Struct WindowsFileObject

pub struct WindowsFileObject<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Windows file object.

A file object is a kernel structure that represents an open file or device in the Windows Object Manager. It contains metadata about the file, its access permissions, and associated device or volume.

Implementation Details

Corresponds to _FILE_OBJECT.

Implementations

impl<'a, Driver> WindowsFileObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, Driver, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows file object.

pub fn device_object(&self) -> Result<WindowsObject<'a, Driver>, VmiError>

Returns the device object associated with the file object.

Implementation Details

Corresponds to _FILE_OBJECT.DeviceObject.

pub fn filename(&self) -> Result<String, VmiError>

Returns the filename associated with the file object.

Implementation Details

Corresponds to _FILE_OBJECT.FileName.

Notes

This operation might fail as the filename is allocated from paged pool.

pub fn full_path(&self) -> Result<String, VmiError>

Constructs the full path of a file from its FILE_OBJECT.

This function first reads the DeviceObject field of the FILE_OBJECT structure. Then it reads the ObjectNameInfo of the DeviceObject and its directory. Finally, it concatenates the device directory name, device name, and file name.

Implementation Details

Corresponds to _FILE_OBJECT.DeviceObject.NameInfo.Name concatenated with _FILE_OBJECT.FileName.

Trait Implementations

impl<'a, Driver> From<WindowsFileObject<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn from(value: WindowsFileObject<'a, Driver>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsFileObject<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.