vmi_os_windows/comps/
mod.rs

1mod control_area;
2pub(crate) mod handle_table;
3mod handle_table_entry;
4pub(crate) mod hive;
5mod image;
6mod kprcb;
7mod luid;
8mod module;
9mod name_info;
10mod object;
11mod object_attributes;
12mod peb;
13mod peb_ldr_data;
14mod process_parameters;
15mod region;
16mod segment;
17mod session;
18mod sid;
19mod teb;
20mod trap_frame;
21mod unloaded_driver;
22mod user_module;
23mod wow64;
24
25pub use self::{
26    control_area::WindowsControlArea,
27    handle_table::WindowsHandleTable,
28    handle_table_entry::WindowsHandleTableEntry,
29    hive::{
30        WindowsHive, WindowsHiveBaseBlock, WindowsHiveCellIndex, WindowsHiveMapDirectory,
31        WindowsHiveMapEntry, WindowsHiveMapTable, WindowsHiveStorageType, WindowsKeyControlBlock,
32        WindowsKeyIndex, WindowsKeyNode, WindowsKeyValue, WindowsKeyValueData,
33        WindowsKeyValueFlags, WindowsKeyValueType,
34    },
35    image::WindowsImage,
36    kprcb::WindowsKernelProcessorBlock,
37    luid::WindowsLuid,
38    module::WindowsModule,
39    name_info::WindowsObjectHeaderNameInfo,
40    object::{
41        FromWindowsObject, ParseObjectTypeError, WindowsDirectoryObject, WindowsFileObject,
42        WindowsImpersonationLevel, WindowsObject, WindowsObjectType, WindowsObjectTypeKind,
43        WindowsPrivilege, WindowsProcess, WindowsSectionObject, WindowsThread, WindowsThreadState,
44        WindowsThreadWaitReason, WindowsToken, WindowsTokenFlags, WindowsTokenPrivilege,
45        WindowsTokenSource, WindowsTokenType,
46    },
47    object_attributes::WindowsObjectAttributes,
48    peb::{Peb, PebLayout, WindowsPeb, WindowsPebBase},
49    peb_ldr_data::{
50        LdrDataTableEntry, LdrDataTableEntryLayout, PebLdrData, PebLdrDataLayout,
51        WindowsPebLdrData, WindowsPebLdrDataBase,
52    },
53    process_parameters::{
54        CurDir, CurDirLayout, RtlUserProcessParameters, RtlUserProcessParametersLayout,
55        WindowsProcessParameters, WindowsProcessParametersBase,
56    },
57    region::WindowsRegion,
58    segment::WindowsSegment,
59    session::WindowsSession,
60    sid::{WindowsSid, WindowsSidAndAttributes, WindowsSidAttributes},
61    teb::{Teb, TebLayout, WindowsTeb, WindowsTebBase},
62    trap_frame::WindowsTrapFrame,
63    unloaded_driver::WindowsUnloadedDriver,
64    user_module::{WindowsUserModule, WindowsUserModuleBase},
65    wow64::{
66        WOW64_TLS_APCLIST, WOW64_TLS_CPURESERVED, WOW64_TLS_FILESYSREDIR, WOW64_TLS_TEMPLIST,
67        WOW64_TLS_USERCALLBACKDATA, WOW64_TLS_WOW64INFO, WindowsWow64Kind,
68    },
69};
70
71/// A Windows processor mode.
72#[derive(Debug, Clone, Copy, PartialEq, Eq)]
73pub enum WindowsProcessorMode {
74    /// Request originated from kernel-mode code.
75    KernelMode,
76
77    /// Request originated from user-mode code.
78    UserMode,
79}
80
81impl From<u8> for WindowsProcessorMode {
82    fn from(value: u8) -> Self {
83        match value {
84            0 => Self::KernelMode,
85            1 => Self::UserMode,
86            _ => {
87                // Assume any non-0 value is user mode.
88                tracing::warn!(value, "unknown processor mode value");
89                Self::UserMode
90            }
91        }
92    }
93}
vmi_os_windows/comps/mod.rs

vmi_os_windows/comps/
mod.rs
