Describes a victim object. More...

#include <exceptions.h>

Data Fields
INTRO_OBJECT_TYPE	Type
	The type of the modified object. More...

DWORD	NameHash
	The hash of the modified object. More...

union {
char * Name
	The modified process name. More...

WCHAR * NameWide
	The modified module name. More...

};

QWORD	BaseAddress
	Depending on INTRO_OBJECT_TYPE we have: CR3 for processes / ModuleBase for km drivers and um dll. More...

union {
union {
EXCEPTION_VICTIM_MODULE Module
	Used when a module is modified. More...

WIN_DRIVER_OBJECT * DriverObject
	Used when a driver object / fastio dispatch table is modified. More...

}

struct {
VAD * Vad
	The internal structure of the modified VAD. More...

EXCEPTION_VICTIM_MODULE Library
	The victim module of the modified library. More...

union {
void * Process
	The internal structure of the modified process. More...

WIN_PROCESS_OBJECT * WinProc
	The internal structure of the modified Windows process. More...

LIX_TASK_OBJECT * LixProc
	The internal structure of the modified Linux process. More...

}

}

};

Detailed Description

Describes a victim object.

Definition at line 850 of file exceptions.h.

Field Documentation

◆ @47

union { ... }

◆ @49

union { ... }

◆ BaseAddress

QWORD _EXCEPTION_VICTIM_OBJECT::BaseAddress

Depending on INTRO_OBJECT_TYPE we have: CR3 for processes / ModuleBase for km drivers and um dll.

Definition at line 863 of file exceptions.h.

Referenced by IntWinSudHandleFieldModification().

◆ DriverObject

WIN_DRIVER_OBJECT* _EXCEPTION_VICTIM_OBJECT::DriverObject

Used when a driver object / fastio dispatch table is modified.

Definition at line 870 of file exceptions.h.

Referenced by IntWinDrvObjHandleModification().

◆ Library

EXCEPTION_VICTIM_MODULE _EXCEPTION_VICTIM_OBJECT::Library

The victim module of the modified library.

Definition at line 877 of file exceptions.h.

Referenced by IntWinProcHandleCopyMemory(), IntWinThrHandleQueueApc(), and IntWinThrHandleThreadHijack().

◆ LixProc

LIX_TASK_OBJECT* _EXCEPTION_VICTIM_OBJECT::LixProc

The internal structure of the modified Linux process.

Definition at line 883 of file exceptions.h.

◆ Module

EXCEPTION_VICTIM_MODULE _EXCEPTION_VICTIM_OBJECT::Module

Used when a module is modified.

Definition at line 869 of file exceptions.h.

Referenced by IntLixKernelHandleRead().

◆ Name

char* _EXCEPTION_VICTIM_OBJECT::Name

The modified process name.

Definition at line 858 of file exceptions.h.

Referenced by IntWinSudHandleFieldModification().

◆ NameHash

DWORD _EXCEPTION_VICTIM_OBJECT::NameHash

The hash of the modified object.

Definition at line 854 of file exceptions.h.

Referenced by IntLixVdsoHandleUserModeWrite(), IntWinSDCheckAclIntegrity(), IntWinSDCheckSecDescIntegrity(), IntWinSudHandleFieldModification(), and IntWinTokenPrivsCheckIntegrityOnProcess().

◆ NameWide

WCHAR* _EXCEPTION_VICTIM_OBJECT::NameWide

The modified module name.

Definition at line 859 of file exceptions.h.

◆ Process

void* _EXCEPTION_VICTIM_OBJECT::Process

The internal structure of the modified process.

Definition at line 881 of file exceptions.h.

Referenced by IntWinSDCheckAclIntegrity(), IntWinSDCheckSecDescIntegrity(), and IntWinTokenPrivsCheckIntegrityOnProcess().

◆ Type

INTRO_OBJECT_TYPE _EXCEPTION_VICTIM_OBJECT::Type

The type of the modified object.

Definition at line 852 of file exceptions.h.

Referenced by IntLixVdsoHandleUserModeWrite(), IntWinInfHookIntegrityHandleWrite(), IntWinIntObjHandleModification(), IntWinSDCheckAclIntegrity(), IntWinSDCheckSecDescIntegrity(), IntWinSudHandleFieldModification(), and IntWinTokenPrivsCheckIntegrityOnProcess().

◆ Vad

VAD* _EXCEPTION_VICTIM_OBJECT::Vad

The internal structure of the modified VAD.

Definition at line 876 of file exceptions.h.

Referenced by IntWinProcHandleCopyMemory().

◆ WinProc

WIN_PROCESS_OBJECT* _EXCEPTION_VICTIM_OBJECT::WinProc

The internal structure of the modified Windows process.

Definition at line 882 of file exceptions.h.

The documentation for this struct was generated from the following file:

introcore/include/exceptions.h

Data Fields