Crate vmi_os_windows

Source
Expand description

§Windows OS-specific VMI operations

This crate provides functionality for introspecting Windows-based virtual machines, working in conjunction with the vmi-core crate. It offers abstractions and utilities for navigating Windows kernel structures, analyzing processes and memory, and performing Windows-specific VMI tasks.

§Features

  • Windows kernel structure parsing and navigation
  • Process and thread introspection
  • Memory management operations (VAD tree traversal, PFN database manipulation)
  • Windows object handling (files, sections, etc.)
  • PE file format parsing and analysis

§Safety Considerations

Many operations in this crate require pausing the VM to ensure consistency. Always pause the VM when performing operations that could be affected by concurrent changes in the guest OS. Be aware of the Windows version you’re introspecting, as kernel structures may vary between versions. Handle errors appropriately, as VMI operations can fail due to various reasons (e.g., invalid memory access, incompatible Windows version).

§Example

let _guard = vmi.pause_guard()?;
// Perform introspection operations here
// VM automatically resumes when `_guard` goes out of scope

Always consider the potential for race conditions and ensure you’re working with a consistent state of the guest OS.

Re-exports§

pub use self::pe::Pe;
pub use self::pe::PeError;

Modules§

pe
Portable Executable (PE) module.

Structs§

CodeView
CodeView information extracted from a PDB file.
HandleTableEntryIterator
An iterator for traversing entries in a Windows handle table.
ListEntryIterator
An iterator for traversing list entries.
Offsets
Offsets for Windows.
ParseObjectTypeError
Error parsing a Windows object type.
Symbols
Windows kernel symbols used by the WindowsOs implementation.
TreeNodeIterator
An iterator for traversing tree nodes.
WindowsControlArea
A Windows control area.
WindowsDirectoryObject
A Windows directory object.
WindowsExceptionRecord
Represents a _EXCEPTION_RECORD structure.
WindowsFileObject
A Windows file object.
WindowsHandleTable
A Windows handle table.
WindowsHandleTableEntry
A Windows handle table entry.
WindowsImage
A Windows executable image (PE).
WindowsKernelInformation
Information about the Windows kernel image.
WindowsModule
A Windows kernel module.
WindowsObject
A Windows object.
WindowsObjectAttributes
A Windows object attributes.
WindowsObjectHeaderNameInfo
A name information for a Windows object.
WindowsObjectType
A Windows object type object.
WindowsOs
VMI operations for the Windows operating system.
WindowsPeb
A Windows process environment block (PEB).
WindowsProcess
A Windows process.
WindowsProcessParameters
A Windows process parameters structure.
WindowsRegion
A Windows memory region.
WindowsSectionObject
A Windows section object.
WindowsSession
A Windows session space.
WindowsThread
A Windows thread.

Enums§

OffsetsExt
Extended offsets for Windows.
WindowsError
Error types for Windows operations.
WindowsObjectTypeKind
Identifies the type of a Windows kernel object.
WindowsWow64Kind
The address space type in a WoW64 process.

Traits§

WindowsOsExt
WindowsOs extensions for the VmiContext.