libintrovirt v0.57.4
IntroVirt introspection library
Loading...
Searching...
No Matches
Classes | Public Member Functions | Static Public Member Functions | List of all members
introvirt::windows::nt::THREAD Class Referenceabstract

#include <THREAD.hh>

Inheritance diagram for introvirt::windows::nt::THREAD:
Inheritance graph
[legend]
Collaboration diagram for introvirt::windows::nt::THREAD:
Collaboration graph
[legend]

Classes

class  CrossThreadFlags
 

Public Member Functions

virtual TEB * Teb ()=0
 
virtual const TEB * Teb () const =0
 
virtual const CLIENT_ID & Cid () const =0
 Get the PID/TID for this THREAD.
 
virtual const PROCESS & Process () const =0
 
virtual PROCESS & Process ()=0
 
virtual int8_t BasePriority () const =0
 
virtual void BasePriority (int8_t priority)=0
 
virtual int8_t Priority () const =0
 
virtual void Priority (int8_t priority)=0
 
virtual uint64_t Affinity () const =0
 
virtual void Affinity (uint64_t affinity)=0
 
virtual uint64_t UserAffinity () const =0
 
virtual void UserAffinity (uint64_t affinity)=0
 
virtual uint32_t IdealProcessor () const =0
 
virtual void IdealProcessor (uint32_t processor)=0
 
virtual uint32_t UserIdealProcessor () const =0
 
virtual void UserIdealProcessor (uint32_t processor)=0
 
virtual int16_t KernelApcDisable () const =0
 
virtual void KernelApcDisable (int16_t value)=0
 
virtual int16_t SpecialApcDisable () const =0
 
virtual void SpecialApcDisable (int16_t value)=0
 
virtual uint8_t PreviousMode () const =0
 
virtual void PreviousMode (uint8_t mode)=0
 
virtual guest_ptr< void > Win32StartAddress () const =0
 
virtual KTHREAD_STATE State () const =0
 
virtual void State (KTHREAD_STATE State)=0
 
virtual bool Preempted () const =0
 
virtual void Preempted (bool Preempted)=0
 
virtual uint32_t CrossThreadFlags () const =0
 
virtual void CrossThreadFlags (uint32_t CrossThreadFlags)=0
 
virtual int8_t Saturation () const =0
 
virtual void Saturation (int8_t saturation)=0
 
virtual bool DisableDynamicCodeOptOut () const =0
 
virtual void DisableDynamicCodeOptOut (bool DisableDynamicCodeOptOut)=0
 
virtual uint64_t InitialStack () const =0
 
virtual uint64_t StackBase () const =0
 
virtual uint64_t StackLimit () const =0
 
virtual uint64_t KernelStack () const =0
 
virtual WindowsTime CreateTime () const =0
 
virtual void CreateTime (const WindowsTime &time)=0
 
- Public Member Functions inherited from introvirt::windows::nt::DISPATCHER_OBJECT
virtual DISPATCHER_HEADER & DispatcherHeader ()=0
 
virtual const DISPATCHER_HEADER & DispatcherHeader () const =0
 
virtual ~DISPATCHER_OBJECT ()=default
 
- Public Member Functions inherited from introvirt::windows::nt::OBJECT
virtual const OBJECT_HEADER & header () const =0
 Get the OBJECT_HEADER for this object.
 
virtual guest_ptr< void > ptr () const =0
 
virtual ~OBJECT ()=default
 Destroy the instance.
 

Static Public Member Functions

static std::shared_ptr< THREAD > make_shared (const NtKernel &kernel, const guest_ptr< void > &ptr)
 
static std::shared_ptr< THREAD > make_shared (const NtKernel &kernel, std::unique_ptr< OBJECT_HEADER > &&header)
 
- Static Public Member Functions inherited from introvirt::windows::nt::OBJECT
static std::shared_ptr< OBJECT > make_shared (const NtKernel &kernel, const guest_ptr< void > &ptr)
 
static std::shared_ptr< OBJECT > make_shared (const NtKernel &kernel, std::unique_ptr< OBJECT_HEADER > &&object_header)
 

Detailed Description

This class handles the Windows KTHREAD/ETHREAD structures

Member Function Documentation

◆ Affinity() [1/2]

virtual uint64_t introvirt::windows::nt::THREAD::Affinity ( ) const
pure virtual

◆ Affinity() [2/2]

virtual void introvirt::windows::nt::THREAD::Affinity ( uint64_t  affinity)
pure virtual

◆ BasePriority() [1/2]

virtual int8_t introvirt::windows::nt::THREAD::BasePriority ( ) const
pure virtual

◆ BasePriority() [2/2]

virtual void introvirt::windows::nt::THREAD::BasePriority ( int8_t  priority)
pure virtual

◆ Cid()

virtual const CLIENT_ID & introvirt::windows::nt::THREAD::Cid ( ) const
pure virtual

Get the PID/TID for this THREAD.

◆ CreateTime() [1/2]

virtual WindowsTime introvirt::windows::nt::THREAD::CreateTime ( ) const
pure virtual

◆ CreateTime() [2/2]

virtual void introvirt::windows::nt::THREAD::CreateTime ( const WindowsTime &  time)
pure virtual

◆ CrossThreadFlags() [1/2]

virtual uint32_t introvirt::windows::nt::THREAD::CrossThreadFlags ( ) const
pure virtual
Returns
A bitmask of CT_* flags

◆ CrossThreadFlags() [2/2]

virtual void introvirt::windows::nt::THREAD::CrossThreadFlags ( uint32_t  CrossThreadFlags)
pure virtual

◆ DisableDynamicCodeOptOut() [1/2]

virtual bool introvirt::windows::nt::THREAD::DisableDynamicCodeOptOut ( ) const
pure virtual

◆ DisableDynamicCodeOptOut() [2/2]

virtual void introvirt::windows::nt::THREAD::DisableDynamicCodeOptOut ( bool  DisableDynamicCodeOptOut)
pure virtual

◆ IdealProcessor() [1/2]

virtual uint32_t introvirt::windows::nt::THREAD::IdealProcessor ( ) const
pure virtual

◆ IdealProcessor() [2/2]

virtual void introvirt::windows::nt::THREAD::IdealProcessor ( uint32_t  processor)
pure virtual

◆ InitialStack()

virtual uint64_t introvirt::windows::nt::THREAD::InitialStack ( ) const
pure virtual

◆ KernelApcDisable() [1/2]

virtual int16_t introvirt::windows::nt::THREAD::KernelApcDisable ( ) const
pure virtual

◆ KernelApcDisable() [2/2]

virtual void introvirt::windows::nt::THREAD::KernelApcDisable ( int16_t  value)
pure virtual

◆ KernelStack()

virtual uint64_t introvirt::windows::nt::THREAD::KernelStack ( ) const
pure virtual

◆ make_shared() [1/2]

static std::shared_ptr< THREAD > introvirt::windows::nt::THREAD::make_shared ( const NtKernel &  kernel,
const guest_ptr< void > &  ptr 
)
static

◆ make_shared() [2/2]

static std::shared_ptr< THREAD > introvirt::windows::nt::THREAD::make_shared ( const NtKernel &  kernel,
std::unique_ptr< OBJECT_HEADER > &&  header 
)
static

◆ Preempted() [1/2]

virtual bool introvirt::windows::nt::THREAD::Preempted ( ) const
pure virtual

◆ Preempted() [2/2]

virtual void introvirt::windows::nt::THREAD::Preempted ( bool  Preempted)
pure virtual

◆ PreviousMode() [1/2]

virtual uint8_t introvirt::windows::nt::THREAD::PreviousMode ( ) const
pure virtual

◆ PreviousMode() [2/2]

virtual void introvirt::windows::nt::THREAD::PreviousMode ( uint8_t  mode)
pure virtual

◆ Priority() [1/2]

virtual int8_t introvirt::windows::nt::THREAD::Priority ( ) const
pure virtual

◆ Priority() [2/2]

virtual void introvirt::windows::nt::THREAD::Priority ( int8_t  priority)
pure virtual

◆ Process() [1/2]

virtual const PROCESS & introvirt::windows::nt::THREAD::Process ( ) const
pure virtual
Returns
The PROCESS object that owns this thread, or NULL if unavailable
Examples
ivexec.cc, and ivprocmemdump.cc.

◆ Process() [2/2]

virtual PROCESS & introvirt::windows::nt::THREAD::Process ( )
pure virtual

◆ Saturation() [1/2]

virtual int8_t introvirt::windows::nt::THREAD::Saturation ( ) const
pure virtual

◆ Saturation() [2/2]

virtual void introvirt::windows::nt::THREAD::Saturation ( int8_t  saturation)
pure virtual

◆ SpecialApcDisable() [1/2]

virtual int16_t introvirt::windows::nt::THREAD::SpecialApcDisable ( ) const
pure virtual

◆ SpecialApcDisable() [2/2]

virtual void introvirt::windows::nt::THREAD::SpecialApcDisable ( int16_t  value)
pure virtual

◆ StackBase()

virtual uint64_t introvirt::windows::nt::THREAD::StackBase ( ) const
pure virtual

◆ StackLimit()

virtual uint64_t introvirt::windows::nt::THREAD::StackLimit ( ) const
pure virtual

◆ State() [1/2]

virtual KTHREAD_STATE introvirt::windows::nt::THREAD::State ( ) const
pure virtual

◆ State() [2/2]

virtual void introvirt::windows::nt::THREAD::State ( KTHREAD_STATE  State)
pure virtual

◆ Teb() [1/2]

virtual const TEB * introvirt::windows::nt::THREAD::Teb ( ) const
pure virtual

◆ Teb() [2/2]

virtual TEB * introvirt::windows::nt::THREAD::Teb ( )
pure virtual
Returns
The thread environment block
Examples
ivexec.cc.

◆ UserAffinity() [1/2]

virtual uint64_t introvirt::windows::nt::THREAD::UserAffinity ( ) const
pure virtual

◆ UserAffinity() [2/2]

virtual void introvirt::windows::nt::THREAD::UserAffinity ( uint64_t  affinity)
pure virtual

◆ UserIdealProcessor() [1/2]

virtual uint32_t introvirt::windows::nt::THREAD::UserIdealProcessor ( ) const
pure virtual

◆ UserIdealProcessor() [2/2]

virtual void introvirt::windows::nt::THREAD::UserIdealProcessor ( uint32_t  processor)
pure virtual

◆ Win32StartAddress()

virtual guest_ptr< void > introvirt::windows::nt::THREAD::Win32StartAddress ( ) const
pure virtual
Returns
The Win32StartAddress member of ETHREAD
The documentation for this class was generated from the following file: