introvirt::windows::WindowsFunctionCall Class Reference

#include <WindowsFunctionCall.hh>

Inheritance diagram for introvirt::windows::WindowsFunctionCall:

Collaboration diagram for introvirt::windows::WindowsFunctionCall:

Public Member Functions
guest_ptr< void >	return_address () const override
	Get the return address for this function call.
void	return_address (const guest_ptr< void > &value) override
	Set the return address for this function call.
bool	is_return_event (Event &event) const override
	Check if the given event is a return event for this function call.
void	handle_return (Event &event) override
	Handle the return event.
bool	returned () const override
	Check if the call has returned.
bool	x64 () const
	Check if the call is from x64 mode.hh>
virtual	~WindowsFunctionCall ()
Public Member Functions inherited from introvirt::FunctionCall
bool	hook_return () const
	Check if the user is requesting that the return be intercepted.
void	hook_return (bool val)
	Configure if the return should be intercepted.
virtual const std::string &	library_name () const =0
	Get the name of the library this call is for.
virtual const std::string &	function_name () const =0
	Get the function name.
virtual void	write (std::ostream &os=std::cout) const =0
	Write out a textual representation of the function for display.
virtual Json::Value	json () const =0
	Get the function as Json.
void	data (const std::string &key, const std::shared_ptr< void > &value)
	Store arbitrary data with the FunctionCall.
void	data (const std::string &key, std::shared_ptr< void > &&value)
	Store arbitrary data with the FunctionCall.
std::shared_ptr< void >	data (const std::string &key)
	Retrieve arbitrary data stored with the FunctionCall.
std::shared_ptr< const void >	data (const std::string &key) const
	Retrieve arbitrary data stored with the FunctionCall.
virtual	~FunctionCall ()=default

Protected Member Functions
uint64_t	raw_return_value () const
void	raw_return_value (uint64_t value)
uint64_t	get_argument (unsigned int index) const
void	set_argument (unsigned int index, uint64_t value)
guest_ptr< void >	get_address_argument (unsigned int index) const
void	set_address_argument (unsigned int index, const guest_ptr< void > &address)
Vcpu &	vcpu ()
const Vcpu &	vcpu () const
	WindowsFunctionCall (Event &event, unsigned int argument_count, WindowsCallType type=WindowsCallType::AUTO)

Constructor & Destructor Documentation

~WindowsFunctionCall()

virtual introvirt::windows::WindowsFunctionCall::~WindowsFunctionCall ( )

virtual

WindowsFunctionCall()

introvirt::windows::WindowsFunctionCall::WindowsFunctionCall ( Event &  event, unsigned int  argument_count, WindowsCallType  type = WindowsCallType::AUTO  )

protected

Member Function Documentation

get_address_argument()

guest_ptr< void > introvirt::windows::WindowsFunctionCall::get_address_argument ( unsigned int  index ) const

protected

get_argument()

uint64_t introvirt::windows::WindowsFunctionCall::get_argument ( unsigned int  index ) const

protected

handle_return()

void introvirt::windows::WindowsFunctionCall::handle_return ( Event &  event )

overridevirtual

Handle the return event.

Perform processing to handle the return of the function call

Parameters

event

The return event

Implements introvirt::FunctionCall.

is_return_event()

bool introvirt::windows::WindowsFunctionCall::is_return_event ( Event &  event ) const

overridevirtual

Check if the given event is a return event for this function call.

Parameters

event

Returns

true

false

Implements introvirt::FunctionCall.

raw_return_value() [1/2]

uint64_t introvirt::windows::WindowsFunctionCall::raw_return_value ( ) const

protected

raw_return_value() [2/2]

void introvirt::windows::WindowsFunctionCall::raw_return_value ( uint64_t  value )

protected

return_address() [1/2]

guest_ptr< void > introvirt::windows::WindowsFunctionCall::return_address ( ) const

overridevirtual

Get the return address for this function call.

Returns

guest_ptr

Implements introvirt::FunctionCall.

return_address() [2/2]

void introvirt::windows::WindowsFunctionCall::return_address ( const guest_ptr< void > &  value )

overridevirtual

Set the return address for this function call.

Parameters

value

The new return address to use

Implements introvirt::FunctionCall.

returned()

bool introvirt::windows::WindowsFunctionCall::returned ( ) const

overridevirtual

Check if the call has returned.

Returns

true if the call has returned

false if the call has not returnerd

Implements introvirt::FunctionCall.

set_address_argument()

void introvirt::windows::WindowsFunctionCall::set_address_argument ( unsigned int  index, const guest_ptr< void > &  address  )

protected

set_argument()

void introvirt::windows::WindowsFunctionCall::set_argument ( unsigned int  index, uint64_t  value  )

protected

vcpu() [1/2]

Vcpu & introvirt::windows::WindowsFunctionCall::vcpu ( )

protected

vcpu() [2/2]

const Vcpu & introvirt::windows::WindowsFunctionCall::vcpu ( ) const

protected

x64()

bool introvirt::windows::WindowsFunctionCall::x64

(

)

const

Check if the call is from x64 mode.hh>

This returns false for 32-bit guests or if the processor is in WoW64 mode

---

The documentation for this class was generated from the following file:

• /home/runner/work/IntroVirt/IntroVirt/include/introvirt/windows/libraries/WindowsFunctionCall.hh