libintrovirt v0.57.4
IntroVirt introspection library
Loading...
Searching...
No Matches
CM_KEY_BODY.hh
Go to the documentation of this file.
1/*
2 * Copyright 2021 Assured Information Security, Inc.
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#pragma once
17
18#include "OBJECT.hh"
19
21
22#include <memory>
23#include <string>
24
25namespace introvirt {
26namespace windows {
27namespace nt {
28
35class CM_KEY_BODY : public OBJECT {
36 public:
42 virtual const CM_KEY_CONTROL_BLOCK& KeyControlBlock() const = 0;
43
47 virtual uint64_t ProcessID() const = 0;
48
57 virtual const std::string& full_key_path() const = 0;
58
59 static std::shared_ptr<CM_KEY_BODY> make_shared(const NtKernel& kernel,
60 const guest_ptr<void>& ptr);
61
62 static std::shared_ptr<CM_KEY_BODY> make_shared(const NtKernel& kernel,
63 std::unique_ptr<OBJECT_HEADER>&& object_header);
64
65 virtual ~CM_KEY_BODY() = default;
66};
67
68} /* namespace nt */
69} /* namespace windows */
70} /* namespace introvirt */
Definition guest_ptr.hh:88
Class for the CM_KEY_BODY NT Kernel structure.
Definition CM_KEY_BODY.hh:35
virtual const CM_KEY_CONTROL_BLOCK & KeyControlBlock() const =0
Get the KeyControlBlock member of the structure.
static std::shared_ptr< CM_KEY_BODY > make_shared(const NtKernel &kernel, std::unique_ptr< OBJECT_HEADER > &&object_header)
static std::shared_ptr< CM_KEY_BODY > make_shared(const NtKernel &kernel, const guest_ptr< void > &ptr)
virtual uint64_t ProcessID() const =0
virtual const std::string & full_key_path() const =0
Helper function for traversing the key back to the root.
Definition CM_KEY_CONTROL_BLOCK.hh:29
Abstraction for the Windows NT kernel.
Definition NtKernel.hh:37
Base class for all kernel objects.
Definition OBJECT.hh:30
virtual guest_ptr< void > ptr() const =0
Core IntroVirt classes.
Definition Cr0.hh:20