Struct WindowsTeb 

pub struct WindowsTeb<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

TEB accessor with a runtime pointer width.

The TEB is a user-mode structure that stores thread-specific information, such as the last error value and thread-local storage.

Implementation Details

Corresponds to _TEB.

Implementations

impl<'a, Driver> WindowsTeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new TEB accessor.

pub fn with_kind( vmi: VmiState<'a, WindowsOs<Driver>>, va: Va, root: Pa, kind: WindowsWow64Kind, ) -> Self

Creates a new TEB accessor with an explicit address space root and pointer width.

pub fn peb(&self) -> Result<Option<WindowsPeb<'a, Driver>>, VmiError>

Returns the process environment block (PEB) associated with the thread.

Implementation Details

Corresponds to _TEB.ProcessEnvironmentBlock.

pub fn last_error_value(&self) -> Result<u32, VmiError>

Returns the last error value for the thread.

The equivalent of GetLastError() in the Windows API.

Implementation Details

Corresponds to _TEB.LastErrorValue.

pub fn last_status_value(&self) -> Result<u32, VmiError>

Returns the last status value for the current thread.

LastStatusValue is an NTSTATUS value, whereas LastError is a Win32 error code. You can obtain the Win32 error code by calling last_error_value.

Implementation Details

Corresponds to _TEB.LastStatusValue.

pub fn tls_slot(&self, index: usize) -> Result<u64, VmiError>

Returns the value of the specified thread-local storage (TLS) slot.

Implementation Details

Corresponds to _TEB.TlsSlots[index].

Trait Implementations

impl<'a, Driver> From<WindowsTebBase<'a, Driver, StructLayout32>> for WindowsTeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsTebBase<'a, Driver, StructLayout32>) -> Self

Converts to this type from the input type.

impl<'a, Driver> From<WindowsTebBase<'a, Driver, StructLayout64>> for WindowsTeb<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsTebBase<'a, Driver, StructLayout64>) -> Self

Converts to this type from the input type.

impl<Driver> VmiVa for WindowsTeb<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.