Struct InjectorHandler

pub struct InjectorHandler<Driver, Os, T, Bridge = ()>
where
    Driver: VmiDriver,
    Os: VmiOs<Driver> + OsAdapter<Driver>,
    Bridge: BridgeHandler<Driver, Os, u64>,
{ /* private fields */ }

Available on crate feature utils only.

A handler for managing code injection into a running system.

The handler monitors CPU events to hijack threads, inject code, and track execution. It uses recipes to define the injection sequence and maintains state about the injection process.

Implementations

impl<Driver, T> InjectorHandler<Driver, WindowsOs<Driver>, T>

where Driver: VmiDriver<Architecture = Amd64>,

pub fn new( vmi: &VmiCore<Driver>, profile: &Profile<'_>, pid: ProcessId, recipe: Recipe<Driver, WindowsOs<Driver>, T>, ) -> Result<InjectorHandler<Driver, WindowsOs<Driver>, T>, VmiError>

Creates a new injector handler.

Examples found in repository

examples/windows-recipe-messagebox.rs (lines 94-102)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let (session, profile) = common::create_vmi_session()?;

    let explorer_pid = {
        // This block is used to drop the pause guard after the PID is found.
        // If the `session.handle()` would be called with the VM paused, no
        // events would be triggered.
        let _pause_guard = session.pause_guard()?;

        let registers = session.registers(VcpuId(0))?;
        let vmi = session.with_registers(&registers);

        let explorer = match common::find_process(&vmi, "explorer.exe")? {
            Some(explorer) => explorer,
            None => {
                tracing::error!("explorer.exe not found");
                return Ok(());
            }
        };

        tracing::info!(
            pid = %explorer.id()?,
            object = %explorer.object()?,
            "found explorer.exe"
        );

        explorer.id()?
    };

    session.handle(|session| {
        InjectorHandler::new(
            session,
            &profile,
            explorer_pid,
            recipe_factory(MessageBox::new(
                "Hello, World!",
                "This is a message box from the VMI!",
            )),
        )
    })?;

    Ok(())
}

examples/windows-recipe-writefile.rs (lines 232-240)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let (session, profile) = common::create_vmi_session()?;

    let explorer_pid = {
        // This block is used to drop the pause guard after the PID is found.
        // If the `session.handle()` would be called with the VM paused, no
        // events would be triggered.
        let _pause_guard = session.pause_guard()?;

        let registers = session.registers(VcpuId(0))?;
        let vmi = session.with_registers(&registers);

        let explorer = match common::find_process(&vmi, "explorer.exe")? {
            Some(explorer) => explorer,
            None => {
                tracing::error!("explorer.exe not found");
                return Ok(());
            }
        };

        tracing::info!(
            pid = %explorer.id()?,
            object = %explorer.object()?,
            "found explorer.exe"
        );

        explorer.id()?
    };

    session.handle(|session| {
        InjectorHandler::new(
            session,
            &profile,
            explorer_pid,
            recipe_factory(GuestFile::new(
                "C:\\Users\\John\\Desktop\\test.txt",
                "Hello, World!".as_bytes(),
            )),
        )
    })?;

    Ok(())
}

examples/windows-recipe-writefile-advanced.rs (lines 332-340)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let (session, profile) = common::create_vmi_session()?;

    let explorer_pid = {
        // This block is used to drop the pause guard after the PID is found.
        // If the `session.handle()` would be called with the VM paused, no
        // events would be triggered.
        let _pause_guard = session.pause_guard()?;

        let registers = session.registers(VcpuId(0))?;
        let vmi = session.with_registers(&registers);

        let explorer = match common::find_process(&vmi, "explorer.exe")? {
            Some(explorer) => explorer,
            None => {
                tracing::error!("explorer.exe not found");
                return Ok(());
            }
        };

        tracing::info!(
            pid = %explorer.id()?,
            object = %explorer.object()?,
            "found explorer.exe"
        );

        explorer.id()?
    };

    let mut content = Vec::new();
    for c in 'A'..='Z' {
        content.extend((0..2049).map(|_| c as u8).collect::<Vec<_>>());
    }

    session.handle(|session| {
        InjectorHandler::new(
            session,
            &profile,
            explorer_pid,
            recipe_factory(GuestFile::new(
                "C:\\Users\\John\\Desktop\\test.txt",
                content,
            )),
        )
    })?;

    Ok(())
}

impl<Driver, T, Bridge> InjectorHandler<Driver, WindowsOs<Driver>, T, Bridge>

where Driver: VmiDriver<Architecture = Amd64>, Bridge: BridgeHandler<Driver, WindowsOs<Driver>, u64>,

pub fn with_bridge( vmi: &VmiCore<Driver>, profile: &Profile<'_>, pid: ProcessId, bridge: Bridge, recipe: Recipe<Driver, WindowsOs<Driver>, T>, ) -> Result<InjectorHandler<Driver, WindowsOs<Driver>, T, Bridge>, VmiError>

Creates a new injector handler.

Trait Implementations

impl<Driver, T, Bridge> VmiHandler<Driver, WindowsOs<Driver>> for InjectorHandler<Driver, WindowsOs<Driver>, T, Bridge>

where Driver: VmiDriver<Architecture = Amd64>, Bridge: BridgeHandler<Driver, WindowsOs<Driver>, u64>,

type Output = Result<u64, BridgePacket>

The output type of the handler.

fn handle_event( &mut self, vmi: VmiContext<'_, Driver, WindowsOs<Driver>>, ) -> VmiEventResponse<Amd64>

Handles a VMI event.

fn check_completion( &self, ) -> Option<<InjectorHandler<Driver, WindowsOs<Driver>, T, Bridge> as VmiHandler<Driver, WindowsOs<Driver>>>::Output>

Checks if the handler has completed.

fn handle_timeout(&mut self, _session: &VmiSession<'_, Driver, Os>)

Handles a timeout event.

fn handle_interrupted(&mut self, _session: &VmiSession<'_, Driver, Os>)

Handles an interrupted event.