libintrovirt v0.57.4
IntroVirt introspection library
Loading...
Searching...
No Matches
KPCR.hh
Go to the documentation of this file.
1/*
2 * Copyright 2021 Assured Information Security, Inc.
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#pragma once
17
18#include <introvirt/core/fwd.hh>
20
21#include <memory>
22
23namespace introvirt {
24namespace windows {
25namespace nt {
26
32class KPCR {
33 public:
39 virtual uint64_t pid() const = 0;
40
46 virtual uint64_t tid() const = 0;
47
53 virtual std::string process_name() const = 0;
54
61 virtual THREAD& CurrentThread() = 0;
62
66 virtual const THREAD& CurrentThread() const = 0;
67
75 virtual uint64_t KernelDirectoryTableBase() const = 0;
76
83 virtual bool idle() const = 0;
84
92 virtual void reset() = 0;
93
97 virtual ~KPCR() = default;
98};
99
100} // namespace nt
101} // namespace windows
102} // namespace introvirt
The KPCR (Kernel Processor Control Region) is used by Windows to hold information about the current t...
Definition KPCR.hh:32
virtual bool idle() const =0
Check if the processor for this KPCR is idle.
virtual ~KPCR()=default
Destroy the instance.
virtual std::string process_name() const =0
Get the name of the current process.
virtual uint64_t KernelDirectoryTableBase() const =0
Get the paging table used by the kernel, if the field exists.
virtual const THREAD & CurrentThread() const =0
Get the currently active thread.
virtual void reset()=0
Reset the state held by the KPCR.
virtual uint64_t pid() const =0
Get the process ID of the current thread.
virtual THREAD & CurrentThread()=0
Get the currently active thread.
virtual uint64_t tid() const =0
Get the thread ID of the current thread.
Definition THREAD.hh:49
Core IntroVirt classes.
Definition Cr0.hh:20