Whether the runtime features are enabled.
Return an iterator over the different modules loaded in the current process.
Assemble the provided assembly code at the specified (absolute) virtual address.
The function returns the generated assembly bytes.
#include <LIEF/runtime.hpp>
auto code = LIEF::runtime::assemble(0x7f0011223344, R"(
xor rax, rbx;
mov rcx, rax;
)");
If you need to configure the assembly engine or to define addresses for symbols, you can provide your own assembly::AssemblerConfig instance.
Start disassembling instructions at the given absolute virtual address.
for (const auto& inst : disassemble(0x7f0011223344)) {
std::cout << inst.to_string() << '\n';
}
This structure represents the current process and provides functions to query process-level information.
Subclassed by LIEF::runtime::Linux::Process, LIEF::runtime::android::Process, LIEF::runtime::osx::Process, LIEF::runtime::windows::Process
Public Static Functions
Get the Thread ID of the current thread.
Return the number of bytes in a memory page.
For instance:
0x1000 (4096 bytes) for x86_64
0x4000 (16384 bytes) for ARM64
Return the environment variable associated with the given key.
This class represents the current host.
Public Static Functions
The machine hostname.
The user home dir (e.g. /home/romain or C:\Users\romain).
Temporary directory.
This function looks at the environment variables to determine the suitable temp directory (e.g. TEMP, TMPDIR)
The directory to store user-specific configuration.
The directory where software should store their cache files (e.g. $HOME/.cache).
This class represents an in-memory module which can be an executable or a library.
Subclassed by LIEF::runtime::Linux::Module, LIEF::runtime::android::Module, LIEF::runtime::osx::Module, LIEF::runtime::windows::Module
Public Functions
Base address where the module is loaded in memory.
Virtual size of the current module.
End address of the module.
Name of the module (e.g. libc.so.6, kernel32.dll, libsystem_c.dylib).
Path of the module.
Check if the current module contains the given address.
Return the content of the module as it is currently mapped in memory.
The returned buffer spans imagebase() over size() bytes. An empty buffer is returned if the imagebase or the size is null.
Same as dump() but also writes the content into the file located at filepath.
Same as dump() but also writes the content into the given output stream.
This function can be used to downcast a Module instance.
Find the module with the given name.
This class exposes API to access and manage memory.
Public Types
Flags used when creating a memory map (mmap).
Values:
Changes are private to this process (copy-on-write).
The mapping is not backed by any file.
Changes are shared.
Interpret the address as a fixed requirement.
Map for Just-In-Time code generation.
Public Static Functions
Allocate a memory chunk through mmap-like function.
Deallocate a mmaped memory chunk.
Sets the permission of the given memory chunk.
Write the buffer at the address given in the third parameter.
This function assumes that the memory pointed by addr has the correct permission to write this buffer.
Write the buffer at the address given in the third parameter.
This function assumes that the memory pointed by addr has the correct permission to write this buffer.
Generic function to write a typed value.
Read the content at the address pointed by the first parameter and write the result in the std::vector provided in the second parameter.
Read the content at the address pointed by the first parameter and write the result in the buffer provided in the second parameter.
This function assumes that the buffer in the second parameter is large enough to contain the data being read.
Represents a contiguous chunk of memory allocated or inspected by the runtime.
Public Functions
Returns the start address of the memory chunk as an opaque pointer.
Returns the start address of the memory chunk.
Returns the size of the memory chunk in bytes.
Returns the current permissions of the memory chunk.
Returns the address of the start of the page containing this chunk.
Returns the address of the end of the page containing this chunk.
Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT).
Check if this chunk is valid.
RAII interface to change the permission within a determined scope.
This class exposes a Linux-specific API for a module.
Public Functions
Return the dlopen handle for this library.
Return a nullptr if the function fails or if the handler can’t be found
Resolve the symbol with the given name for the current module.
Parse the ELF module from its path on the filesystem.
Parse the ELF module from its path on the filesystem and given the parser configuration.
Parse the ELF module from memory with the given configuration.
This class exposes Linux-specific host information.
This class exposes Android-specific API for a module.
Public Functions
Return the dlopen handle for this library.
Return a nullptr if the function fails or if the handler can’t be found
Resolve the symbol from with the given name for the current module.
Parse the ELF module from its path on the filesystem.
Parse the ELF module from its path on the filesystem and given the parser configuration.
Parse the ELF module from memory with the given configuration.
This class exposes Android-specific API for the current process.
Public Static Functions
Return the content of /proc/cmdline.
Return the value of the Android system property with the given name (e.g. ro.build.version.sdk).
Get all the system properties.
This class represents an Android property such as ro.boot.hardware.
Public Functions
Name of the property (e.g. ro.boot.hardware).
Value associated with the property.
Serial number of the property.
It is incremented each time the property is updated and can therefore be used to detect changes.
Pretty representation of the property.
This class exposes an OSX-specific API for a module.
Public Functions
Return the dlopen handle for this library.
Return a nullptr if the function fails or if the handler can’t be found
Resolve the symbol with the given name for the current module.
Parse the Mach-O module from its path on the filesystem.
Parse the Mach-O module from its path on the filesystem with the given parser configuration.
Parse the Mach-O module from memory with the given configuration.
Public Static Functions
The OS version string (e.g. Version 26.2 (Build 25C56)).
Whether System Integrity Protection (SIP) is enabled on this host.
This conservatively returns true when the status can’t be determined (including on a non-macOS build).
This class exposes a Windows-specific API for a module.
Public Functions
Return the HMODULE handle as an opaque pointer.
Return a nullptr if the function fails or if the handler can’t be found
Resolve the symbol with the given name for the current module.
Parse the PE module from its path on the filesystem.
Parse the PE module from its path on the filesystem and given the parser configuration.
Parse the PE module from memory with the given configuration.
Load the windows library with the given path or name.
Try to get the Module with the given name.
Return a nullptr if the module is not found
if (auto ntdll = find_module("ntdll.dll")) {
std::cout << ntdll->path() << '\n';
}
Note
This function relies on the Windows API GetModuleHandle which is more efficient than the generic implementation LIEF::runtime::module_from_name
Describes how to spawn a new process and inject a library into it.
Public Functions
Check whether the context is consistent (required paths filled-in and readable).
Public Members
Absolute path to the target executable to spawn.
Command-line arguments passed to the spawned process.
Absolute path to the library (DLL) that should be injected.
Environment variables to set in the spawned process. If left empty, the current process environment is inherited.
Friends
Spawn the target described by the given injection context and inject the associated library before the main thread starts executing.
This is the Windows equivalent of a “create suspended + remote LoadLibrary” approach.
This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process.
An instance can be created through LIEF::runtime::windows::Process::peb().
if (auto peb = LIEF::runtime::windows::Process::peb()) {
if (peb->being_debugged()) {
// A debugger is attached to the current process
}
}
Public Types
Iterator over the LdrDataTableEntry referenced by the loader data.
Public Functions
Whether the current process is being debugged.
Address of the loader data structure (PEB_LDR_DATA).
Address of the process parameters (RTL_USER_PROCESS_PARAMETERS).
Address of the per-process ATL thunk SList (single-linked list).
32-bit value of the ATL thunk SList pointer.
Address of the routine called once the process completed its initialization (PostProcessInitRoutine).
Session ID associated with the current process.
Return a bidirectional iterator over the modules referenced by the loader data (Ldr).
if (auto peb = LIEF::runtime::windows::Process::peb()) {
for (const LdrDataTableEntry& entry : peb->entries()) {
// entry.base_dll_name(), entry.dll_base(), ...
}
}
Friends
This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process.
Public Functions
Base address at which the module is mapped in memory (DllBase).
Address of the entry point of the module (EntryPoint).
Size (in bytes) of the module’s image in memory (SizeOfImage).
Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.
Base name of the module (BaseDllName), e.g. ntdll.dll.
Loader flags describing the state of the module (Flags).
Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and later.
TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).
TimeDateStamp of the module as cached by the loader.
Address of the activation context associated with the module’s entry point.
Address of the per-entry loader lock.
Address of the dependency-graph node of the module (DdagNode).
Note
Available on Windows 8 and later.
Address of the loader context used while the module is being snapped.
Note
Available on Windows 8 and later.
Base address of the module that triggered the load of this one.
Note
Available on Windows 8 and later.
Address of the CHPE switch-back context.
Note
Available on Windows 8 and later.
Preferred base address recorded in the PE headers.
Note
Available on Windows 8 and later.
Time at which the module was loaded.
Note
Available on Windows 8 and later.
Hash of the module’s base name used to index the loader tables.
Note
Available on Windows 8 and later.
Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.
Note
Available on Windows 8 and later.
Path-search options implied when the module was resolved.
Note
Available on Windows 8 and later.
Number of references currently held on the module.
Note
Available on Windows 8 and later.
Flags controlling how the statically-linked dependencies of the module are loaded.
Note
Available on Windows 8 and later.
Signing level of the module’s image, as a SE_SIGNING_LEVEL value.
Note
Available on Windows 10 and later.
Image checksum cached by the loader.
Note
Available on Windows 10 and later.
Base address of the active hot-patch image, if any.
Note
Available on Windows 11 and later.
State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.
Note
Available on Windows 11 and later.
Pretty-printed representation of this entry.
Friends
Bidirectional iterator over the LdrDataTableEntry mirroring the doubly-linked list used by Windows.
Public Types
Public Functions
Transfer ownership of the entry at the current position to the caller. Returns nullptr if the iterator is past-the-end.