LIEF: Library to Instrument Executable Formats Version 2.0.0
Loading...
Searching...
No Matches
LdrDataTableEntry.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_RUNTIME_WINDOWS_LDR_DATA_TABLE_ENTRY_H
17#define LIEF_RUNTIME_WINDOWS_LDR_DATA_TABLE_ENTRY_H
18#include <cstdint>
19#include <memory>
20#include <ostream>
21#include <string>
22
24#include "LIEF/iterators.hpp"
25#include "LIEF/visibility.h"
26#include <optional>
27
28
29namespace LIEF::runtime::windows {
30
31namespace details {
32class ldr_entry;
33class ldr_entry_it;
34}
35
40 public:
43 class Iterator final
44 : public iterator_facade_base<Iterator, std::bidirectional_iterator_tag,
45 LdrDataTableEntry, std::ptrdiff_t,
46 const LdrDataTableEntry*,
47 const LdrDataTableEntry&> {
48 public:
49 using implementation = details::ldr_entry_it;
50 using iterator_facade_base::operator++;
51 using iterator_facade_base::operator--;
52
54
55 LIEF_API Iterator(std::unique_ptr<details::ldr_entry_it> impl);
56
59
61 LIEF_API Iterator& operator=(Iterator&&) noexcept;
62
64
65 friend LIEF_API bool operator==(const Iterator& LHS, const Iterator& RHS);
66 friend bool operator!=(const Iterator& LHS, const Iterator& RHS) {
67 return !(LHS == RHS);
68 }
69
70 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
72
73 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
75
77
78 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
80
83 LIEF_API std::unique_ptr<LdrDataTableEntry> yield();
84
85 private:
86 void load() const;
87
88 std::unique_ptr<details::ldr_entry_it> impl_;
89 mutable std::unique_ptr<LdrDataTableEntry> cached_;
90 };
91
93 LdrDataTableEntry(std::unique_ptr<details::ldr_entry> impl);
94
96 LdrDataTableEntry& operator=(const LdrDataTableEntry&) = delete;
97
99 LdrDataTableEntry& operator=(LdrDataTableEntry&&) noexcept;
100
102 uintptr_t dll_base() const;
103
105 uintptr_t entry_point() const;
106
108 uint32_t size_of_image() const;
109
112 std::string full_dll_name() const;
113
115 std::string base_dll_name() const;
116
118 uint32_t flags() const;
119
122 uint16_t obsolete_load_count() const;
123
126 uint16_t tls_index() const;
127
129 uint32_t time_date_stamp() const;
130
134
136 uintptr_t lock() const;
137
141 std::optional<uintptr_t> ddag_node() const;
142
146 std::optional<uintptr_t> load_context() const;
147
151 std::optional<uintptr_t> parent_dll_base() const;
152
156 std::optional<uintptr_t> switch_back_context() const;
157
161 std::optional<uintptr_t> original_base() const;
162
166 std::optional<int64_t> load_time() const;
167
171 std::optional<uint32_t> base_name_hash_value() const;
172
176 std::optional<int32_t> load_reason() const;
177
181 std::optional<uint32_t> implicit_path_options() const;
182
186 std::optional<uint32_t> reference_count() const;
187
192 std::optional<uint32_t> dependent_load_flags() const;
193
197 std::optional<uint8_t> signing_level() const;
198
202 std::optional<uint32_t> check_sum() const;
203
207 std::optional<uintptr_t> active_patch_image_base() const;
208
213 std::optional<uint32_t> hot_patch_state() const;
214
216 std::string to_string() const;
217
218 LIEF_API friend std::ostream& operator<<(std::ostream& os,
219 const LdrDataTableEntry& entry) {
220 os << entry.to_string();
221 return os;
222 }
223
225
226 private:
227 std::unique_ptr<details::ldr_entry> impl_;
228};
229
230}
231
232
233#endif
CRTP base class which implements the entire standard iterator facade in terms of a minimal subset of ...
Definition iterators.hpp:738
Iterator(std::unique_ptr< details::ldr_entry_it > impl)
details::ldr_entry_it implementation
Definition LdrDataTableEntry.hpp:49
std::unique_ptr< LdrDataTableEntry > yield()
Transfer ownership of the entry at the current position to the caller. Returns nullptr if the iterato...
std::optional< uint32_t > reference_count() const
Number of references currently held on the module.
uintptr_t dll_base() const
Base address at which the module is mapped in memory (DllBase).
std::optional< int64_t > load_time() const
Time at which the module was loaded.
std::optional< uint32_t > base_name_hash_value() const
Hash of the module's base name used to index the loader tables.
std::optional< int32_t > load_reason() const
Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.
std::string to_string() const
Pretty-printed representation of this entry.
std::optional< uint8_t > signing_level() const
Signing level of the module's image, as a SE_SIGNING_LEVEL value.
uint32_t flags() const
Loader flags describing the state of the module (Flags).
std::optional< uint32_t > check_sum() const
Image checksum cached by the loader.
std::optional< uintptr_t > parent_dll_base() const
Base address of the module that triggered the load of this one.
std::optional< uint32_t > implicit_path_options() const
Path-search options implied when the module was resolved.
std::optional< uintptr_t > active_patch_image_base() const
Base address of the active hot-patch image, if any.
uint32_t size_of_image() const
Size (in bytes) of the module's image in memory (SizeOfImage).
uint16_t tls_index() const
TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).
uintptr_t entry_point() const
Address of the entry point of the module (EntryPoint).
std::optional< uintptr_t > load_context() const
Address of the loader context used while the module is being snapped.
std::optional< uintptr_t > ddag_node() const
Address of the dependency-graph node of the module (DdagNode).
uint16_t obsolete_load_count() const
Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and...
uintptr_t lock() const
Address of the per-entry loader lock.
std::string base_dll_name() const
Base name of the module (BaseDllName), e.g. ntdll.dll.
std::optional< uintptr_t > switch_back_context() const
Address of the CHPE switch-back context.
std::optional< uintptr_t > original_base() const
Preferred base address recorded in the PE headers.
std::optional< uint32_t > dependent_load_flags() const
Flags controlling how the statically-linked dependencies of the module are loaded.
uintptr_t entry_point_activation_context() const
Address of the activation context associated with the module's entry point.
std::string full_dll_name() const
Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.
uint32_t time_date_stamp() const
TimeDateStamp of the module as cached by the loader.
std::optional< uint32_t > hot_patch_state() const
State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.
#define LIEF_LIFETIMEBOUND
Definition compiler_attributes.hpp:72
Definition LdrDataTableEntry.hpp:31
Definition windows/Host.hpp:24
#define LIEF_API
Definition visibility.h:45