Handler for kernel32!CreateProcessA. More...

#include <CreateProcessA.hh>

Inheritance diagram for introvirt::windows::kernel32::CreateProcessA:

[legend]

Collaboration diagram for introvirt::windows::kernel32::CreateProcessA:

[legend]

Public Member Functions
guest_ptr< char[]>	pApplicationName () const

void	pApplicationName (const guest_ptr< char[]> &pApplicationName)

guest_ptr< char[]>	pCommandLine () const

void	pCommandLine (const guest_ptr< char[]> &pCommandLine)

guest_ptr< void >	pProcessAttributes () const

void	pProcessAttributes (const guest_ptr< void > &pProcessAttributes)

guest_ptr< void >	pThreadAttributes () const

void	pThreadAttributes (const guest_ptr< void > &pThreadAttributes)

bool	bInheritHandles () const

void	bInheritHandles (bool bInheritHandles)

uint32_t	dwCreationFlags () const

void	dwCreationFlags (uint32_t dwCreationFlags)

guest_ptr< void >	pEnvironment () const

void	pEnvironment (const guest_ptr< void > &pEnvironment)

guest_ptr< char[]>	pCurrentDirectory () const

void	pCurrentDirectory (const guest_ptr< char[]> &pCurrentDirectory)

guest_ptr< void >	pStartupInfo () const

void	pStartupInfo (const guest_ptr< void > &pStartupInfo)

std::shared_ptr< STARTUPINFOA >	StartupInfo ()

guest_ptr< void >	pProcessInformation () const

void	pProcessInformation (const guest_ptr< void > &pProcessInformation)

std::shared_ptr< PROCESS_INFORMATION >	ProcessInformation ()

const std::string &	function_name () const override
	Get the function name.

const std::string &	library_name () const override
	Get the name of the library this call is for.

void	write (std::ostream &os=std::cout) const override
	Write out a textual representation of the function for display.

Json::Value	json () const override
	Get the function as Json.

bool	result () const

void	result (bool result)

	CreateProcessA (Event &event)

	~CreateProcessA () override

Public Member Functions inherited from introvirt::windows::WindowsFunctionCall
guest_ptr< void >	return_address () const override
	Get the return address for this function call.

void	return_address (const guest_ptr< void > &value) override
	Set the return address for this function call.

bool	is_return_event (Event &event) const override
	Check if the given event is a return event for this function call.

void	handle_return (Event &event) override
	Handle the return event.

bool	returned () const override
	Check if the call has returned.

bool	x64 () const
	Check if the call is from x64 mode.hh>

virtual	~WindowsFunctionCall ()

Public Member Functions inherited from introvirt::FunctionCall
bool	hook_return () const
	Check if the user is requesting that the return be intercepted.

void	hook_return (bool val)
	Configure if the return should be intercepted.

void	data (const std::string &key, const std::shared_ptr< void > &value)
	Store arbitrary data with the FunctionCall.

void	data (const std::string &key, std::shared_ptr< void > &&value)
	Store arbitrary data with the FunctionCall.

std::shared_ptr< void >	data (const std::string &key)
	Retrieve arbitrary data stored with the FunctionCall.

std::shared_ptr< const void >	data (const std::string &key) const
	Retrieve arbitrary data stored with the FunctionCall.

virtual	~FunctionCall ()=default

Static Public Member Functions
static bool	inject (const guest_ptr< char[]> &pApplicationName, const guest_ptr< char[]> &pCommandLine, const guest_ptr< void > &pProcessAttributes, const guest_ptr< void > &pThreadAttributes, bool bInheritHandles, uint32_t dwCreationFlags, const guest_ptr< void > &pEnvironment, const guest_ptr< char[]> &pCurrentDirectory, const guest_ptr< void > &pStartupInfo, const guest_ptr< void > &pProcessInformation)

Static Public Attributes
static constexpr int	ArgumentCount = 10

static const std::string	LibraryName = "kernel32"

static const std::string	FunctionName = "CreateProcessA"

Additional Inherited Members
Protected Member Functions inherited from introvirt::windows::WindowsFunctionCall
uint64_t	raw_return_value () const

void	raw_return_value (uint64_t value)

uint64_t	get_argument (unsigned int index) const

void	set_argument (unsigned int index, uint64_t value)

guest_ptr< void >	get_address_argument (unsigned int index) const

void	set_address_argument (unsigned int index, const guest_ptr< void > &address)

Vcpu &	vcpu ()

const Vcpu &	vcpu () const

	WindowsFunctionCall (Event &event, unsigned int argument_count, WindowsCallType type=WindowsCallType::AUTO)

Detailed Description

Handler for kernel32!CreateProcessA.

See also: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa

Constructor & Destructor Documentation

◆ CreateProcessA()

introvirt::windows::kernel32::CreateProcessA::CreateProcessA ( Event & event )

◆ ~CreateProcessA()

introvirt::windows::kernel32::CreateProcessA::~CreateProcessA ( )

override

Member Function Documentation

◆ bInheritHandles() [1/2]

bool introvirt::windows::kernel32::CreateProcessA::bInheritHandles ( ) const

◆ bInheritHandles() [2/2]

void introvirt::windows::kernel32::CreateProcessA::bInheritHandles ( bool bInheritHandles )

◆ dwCreationFlags() [1/2]

uint32_t introvirt::windows::kernel32::CreateProcessA::dwCreationFlags ( ) const

◆ dwCreationFlags() [2/2]

void introvirt::windows::kernel32::CreateProcessA::dwCreationFlags ( uint32_t dwCreationFlags )

◆ function_name()

const std::string & introvirt::windows::kernel32::CreateProcessA::function_name ( ) const

overridevirtual

Get the function name.

Returns: const std::string&

Implements introvirt::FunctionCall.

◆ inject()

static bool introvirt::windows::kernel32::CreateProcessA::inject	(	const guest_ptr< char[]> &	pApplicationName,
		const guest_ptr< char[]> &	pCommandLine,
		const guest_ptr< void > &	pProcessAttributes,
		const guest_ptr< void > &	pThreadAttributes,
		bool	bInheritHandles,
		uint32_t	dwCreationFlags,
		const guest_ptr< void > &	pEnvironment,
		const guest_ptr< char[]> &	pCurrentDirectory,
		const guest_ptr< void > &	pStartupInfo,
		const guest_ptr< void > &	pProcessInformation
	)

static

◆ json()

Json::Value introvirt::windows::kernel32::CreateProcessA::json ( ) const

overridevirtual

Get the function as Json.

Returns: Json::Value

Implements introvirt::FunctionCall.

◆ library_name()

const std::string & introvirt::windows::kernel32::CreateProcessA::library_name ( ) const

overridevirtual

Get the name of the library this call is for.

Returns: const std::string&

Implements introvirt::FunctionCall.

◆ pApplicationName() [1/2]

guest_ptr< char[]> introvirt::windows::kernel32::CreateProcessA::pApplicationName ( ) const

◆ pApplicationName() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pApplicationName ( const guest_ptr< char[]> & pApplicationName )

◆ pCommandLine() [1/2]

guest_ptr< char[]> introvirt::windows::kernel32::CreateProcessA::pCommandLine ( ) const

◆ pCommandLine() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pCommandLine ( const guest_ptr< char[]> & pCommandLine )

◆ pCurrentDirectory() [1/2]

guest_ptr< char[]> introvirt::windows::kernel32::CreateProcessA::pCurrentDirectory ( ) const

◆ pCurrentDirectory() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pCurrentDirectory ( const guest_ptr< char[]> & pCurrentDirectory )

◆ pEnvironment() [1/2]

guest_ptr< void > introvirt::windows::kernel32::CreateProcessA::pEnvironment ( ) const

◆ pEnvironment() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pEnvironment ( const guest_ptr< void > & pEnvironment )

◆ pProcessAttributes() [1/2]

guest_ptr< void > introvirt::windows::kernel32::CreateProcessA::pProcessAttributes ( ) const

◆ pProcessAttributes() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pProcessAttributes ( const guest_ptr< void > & pProcessAttributes )

◆ pProcessInformation() [1/2]

guest_ptr< void > introvirt::windows::kernel32::CreateProcessA::pProcessInformation ( ) const

◆ pProcessInformation() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pProcessInformation ( const guest_ptr< void > & pProcessInformation )

◆ ProcessInformation()

std::shared_ptr< PROCESS_INFORMATION > introvirt::windows::kernel32::CreateProcessA::ProcessInformation ( )

◆ pStartupInfo() [1/2]

guest_ptr< void > introvirt::windows::kernel32::CreateProcessA::pStartupInfo ( ) const

◆ pStartupInfo() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pStartupInfo ( const guest_ptr< void > & pStartupInfo )

◆ pThreadAttributes() [1/2]

guest_ptr< void > introvirt::windows::kernel32::CreateProcessA::pThreadAttributes ( ) const

◆ pThreadAttributes() [2/2]

void introvirt::windows::kernel32::CreateProcessA::pThreadAttributes ( const guest_ptr< void > & pThreadAttributes )

◆ result() [1/2]

bool introvirt::windows::kernel32::CreateProcessA::result ( ) const

◆ result() [2/2]

void introvirt::windows::kernel32::CreateProcessA::result ( bool result )

◆ StartupInfo()

std::shared_ptr< STARTUPINFOA > introvirt::windows::kernel32::CreateProcessA::StartupInfo ( )

◆ write()

void introvirt::windows::kernel32::CreateProcessA::write ( std::ostream & os = std::cout ) const

overridevirtual

Write out a textual representation of the function for display.

Parameters

os

Implements introvirt::FunctionCall.

Member Data Documentation

◆ ArgumentCount

constexpr int introvirt::windows::kernel32::CreateProcessA::ArgumentCount = 10

staticconstexpr

◆ FunctionName

const std::string introvirt::windows::kernel32::CreateProcessA::FunctionName = "CreateProcessA"

inlinestatic

◆ LibraryName

const std::string introvirt::windows::kernel32::CreateProcessA::LibraryName = "kernel32"

inlinestatic

The documentation for this class was generated from the following file:

/home/runner/work/IntroVirt/IntroVirt/include/introvirt/windows/libraries/kernel32/functions/CreateProcessA.hh

Public Member Functions

Static Public Member Functions

Static Public Attributes

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ CreateProcessA()

◆ ~CreateProcessA()

Member Function Documentation

◆ bInheritHandles() [1/2]

◆ bInheritHandles() [2/2]

◆ dwCreationFlags() [1/2]

◆ dwCreationFlags() [2/2]

◆ function_name()

◆ inject()

◆ json()

◆ library_name()

◆ pApplicationName() [1/2]

◆ pApplicationName() [2/2]

◆ pCommandLine() [1/2]

◆ pCommandLine() [2/2]

◆ pCurrentDirectory() [1/2]

◆ pCurrentDirectory() [2/2]

◆ pEnvironment() [1/2]

◆ pEnvironment() [2/2]

◆ pProcessAttributes() [1/2]

◆ pProcessAttributes() [2/2]

◆ pProcessInformation() [1/2]

◆ pProcessInformation() [2/2]

◆ ProcessInformation()

◆ pStartupInfo() [1/2]

◆ pStartupInfo() [2/2]

◆ pThreadAttributes() [1/2]

◆ pThreadAttributes() [2/2]

◆ result() [1/2]

◆ result() [2/2]

◆ StartupInfo()

◆ write()

Member Data Documentation

◆ ArgumentCount

◆ FunctionName

◆ LibraryName