> Result<Va, VmiError>

Returns the ending address of the section (exclusive).

Implementation Details

Corresponds to _SECTION_OBJECT.EndingVa or _SECTION.EndingVpn incremented by 1 and shifted left by 12 bits.

pub fn size(&self) -> Result<u64, VmiError>

Returns the size of the section.

Implementation Details

Corresponds to _SECTION_OBJECT.SizeOfSegment or _SECTION.SizeOfSection.

pub fn flags(&self) -> Result<u64, VmiError>

Returns the flags of the section.

Implementation Details

Corresponds to _SECTION.Flags or _SEGMENT_OBJECT.MmSectionFlags.

pub fn file_object( &self, ) -> Result<Option<WindowsFileObject<'a, Driver>>, VmiError>

Returns the file object of the section.

Implementation Details

Corresponds to _SECTION.ControlArea.FilePointer or _SEGMENT_OBJECT.ControlArea.FilePointer.

pub fn full_path(&self) -> Result<Option<String>, VmiError>

Constructs the full path of the file object associated with the section.

Shortcut for self.file_object()?.full_path().

Trait Implementations

impl<'a, Driver> From<WindowsSectionObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsSectionObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> FromWindowsObject<'a, Driver> for WindowsSectionObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from_object( object: WindowsObject<'a, Driver>, ) -> Result<Option<Self>, VmiError>

Attempts to convert a WindowsObject into a specific object type.

impl<Driver> VmiVa for WindowsSectionObject<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.