ExtRemoteList

The ExtRemoteList class provides a wrapper around a singly-linked or doubly-linked list. The class contains methods that can be used to move both forward and backward through the list.

ExtRemoteList supports both NULL-terminated and circular lists.

Note ExtRemoteList expects that a list is lists implemented in the way that NT-based versions of Windows implements a list. It also expects that the list uses the SINGLE_LIST_ENTRY or LIST_ENTRY structure. In particular, ExtRemoteList expects the lists to have the following characteristics:

1. The list has a head. The head represents the beginning (and, for circular and doubly-linked lists, the end) of the list and is not a list item. The type of the head is SINGLE_LIST_ENTRY or LIST_ENTRY.
2. The pointer to the next item in the list points to the pointer to the following item. In other words, the pointer to the next item points to the SINGLE_LIST_ENTRY or LIST_ENTRY structure embedded in the next item.
3. For doubly-linked lists, the pointer to the previous item in the list points to the pointer to the current item. In other words, the pointer to the previous item points to the LIST_ENTRY structure embedded in the previous item.
4. For doubly-linked lists, the pointer to the previous item immediately follows the pointer to the next item. This matches the layout of the LIST_ENTRY structure in memory.

For more information about the SINGLE_LIST_ENTRY and LIST_ENTRY structures and their use, see the Windows Driver Kit (WDK) documentation.

The ExtRemoteList class includes the following methods:

class ExtRemoteList
{
public:
    ULONG64  m_Head;
    ULONG  m_LinkOffset;
    bool  m_Double;
    ULONG  m_MaxIter;
    ExtRemoteData  m_Node;
    ULONG  m_CurIter;
};

Members

m_Head

The location in the target's memory of the head of the list.

m_LinkOffset

The offset of the SINGLE_LIST_ENTRY or LIST_ENTRY structures embedded within the list items.

m_Double

true for a doubly-linked list. false for a singly-linked list.

m_MaxIter

The maximum number of nodes that can be returned when iterating over the list. The default value of m_MaxIter is 65536. Limiting the number of nodes that can be returned in an iteration protects against loops.

m_Node

The pointer to the current item in the list. m_Node is not set until an iteration is initialized using StartHead or StartTail. m_Node is of type ExtRemoteData, which describes the pointer.

m_CurIter

The number of steps taken in the current list iteration. For doubly-linked lists, m_CurIter is increased for both forward and backward steps.

Requirements

Headers: Defined in Engextcpp.hpp. Include Engextcpp.hpp.

See Also

ExtRemoteData, StartHead, StartTail