List of all items

Structs

• AccessContext
• AddressContext
• Gfn
• MemoryAccess
• MemoryAccessOptions
• Pa
• Va
• VcpuId
• View
• VmiContext
• VmiCore
• VmiEvent
• VmiEventFlags
• VmiEventResponse
• VmiInfo
• VmiMappedPage
• VmiOsContext
• VmiOsState
• VmiPauseGuard
• VmiProber
• VmiSession
• VmiSessionPauseGuard
• VmiState
• arch::amd64::Amd64
• arch::amd64::Cr0
• arch::amd64::Cr2
• arch::amd64::Cr3
• arch::amd64::Cr4
• arch::amd64::Dr0
• arch::amd64::Dr1
• arch::amd64::Dr2
• arch::amd64::Dr3
• arch::amd64::Dr6
• arch::amd64::Dr7
• arch::amd64::EventCpuId
• arch::amd64::EventHypercall
• arch::amd64::EventInterrupt
• arch::amd64::EventIo
• arch::amd64::EventMemoryAccess
• arch::amd64::EventSinglestep
• arch::amd64::EventWriteCr
• arch::amd64::EventWriteMsr
• arch::amd64::ExceptionVector
• arch::amd64::Gdtr
• arch::amd64::GpRegisters
• arch::amd64::IdtAccess
• arch::amd64::IdtEntry
• arch::amd64::Idtr
• arch::amd64::Interrupt
• arch::amd64::MemoryAccessFlags
• arch::amd64::Msr
• arch::amd64::MsrEfer
• arch::amd64::PageTableEntry
• arch::amd64::Registers
• arch::amd64::Rflags
• arch::amd64::SegmentAccess
• arch::amd64::SegmentDescriptor
• arch::amd64::Selector
• arch::amd64::TranslationEntry
• arch::amd64::VaTranslation
• driver::kdmp::ExceptionRecord64
• driver::kdmp::Header64
• driver::kdmp::VmiKdmpDriver
• driver::xen::VmiXenDriver
• driver::xen::XenDomainId
• driver::xen_core_dump::VmiXenCoreDumpDriver
• os::AnyModule
• os::AnyProcess
• os::AnyRegion
• os::AnyUserModule
• os::NoOS
• os::ProcessId
• os::ProcessObject
• os::StructReader
• os::ThreadId
• os::ThreadObject
• os::VmiOsImageSymbol
• os::linux::LinuxDEntry
• os::linux::LinuxFile
• os::linux::LinuxFsStruct
• os::linux::LinuxImage
• os::linux::LinuxMapped
• os::linux::LinuxMmStruct
• os::linux::LinuxModule
• os::linux::LinuxOs
• os::linux::LinuxPath
• os::linux::LinuxQStr
• os::linux::LinuxTaskStruct
• os::linux::LinuxThread
• os::linux::LinuxUserModule
• os::linux::LinuxVFSMount
• os::linux::LinuxVmAreaStruct
• os::linux::ListEntryIterator
• os::linux::MapleTree
• os::linux::MapleTreeIteratorNew
• os::linux::Offsets
• os::linux::Symbols
• os::windows::CONTEXT_AMD64
• os::windows::CONTEXT_X86
• os::windows::CodeView
• os::windows::CurDirLayout
• os::windows::DirectoryObjectIterator
• os::windows::FLOATING_SAVE_AREA
• os::windows::HandleTableEntryIterator
• os::windows::KDESCRIPTOR_AMD64
• os::windows::KDESCRIPTOR_X86
• os::windows::KSPECIAL_REGISTERS_AMD64
• os::windows::KSPECIAL_REGISTERS_X86
• os::windows::KeyControlBlockIterator
• os::windows::KeyNodeIterator
• os::windows::KeyValueIterator
• os::windows::LdrDataTableEntryLayout
• os::windows::ListEntryIterator
• os::windows::ListEntryIteratorBase
• os::windows::ListEntryLayout
• os::windows::M128A
• os::windows::Offsets
• os::windows::ParseObjectTypeError
• os::windows::PeFile
• os::windows::PeHeader
• os::windows::PebLayout
• os::windows::PebLdrDataLayout
• os::windows::RtlUserProcessParametersLayout
• os::windows::StructLayout32
• os::windows::StructLayout64
• os::windows::Symbols
• os::windows::TebLayout
• os::windows::TreeNodeIterator
• os::windows::WindowsControlArea
• os::windows::WindowsDirectoryObject
• os::windows::WindowsExceptionRecord
• os::windows::WindowsFileObject
• os::windows::WindowsHandleTable
• os::windows::WindowsHandleTableEntry
• os::windows::WindowsHive
• os::windows::WindowsHiveBaseBlock
• os::windows::WindowsHiveCellIndex
• os::windows::WindowsHiveMapDirectory
• os::windows::WindowsHiveMapEntry
• os::windows::WindowsHiveMapTable
• os::windows::WindowsImage
• os::windows::WindowsKernelInformation
• os::windows::WindowsKernelProcessorBlock
• os::windows::WindowsKeyControlBlock
• os::windows::WindowsKeyIndex
• os::windows::WindowsKeyNode
• os::windows::WindowsKeyValue
• os::windows::WindowsKeyValueFlags
• os::windows::WindowsLuid
• os::windows::WindowsModule
• os::windows::WindowsObject
• os::windows::WindowsObjectAttributes
• os::windows::WindowsObjectHeaderNameInfo
• os::windows::WindowsObjectType
• os::windows::WindowsOs
• os::windows::WindowsPeb
• os::windows::WindowsPebBase
• os::windows::WindowsPebLdrData
• os::windows::WindowsPebLdrDataBase
• os::windows::WindowsPrivilege
• os::windows::WindowsProcess
• os::windows::WindowsProcessParameters
• os::windows::WindowsProcessParametersBase
• os::windows::WindowsRegion
• os::windows::WindowsSectionObject
• os::windows::WindowsSegment
• os::windows::WindowsSession
• os::windows::WindowsSid
• os::windows::WindowsSidAndAttributes
• os::windows::WindowsSidAttributes
• os::windows::WindowsTeb
• os::windows::WindowsTebBase
• os::windows::WindowsThread
• os::windows::WindowsToken
• os::windows::WindowsTokenFlags
• os::windows::WindowsTokenPrivilege
• os::windows::WindowsTokenSource
• os::windows::WindowsTrapFrame
• os::windows::WindowsUnloadedDriver
• os::windows::WindowsUserModule
• os::windows::WindowsUserModuleBase
• os::windows::XSAVE_FORMAT
• os::windows::pe::CodeView
• os::windows::pe::Export
• os::windows::pe::ExportTable
• os::windows::pe::ImageDataDirectory
• os::windows::pe::ImageDebugDirectory
• os::windows::pe::ImageDosHeader
• os::windows::pe::ImageFileHeader
• os::windows::pe::ImageNtHeaders
• os::windows::pe::ImageOptionalHeader32
• os::windows::pe::ImageOptionalHeader64
• os::windows::pe::ImageRuntimeFunctionEntry
• os::windows::pe::ImageSectionHeader
• os::windows::pe::PeDebugDirectory
• os::windows::pe::PeExceptionDirectory
• os::windows::pe::PeExportDirectory
• os::windows::pe::PeFile
• os::windows::pe::PeHeader
• os::windows::unwind::Frame
• os::windows::unwind::amd64::UNWIND_INFO
• os::windows::unwind::amd64::UnwindContextAmd64
• os::windows::unwind::amd64::UnwinderAmd64
• trace::Hex
• utils::bpm::Breakpoint
• utils::bpm::BreakpointBuilder
• utils::bpm::BreakpointController
• utils::bpm::BreakpointManager
• utils::bpm::MemoryController
• utils::bridge::Bridge
• utils::bridge::BridgePacket
• utils::bridge::BridgeResponse
• utils::injector::Argument
• utils::injector::CallBuilder
• utils::injector::InjectorHandler
• utils::injector::KernelMode
• utils::injector::Recipe
• utils::injector::RecipeContext
• utils::injector::RecipeExecutor
• utils::injector::UserMode
• utils::interceptor::Interceptor
• utils::ptm::PageEntryUpdate
• utils::ptm::PageTableMonitor
• utils::ptm::arch::amd64::PageTableMonitorAmd64
• utils::reactor::EventMetadata
• utils::reactor::ModuleMetadata
• utils::reactor::Reactor
• utils::reactor::ResolvedEvent
• utils::reactor::ResolvedModule
• utils::resolver::Resolved
• utils::shellcode::ParameterValue
• utils::shellcode::ParameterWriter
• utils::shellcode::Payload
• utils::shellcode::RetryState
• utils::shellcode::Status
• utils::shellcode::StatusKind
• utils::tracker::Tracker

Enums

• TranslationMechanism
• VmiError
• VmiEventAction
• arch::amd64::ControlRegister
• arch::amd64::DescriptorTable
• arch::amd64::DescriptorType
• arch::amd64::EventIoDirection
• arch::amd64::EventMonitor
• arch::amd64::EventReason
• arch::amd64::Granularity
• arch::amd64::InterruptType
• arch::amd64::OperationSize
• arch::amd64::PageTableLevel
• arch::amd64::PagingMode
• os::VmiOsImageArchitecture
• os::VmiOsRegionKind
• os::linux::LinuxError
• os::windows::OffsetsExt
• os::windows::PeError
• os::windows::WindowsError
• os::windows::WindowsHiveStorageType
• os::windows::WindowsImpersonationLevel
• os::windows::WindowsKeyValueData
• os::windows::WindowsKeyValueType
• os::windows::WindowsObjectTypeKind
• os::windows::WindowsProcessorMode
• os::windows::WindowsThreadState
• os::windows::WindowsThreadWaitReason
• os::windows::WindowsTokenType
• os::windows::WindowsWow64Kind
• os::windows::pe::ExportTarget
• os::windows::pe::ImageOptionalHeader
• os::windows::pe::PeError
• os::windows::unwind::Unwound
• utils::Representation
• utils::injector::ArgumentData
• utils::injector::RecipeControlFlow
• utils::ptm::PageTableMonitorEvent
• utils::reactor::Action
• utils::reactor::ModuleMode
• utils::reactor::ModuleProcessFilter
• utils::reactor::ProfileRef
• utils::shellcode::Parameter

Traits

• Architecture
• Registers
• VmiDriver
• VmiEventControl
• VmiFullDriver
• VmiHandler
• VmiMemory
• VmiOs
• VmiOsExt
• VmiProtection
• VmiQueryProtection
• VmiQueryRegisters
• VmiRead
• VmiReadAccess
• VmiRegisters
• VmiSetProtection
• VmiSetRegisters
• VmiVa
• VmiViewControl
• VmiVmControl
• VmiWrite
• VmiWriteAccess
• arch::Architecture
• arch::EventInterrupt
• arch::EventMemoryAccess
• arch::EventReason
• arch::GpRegisters
• arch::Registers
• driver::VmiDriver
• driver::VmiEventControl
• driver::VmiFullDriver
• driver::VmiMemory
• driver::VmiProtection
• driver::VmiQueryProtection
• driver::VmiQueryRegisters
• driver::VmiRead
• driver::VmiReadAccess
• driver::VmiRegisters
• driver::VmiSetProtection
• driver::VmiSetRegisters
• driver::VmiViewControl
• driver::VmiVmControl
• driver::VmiWrite
• driver::VmiWriteAccess
• driver::kdmp::ArchAdapter
• driver::xen::ArchAdapter
• driver::xen_core_dump::ArchAdapter
• os::ModulePredicate
• os::ProcessPredicate
• os::RegionPredicate
• os::UserModulePredicate
• os::VmiOs
• os::VmiOsExt
• os::VmiOsImage
• os::VmiOsMapped
• os::VmiOsModule
• os::VmiOsProcess
• os::VmiOsProcessExt
• os::VmiOsRegion
• os::VmiOsThread
• os::VmiOsUserModule
• os::windows::ArchAdapter
• os::windows::CurDir
• os::windows::FromWindowsObject
• os::windows::LdrDataTableEntry
• os::windows::ListEntry
• os::windows::PeImage
• os::windows::PeImageExt
• os::windows::Peb
• os::windows::PebLdrData
• os::windows::RtlUserProcessParameters
• os::windows::StructLayout
• os::windows::Teb
• os::windows::WindowsContext
• os::windows::WindowsExceptionVector
• os::windows::WindowsInterrupt
• os::windows::WindowsOsExt
• os::windows::WindowsPageTableEntry
• os::windows::WindowsRegistersAdapter
• os::windows::WindowsSpecialRegisters
• os::windows::pe::PeImage
• os::windows::pe::PeImageExt
• os::windows::unwind::Unwinder
• utils::bpm::KeyType
• utils::bpm::TagType
• utils::bpm::TapController
• utils::bridge::ArchAdapter
• utils::bridge::BridgeContract
• utils::bridge::BridgeDispatch
• utils::bridge::BridgeHandler
• utils::injector::ArchAdapter
• utils::injector::ExecutionMode
• utils::injector::InjectorExecutionAdapter
• utils::injector::InjectorHandlerAdapter
• utils::injector::InjectorHandlerFactory
• utils::injector::OsAdapter
• utils::ptm::ArchAdapter
• utils::ptm::PageTableMonitorAdapter
• utils::ptm::TagType
• utils::ptm::arch::ArchAdapter
• utils::reactor::ReactorEvent
• utils::reactor::ReactorHandler
• utils::reactor::ReactorModule
• utils::resolver::ArchAdapter
• utils::resolver::OsAdapter
• utils::shellcode::ArchAdapter
• utils::shellcode::OsAdapter
• utils::shellcode::ParameterSource
• utils::shellcode::Parameters
• utils::shellcode::Stage

Macros

• vmi_probe

Functions

• os::windows::unwind::amd64::read_params
• os::windows::unwind::amd64::resolve_primary_function
• os::windows::unwind::amd64::unwind_leaf
• trace::current_process_id
• trace::current_process_name
• trace::current_thread_id
• trace::event_view
• trace::process_id
• trace::process_name
• trace::thread_id
• trace::user_module_name
• utils::hexdump
• utils::resolver::resolve_kernel_module
• utils::resolver::resolve_kernel_module_in
• utils::resolver::resolve_user_module
• utils::resolver::resolve_user_module_in
• utils::shellcode::kernel_shellcode_call_recipe
• utils::shellcode::kernel_shellcode_spawn_recipe
• utils::shellcode::user_shellcode_call_recipe
• utils::shellcode::user_shellcode_spawn_recipe

Type Aliases

• arch::amd64::Idt
• arch::amd64::TranslationEntries
• utils::injector::ImageSymbolCache
• utils::injector::KernelInjectorHandler
• utils::injector::UserInjectorHandler
• utils::shellcode::EncodedStatus
• utils::shellcode::KernelRecipe
• utils::shellcode::KernelRecipeData
• utils::shellcode::UserRecipe
• utils::shellcode::UserRecipeData

Constants

• os::windows::MAXIMUM_SUPPORTED_EXTENSION
• os::windows::SIZE_OF_80387_REGISTERS
• os::windows::WOW64_TLS_APCLIST
• os::windows::WOW64_TLS_CPURESERVED
• os::windows::WOW64_TLS_FILESYSREDIR
• os::windows::WOW64_TLS_TEMPLIST
• os::windows::WOW64_TLS_USERCALLBACKDATA
• os::windows::WOW64_TLS_WOW64INFO
• os::windows::pe::IMAGE_DEBUG_TYPE_CODEVIEW
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_BASERELOC
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_DEBUG
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_EXCEPTION
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_EXPORT
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_GLOBALPTR
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_IAT
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_IMPORT
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_RESOURCE
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_SECURITY
• os::windows::pe::IMAGE_DIRECTORY_ENTRY_TLS
• os::windows::pe::IMAGE_DOS_SIGNATURE
• os::windows::pe::IMAGE_NT_OPTIONAL_HDR32_MAGIC
• os::windows::pe::IMAGE_NT_OPTIONAL_HDR64_MAGIC
• os::windows::pe::IMAGE_NT_SIGNATURE
• os::windows::pe::IMAGE_NUMBEROF_DIRECTORY_ENTRIES
• os::windows::unwind::amd64::REG_R10
• os::windows::unwind::amd64::REG_R11
• os::windows::unwind::amd64::REG_R12
• os::windows::unwind::amd64::REG_R13
• os::windows::unwind::amd64::REG_R14
• os::windows::unwind::amd64::REG_R15
• os::windows::unwind::amd64::REG_R8
• os::windows::unwind::amd64::REG_R9
• os::windows::unwind::amd64::REG_RAX
• os::windows::unwind::amd64::REG_RBP
• os::windows::unwind::amd64::REG_RBX
• os::windows::unwind::amd64::REG_RCX
• os::windows::unwind::amd64::REG_RDI
• os::windows::unwind::amd64::REG_RDX
• os::windows::unwind::amd64::REG_RSI
• os::windows::unwind::amd64::REG_RSP
• os::windows::unwind::amd64::UNWIND_CHAIN_LIMIT
• os::windows::unwind::amd64::UNW_FLAG_CHAININFO
• os::windows::unwind::amd64::UNW_FLAG_EHANDLER
• os::windows::unwind::amd64::UNW_FLAG_NHANDLER
• os::windows::unwind::amd64::UNW_FLAG_UHANDLER
• os::windows::unwind::amd64::UWOP_ALLOC_LARGE
• os::windows::unwind::amd64::UWOP_ALLOC_SMALL
• os::windows::unwind::amd64::UWOP_EPILOG
• os::windows::unwind::amd64::UWOP_PUSH_MACHFRAME
• os::windows::unwind::amd64::UWOP_PUSH_NONVOL
• os::windows::unwind::amd64::UWOP_SAVE_NONVOL
• os::windows::unwind::amd64::UWOP_SAVE_NONVOL_FAR
• os::windows::unwind::amd64::UWOP_SAVE_XMM128
• os::windows::unwind::amd64::UWOP_SAVE_XMM128_FAR
• os::windows::unwind::amd64::UWOP_SET_FPREG
• os::windows::unwind::amd64::UWOP_SPARE_CODE
• utils::shellcode::BRIDGE_MAGIC
• utils::shellcode::BRIDGE_VERIFY_VALUE3
• utils::shellcode::BRIDGE_VERIFY_VALUE4