C++¶

Utilities¶

static bool LIEF::runtime::is_enabled()¶: Whether the runtime features are enabled.

static PLATFORMS LIEF::runtime::platform()¶: Platform for which the runtime is compiled.

static ARCH LIEF::runtime::arch()¶: Architecture for which the runtime is compiled.

modules_t LIEF::runtime::modules()¶: Return an iterator over the different modules loaded in the current process.

std::vector<uint8_t> LIEF::runtime::assemble(uint64_t addr, const std::string &Asm, assembly::AssemblerConfig &config = assembly::AssemblerConfig::default_config())¶

Assemble the provided assembly code at the specified (absolute) virtual address.

The function returns the generated assembly bytes.

#include <LIEF/runtime.hpp>

auto code = LIEF::runtime::assemble(0x7f0011223344, R"(
  xor rax, rbx;
  mov rcx, rax;
)");

If you need to configure the assembly engine or to define addresses for symbols, you can provide your own assembly::AssemblerConfig instance.

instructions_it LIEF::runtime::disassemble(uintptr_t addr)¶

Start disassembling instructions at the given absolute virtual address.

for (const auto& inst : disassemble(0x7f0011223344)) {
  std::cout << inst.to_string() << '\n';
}

Process¶

class Process¶

This structure represents the current process and provides functions to query process-level information.

Subclassed by LIEF::runtime::Linux::Process, LIEF::runtime::android::Process, LIEF::runtime::osx::Process, LIEF::runtime::windows::Process

Public Static Functions

static int32_t pid()¶: Get the Process ID of the current process.

static uint32_t tid()¶: Get the Thread ID of the current thread.

static inline ARCH arch()¶: Return the target architecture of the current process.

static inline PLATFORMS platform()¶: Return the target platform of the current process.

static uint32_t page_size()¶

Return the number of bytes in a memory page.

For instance:

0x1000 (4096 bytes) for x86_64
0x4000 (16384 bytes) for ARM64

static std::optional<std::string> get_env(const std::string &key)¶: Return the environment variable associated with the given key.

static EnvVars get_envs()¶: Return the environment variables present in the current process.

static assembly::Engine *default_engine()¶: Return the assembler/disassembler for the current process.

struct EnvVars¶

This structure wraps environment variables.

Public Functions

inline bool empty() const¶

Public Members

std::unordered_map<std::string, std::string> vars¶

Host¶

class Host¶

This class represents the current host.

Public Static Functions

static std::string name()¶: The machine hostname.

static std::string home_dir()¶: The user home dir (e.g. /home/romain or C:\Users\romain).

static std::string tmp_dir()¶

Temporary directory.

This function looks at the environment variables to determine the suitable temp directory (e.g. TEMP, TMPDIR)

static std::string config_dir()¶: The directory to store user-specific configuration.

static std::string cache_dir()¶: The directory where software should store their cache files (e.g. $HOME/.cache).

Module¶

class Module¶

This class represents an in-memory module which can be an executable or a library.

Subclassed by LIEF::runtime::Linux::Module, LIEF::runtime::android::Module, LIEF::runtime::osx::Module, LIEF::runtime::windows::Module

Public Functions

Module() = delete¶

Module(std::unique_ptr<details::Module> impl)¶

Module(const Module&) = delete¶

Module &operator=(const Module&) = delete¶

Module(Module&&) noexcept¶

Module &operator=(Module&&) noexcept¶

virtual std::unique_ptr<Module> clone() const¶

uint64_t imagebase() const¶: Base address where the module is loaded in memory.

uint64_t size() const¶: Virtual size of the current module.

inline uint64_t end() const¶: End address of the module.

std::string name() const¶: Name of the module (e.g. libc.so.6, kernel32.dll, libsystem_c.dylib).

std::string path() const¶: Path of the module.

inline bool contains(uintptr_t addr) const¶: Check if the current module contains the given address.

inline std::vector<uint8_t> dump() const¶

Return the content of the module as it is currently mapped in memory.

The returned buffer spans imagebase() over size() bytes. An empty buffer is returned if the imagebase or the size is null.

inline std::vector<uint8_t> dump(const std::string &filepath) const¶: Same as dump() but also writes the content into the file located at filepath.

inline std::vector<uint8_t> dump(std::ostream &os) const¶: Same as dump() but also writes the content into the given output stream.

std::string to_string() const¶

template<class T> inline const T *as() const¶: This function can be used to downcast a Module instance.

template<class T> inline T *as()¶

virtual ~Module()¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Module &M)¶

class Iterator : public LIEF::iterator_facade_base<Iterator, std::forward_iterator_tag, Module, std::ptrdiff_t, const Module*, const Module&>¶

Public Types

using implementation = details::ModuleIt¶

Public Functions

Iterator()¶

Iterator(const Iterator&)¶

Iterator &operator=(const Iterator&)¶

Iterator(Iterator&&) noexcept¶

Iterator &operator=(Iterator&&) noexcept¶

Iterator(std::unique_ptr<details::ModuleIt> impl)¶

~Iterator()¶

Iterator &operator++()¶

const Module &operator*() const¶

const Module *operator->() const¶

std::unique_ptr<Module> yield()¶: Transfer ownership of the module at the current position to the caller. Returns nullptr if the iterator is past-the-end.

inline DerivedT operator++(int)¶

Friends

friend bool operator==(const Iterator &LHS, const Iterator &RHS)¶

inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS)¶

inline std::unique_ptr<Module> LIEF::runtime::module_from_name(const std::string &name)¶: Find the module with the given name.

inline std::unique_ptr<Module> LIEF::runtime::module_from_path(const std::string &path)¶: Find the module with the given path.

inline std::unique_ptr<Module> LIEF::runtime::module_from_addr(uintptr_t addr)¶: Find the module that encompasses the given virtual address (absolute).

Memory¶

class Memory¶

This class exposes API to access and manage memory.

Public Types

enum MMAP_FLAGS¶

Flags used when creating a memory map (mmap).

Values:

enumerator MP_NONE = 0¶

enumerator MP_PRIVATE = 1 << 0¶: Changes are private to this process (copy-on-write).

enumerator MP_ANONYMOUS = 1 << 1¶: The mapping is not backed by any file.

enumerator MP_SHARED = 1 << 2¶: Changes are shared.

enumerator MP_FIXED = 1 << 3¶: Interpret the address as a fixed requirement.

enumerator MP_JIT = 1 << 4¶: Map for Just-In-Time code generation.

enum PERM¶

Values:

enumerator P_NONE = 0¶

enumerator P_READ = 1 << 0¶

enumerator P_WRITE = 1 << 1¶

enumerator P_EXEC = 1 << 2¶

Public Static Functions

static std::optional<Chunk> mmap(size_t size, uint32_t flags, uint32_t permissions = P_NONE)¶: Allocate a memory chunk through mmap-like function.

static ok_error_t munmap(Chunk &C)¶: Deallocate a mmaped memory chunk.

static ok_error_t mprotect(Chunk &C, uint32_t flags)¶: Sets the permission of the given memory chunk.

static inline ok_error_t write(const uint8_t *buffer, size_t size, uintptr_t addr)¶

Write the buffer at the address given in the third parameter.

This function assumes that the memory pointed by addr has the correct permission to write this buffer.

static inline ok_error_t write(const std::vector<uint8_t> &buffer, uintptr_t addr)¶

Write the buffer at the address given in the third parameter.

This function assumes that the memory pointed by addr has the correct permission to write this buffer.

template<class T, typename = std::enable_if_t<std::is_standard_layout_v<T> && std::is_trivial_v<T>>> static inline ok_error_t write(const T &value, uintptr_t addr)¶: Generic function to write a typed value.

template<class T> static inline T read(uintptr_t addr)¶: Generic function to read a typed value.

static inline void read(uintptr_t addr, std::vector<uint8_t> &out, size_t size)¶: Read the content at the address pointed by the first parameter and write the result in the std::vector provided in the second parameter.

static inline void read(uintptr_t addr, uint8_t *out, size_t size)¶

Read the content at the address pointed by the first parameter and write the result in the buffer provided in the second parameter.

This function assumes that the buffer in the second parameter is large enough to contain the data being read.

static std::string perm_str(uint32_t flags)¶

static inline bool support_rwx()¶

class Chunk¶

Represents a contiguous chunk of memory allocated or inspected by the runtime.

Public Functions

inline Chunk(void *addr, size_t size, uint32_t permissions)¶

inline Chunk(void *addr, size_t size)¶

inline Chunk(void *addr)¶

inline void *addr_ptr()¶: Returns the start address of the memory chunk as an opaque pointer.

inline const void *addr_ptr() const¶

inline uintptr_t addr() const¶: Returns the start address of the memory chunk.

inline size_t size() const¶: Returns the size of the memory chunk in bytes.

inline uint32_t permissions() const¶: Returns the current permissions of the memory chunk.

uintptr_t page_start() const¶: Returns the address of the start of the page containing this chunk.

uintptr_t page_end() const¶: Returns the address of the end of the page containing this chunk.

inline Chunk &change_permissions(uint32_t p)¶: Changes the permissions of the memory chunk.

inline Chunk &make_x()¶: Sets the permissions to Execute only.

inline Chunk &make_rw()¶: Sets the permissions to Read and Write.

inline Chunk &make_rx()¶: Sets the permissions to Read and Execute.

inline Chunk &make_rwx()¶: Sets the permissions to Read, Write, and Execute.

inline Chunk &make_ro()¶: Sets the permissions to Read Only.

Chunk &cache_flush()¶: Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT).

inline bool is_valid() const¶: Check if this chunk is valid.

inline operator bool() const¶

inline ok_error_t deallocate()¶

std::string to_string() const¶

Friends

friend class Memory

inline friend std::ostream &operator<<(std::ostream &os, const Chunk &C)¶

class ScopedPermissions¶

RAII interface to change the permission within a determined scope.

Public Functions

inline explicit ScopedPermissions(Chunk &chunk, uint32_t perms)¶

inline ~ScopedPermissions()¶

Linux¶

Module¶

class Module : public LIEF::runtime::Module ¶

This class exposes a Linux-specific API for a module.

Public Functions

void *handle() const¶

Return the dlopen handle for this library.

Return a nullptr if the function fails or if the handler can’t be found

void *dlsym(const std::string &name) const¶: Resolve the symbol with the given name for the current module.

std::unique_ptr<ELF::Binary> parse_from_path() const¶: Parse the ELF module from its path on the filesystem.

std::unique_ptr<ELF::Binary> parse_from_path(const ELF::ParserConfig &config) const¶: Parse the ELF module from its path on the filesystem and given the parser configuration.

std::unique_ptr<ELF::Binary> parse_from_memory(const ELF::ParserConfig &config) const¶: Parse the ELF module from memory with the given configuration.

std::unique_ptr<ELF::Binary> parse_from_memory() const¶: Parse the ELF module from memory.

virtual ~Module() override = default¶

Module() = delete¶

Module(std::unique_ptr<details::Module> impl)¶

Module(const Module&) = delete¶

Module(Module&&) noexcept¶

Public Static Functions

static std::unique_ptr<Module> from_handle(void *H)¶: Instantiate a Module from the given dlopen handle.

static inline bool classof(const runtime::Module*)¶

std::unique_ptr<Module> LIEF::runtime::Linux::dlopen(const std::string &name)¶: Load the library with the given path/name.

Host¶

class Host¶

This class exposes Linux-specific host information.

Public Static Functions

static std::string sys_name()¶: Operating system name (e.g., Linux).

static std::string sys_release()¶: Operating system release (e.g., 2.6.28).

static std::string sys_version()¶: Operating system version.

static std::string hardware()¶: Hardware type identifier (e.g., x86_64).

Process¶

class Process : public LIEF::runtime::Process ¶

This class exposes Linux-specific API for the current process.

Public Static Functions

static std::string cmdline()¶: Return the content of /proc/cmdline.

static std::string glibc_version()¶

Return the version of the GNU C Library (glibc) loaded in the current process (e.g. 2.39).

Return an empty string if the version cannot be determined.

static inline bool classof(const runtime::Process*)¶

Android¶

Module¶

class Module : public LIEF::runtime::Module ¶

This class exposes Android-specific API for a module.

Public Functions

void *handle() const¶

Return the dlopen handle for this library.

Return a nullptr if the function fails or if the handler can’t be found

void *dlsym(const std::string &name) const¶: Resolve the symbol from with the given name for the current module.

std::unique_ptr<ELF::Binary> parse_from_path() const¶: Parse the ELF module from its path on the filesystem.

std::unique_ptr<ELF::Binary> parse_from_path(const ELF::ParserConfig &config) const¶: Parse the ELF module from its path on the filesystem and given the parser configuration.

std::unique_ptr<ELF::Binary> parse_from_memory(const ELF::ParserConfig &config) const¶: Parse the ELF module from memory with the given configuration.

std::unique_ptr<ELF::Binary> parse_from_memory() const¶: Parse the ELF module from memory.

virtual ~Module() override = default¶

Module() = delete¶

Module(std::unique_ptr<details::Module> impl)¶

Module(const Module&) = delete¶

Module(Module&&) noexcept¶

Public Static Functions

static std::unique_ptr<Module> from_handle(void *H)¶: Instantiate a Module from the given dlopen handle.

static inline bool classof(const runtime::Module*)¶

std::unique_ptr<Module> LIEF::runtime::android::dlopen(const std::string &name)¶: Load the library with the given path/name.

Host¶

class Host¶

This class exposes Android-specific host information.

Public Static Functions

static std::optional<uint32_t> sdk_version()¶: Return the Android SDK/API level of the device (e.g. 34 for Android 14).

Process¶

class Process : public LIEF::runtime::Process ¶

This class exposes Android-specific API for the current process.

Public Types

using properties_t = std::vector<Property>¶

Public Static Functions

static std::string cmdline()¶: Return the content of /proc/cmdline.

static std::optional<Property> get_system_property(const std::string &name)¶: Return the value of the Android system property with the given name (e.g. ro.build.version.sdk).

static properties_t properties()¶: Get all the system properties.

static inline bool classof(const runtime::Process*)¶

Property¶

class Property¶

This class represents an Android property such as ro.boot.hardware.

Public Functions

Property() = default¶

inline Property(std::string name, std::string value, uint32_t serial)¶

Property(const Property&) = default¶

Property &operator=(const Property&) = default¶

Property(Property&&) noexcept = default¶

Property &operator=(Property&&) noexcept = default¶

~Property() = default¶

inline std::string_view name() const¶: Name of the property (e.g. ro.boot.hardware).

inline std::string_view value() const¶: Value associated with the property.

inline uint32_t serial() const¶

Serial number of the property.

It is incremented each time the property is updated and can therefore be used to detect changes.

std::string to_string() const¶: Pretty representation of the property.

Public Static Functions

static Property create_from(const prop_info &pi)¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Property &prop)¶

OSX¶

Module¶

class Module : public LIEF::runtime::Module ¶

This class exposes an OSX-specific API for a module.

Public Functions

void *handle() const¶

Return the dlopen handle for this library.

Return a nullptr if the function fails or if the handler can’t be found

void *dlsym(const std::string &name) const¶: Resolve the symbol with the given name for the current module.

std::unique_ptr<MachO::Binary> parse_from_path() const¶: Parse the Mach-O module from its path on the filesystem.

std::unique_ptr<MachO::Binary> parse_from_path(const MachO::ParserConfig &config) const¶: Parse the Mach-O module from its path on the filesystem with the given parser configuration.

std::unique_ptr<MachO::Binary> parse_from_memory() const¶: Parse the Mach-O module from memory.

std::unique_ptr<MachO::Binary> parse_from_memory(const MachO::ParserConfig &config) const¶: Parse the Mach-O module from memory with the given configuration.

virtual ~Module() override = default¶

Module() = delete¶

Module(std::unique_ptr<details::Module> impl)¶

Module(const Module&) = delete¶

Module(Module&&) noexcept¶

Public Static Functions

static std::unique_ptr<Module> from_handle(void *handle)¶: Instantiate a Module from the given dlopen handle.

static inline bool classof(const runtime::Module*)¶

std::unique_ptr<Module> LIEF::runtime::osx::dlopen(const std::string &name)¶: Load the library with the given path or name.

Host¶

class Host¶

Public Static Functions

static std::string os_version_name()¶: The OS version string (e.g. Version 26.2 (Build 25C56)).

static version_t os_version()¶: The OS version (e.g. 13.0.0).

static bool is_sip_enabled()¶

Whether System Integrity Protection (SIP) is enabled on this host.

This conservatively returns true when the status can’t be determined (including on a non-macOS build).

struct version_t¶

Public Functions

inline version_t(uint32_t major, uint32_t minor, uint32_t patch)¶

bool operator<=(const version_t &rhs) const¶

inline bool operator>(const version_t &rhs) const¶

bool operator>=(const version_t &rhs) const¶

inline bool operator<(const version_t &rhs) const¶

bool operator==(const version_t &other) const¶

inline bool operator!=(const version_t &other) const¶

std::string to_string() const¶

Public Members

uint32_t major = 0¶

uint32_t minor = 0¶

uint32_t patch = 0¶

Public Static Functions

static const version_t &BigSur()¶

static const version_t &Monterey()¶

static const version_t &Ventura()¶

static const version_t &Sonoma()¶

static const version_t &Sequoia()¶

static const version_t &Tahoe()¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const version_t version)¶

Process¶

class Process : public LIEF::runtime::Process ¶

This class exposes OSX-specific API for the current process.

Public Static Functions

static std::string dyld_version()¶: Return the version of dyld for the current process.

static inline bool classof(const runtime::Process*)¶

Windows¶

Module¶

class Module : public LIEF::runtime::Module ¶

This class exposes a Windows-specific API for a module.

Public Functions

void *handle() const¶

Return the HMODULE handle as an opaque pointer.

Return a nullptr if the function fails or if the handler can’t be found

void *dlsym(const std::string &name) const¶: Resolve the symbol with the given name for the current module.

std::unique_ptr<PE::Binary> parse_from_path() const¶: Parse the PE module from its path on the filesystem.

std::unique_ptr<PE::Binary> parse_from_path(const PE::ParserConfig &config) const¶: Parse the PE module from its path on the filesystem and given the parser configuration.

std::unique_ptr<PE::Binary> parse_from_memory(const PE::ParserConfig &config) const¶: Parse the PE module from memory with the given configuration.

std::unique_ptr<PE::Binary> parse_from_memory() const¶: Parse the PE module from memory.

virtual ~Module() override = default¶

Module() = delete¶

Module(std::unique_ptr<details::Module> impl)¶

Module(const Module&) = delete¶

Module(Module&&) noexcept¶

Public Static Functions

static std::unique_ptr<Module> from_handle(void *H)¶

static inline bool classof(const runtime::Module*)¶

std::unique_ptr<Module> LIEF::runtime::windows::dlopen(const std::string &name)¶: Load the windows library with the given path or name.

std::unique_ptr<Module> LIEF::runtime::windows::find_module(const std::string &name)¶

Try to get the Module with the given name.

Return a nullptr if the module is not found

if (auto ntdll = find_module("ntdll.dll")) {
  std::cout << ntdll->path() << '\n';
}

Note

This function relies on the Windows API GetModuleHandle which is more efficient than the generic implementation LIEF::runtime::module_from_name

Host¶

class Host¶

This class exposes Windows-specific host information.

Public Static Functions

static version_t version()¶: Return the Windows version (e.g., 10.0.26200).

struct version_t¶

Public Functions

version_t() = default¶

inline version_t(uint32_t major, uint32_t minor, uint32_t build_number)¶

bool operator<=(const version_t &rhs) const¶

inline bool operator>(const version_t &rhs) const¶

bool operator>=(const version_t &rhs) const¶

inline bool operator<(const version_t &rhs) const¶

bool operator==(const version_t &other) const¶

inline bool operator!=(const version_t &other) const¶

std::string to_string() const¶

Public Members

uint32_t major = 0¶

uint32_t minor = 0¶

uint32_t build_number = 0¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const version_t &version)¶

Injector¶

struct injection_context_t¶

Describes how to spawn a new process and inject a library into it.

Public Functions

bool validate() const¶: Check whether the context is consistent (required paths filled-in and readable).

inline operator bool() const¶

std::string to_string() const¶

Public Members

std::string target_path¶: Absolute path to the target executable to spawn.

std::string args¶: Command-line arguments passed to the spawned process.

std::string library¶: Absolute path to the library (DLL) that should be injected.

std::unordered_map<std::string, std::string> env¶: Environment variables to set in the spawned process. If left empty, the current process environment is inherited.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const injection_context_t &ctx)¶

ok_error_t LIEF::runtime::windows::inject_spawn(const injection_context_t &ctx)¶

Spawn the target described by the given injection context and inject the associated library before the main thread starts executing.

This is the Windows equivalent of a “create suspended + remote LoadLibrary” approach.

Process¶

class Process : public LIEF::runtime::Process ¶

This class exposes Windows-specific API for the current process.

Public Static Functions

static std::unique_ptr<PEB> peb()¶: Return an interface over the internal Process Environment Block (PEB).

static inline bool classof(const runtime::Process*)¶

PEB¶

class PEB¶

This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process.

An instance can be created through LIEF::runtime::windows::Process::peb().

if (auto peb = LIEF::runtime::windows::Process::peb()) {
  if (peb->being_debugged()) {
    // A debugger is attached to the current process
  }
}

Public Types

using entries_it = iterator_range<LdrDataTableEntry::Iterator>¶: Iterator over the LdrDataTableEntry referenced by the loader data.

Public Functions

PEB() = delete¶

PEB(const PEB&) = delete¶

PEB &operator=(const PEB&) = delete¶

PEB(PEB&&) noexcept¶

PEB &operator=(PEB&&) noexcept¶

bool being_debugged() const¶: Whether the current process is being debugged.

uintptr_t ldr() const¶: Address of the loader data structure (PEB_LDR_DATA).

uintptr_t process_parameters() const¶: Address of the process parameters (RTL_USER_PROCESS_PARAMETERS).

uintptr_t atl_thunk_slist_ptr() const¶: Address of the per-process ATL thunk SList (single-linked list).

uint32_t atl_thunk_slist_ptr32() const¶: 32-bit value of the ATL thunk SList pointer.

uintptr_t post_process_init_routine() const¶: Address of the routine called once the process completed its initialization (PostProcessInitRoutine).

uint32_t session_id() const¶: Session ID associated with the current process.

entries_it entries() const¶

Return a bidirectional iterator over the modules referenced by the loader data (Ldr).

if (auto peb = LIEF::runtime::windows::Process::peb()) {
  for (const LdrDataTableEntry& entry : peb->entries()) {
    // entry.base_dll_name(), entry.dll_base(), ...
  }
}

~PEB()¶

Friends

friend class Process

LdrDataTableEntry¶

class LdrDataTableEntry¶

This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process.

Public Functions

LdrDataTableEntry() = delete¶

LdrDataTableEntry(std::unique_ptr<details::ldr_entry> impl)¶

LdrDataTableEntry(const LdrDataTableEntry&) = delete¶

LdrDataTableEntry &operator=(const LdrDataTableEntry&) = delete¶

LdrDataTableEntry(LdrDataTableEntry&&) noexcept¶

LdrDataTableEntry &operator=(LdrDataTableEntry&&) noexcept¶

uintptr_t dll_base() const¶: Base address at which the module is mapped in memory (DllBase).

uintptr_t entry_point() const¶: Address of the entry point of the module (EntryPoint).

uint32_t size_of_image() const¶: Size (in bytes) of the module’s image in memory (SizeOfImage).

std::string full_dll_name() const¶: Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.

std::string base_dll_name() const¶: Base name of the module (BaseDllName), e.g. ntdll.dll.

uint32_t flags() const¶: Loader flags describing the state of the module (Flags).

uint16_t obsolete_load_count() const¶: Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and later.

uint16_t tls_index() const¶: TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).

uint32_t time_date_stamp() const¶: TimeDateStamp of the module as cached by the loader.

uintptr_t entry_point_activation_context() const¶: Address of the activation context associated with the module’s entry point.

uintptr_t lock() const¶: Address of the per-entry loader lock.

std::optional<uintptr_t> ddag_node() const¶: Address of the dependency-graph node of the module (DdagNode).

Note
Available on Windows 8 and later.

std::optional<uintptr_t> load_context() const¶: Address of the loader context used while the module is being snapped.

Note
Available on Windows 8 and later.

std::optional<uintptr_t> parent_dll_base() const¶: Base address of the module that triggered the load of this one.

Note
Available on Windows 8 and later.

std::optional<uintptr_t> switch_back_context() const¶: Address of the CHPE switch-back context.

Note
Available on Windows 8 and later.

std::optional<uintptr_t> original_base() const¶: Preferred base address recorded in the PE headers.

Note
Available on Windows 8 and later.

std::optional<int64_t> load_time() const¶: Time at which the module was loaded.

Note
Available on Windows 8 and later.

std::optional<uint32_t> base_name_hash_value() const¶: Hash of the module’s base name used to index the loader tables.

Note
Available on Windows 8 and later.

std::optional<int32_t> load_reason() const¶: Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.

Note
Available on Windows 8 and later.

std::optional<uint32_t> implicit_path_options() const¶: Path-search options implied when the module was resolved.

Note
Available on Windows 8 and later.

std::optional<uint32_t> reference_count() const¶: Number of references currently held on the module.

Note
Available on Windows 8 and later.

std::optional<uint32_t> dependent_load_flags() const¶: Flags controlling how the statically-linked dependencies of the module are loaded.

Note
Available on Windows 8 and later.

std::optional<uint8_t> signing_level() const¶: Signing level of the module’s image, as a SE_SIGNING_LEVEL value.

Note
Available on Windows 10 and later.

std::optional<uint32_t> check_sum() const¶: Image checksum cached by the loader.

Note
Available on Windows 10 and later.

std::optional<uintptr_t> active_patch_image_base() const¶: Base address of the active hot-patch image, if any.

Note
Available on Windows 11 and later.

std::optional<uint32_t> hot_patch_state() const¶: State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.

Note
Available on Windows 11 and later.

std::string to_string() const¶: Pretty-printed representation of this entry.

~LdrDataTableEntry()¶

Friends

inline friend std::ostream &operator<<(std::ostream &os, const LdrDataTableEntry &entry)¶

class Iterator : public LIEF::iterator_facade_base<Iterator, std::bidirectional_iterator_tag, LdrDataTableEntry, std::ptrdiff_t, const LdrDataTableEntry*, const LdrDataTableEntry&>¶

Bidirectional iterator over the LdrDataTableEntry mirroring the doubly-linked list used by Windows.

Public Types

using implementation = details::ldr_entry_it¶

Public Functions

Iterator()¶

Iterator(std::unique_ptr<details::ldr_entry_it> impl)¶

Iterator(const Iterator&)¶

Iterator &operator=(const Iterator&)¶

Iterator(Iterator&&) noexcept¶

Iterator &operator=(Iterator&&) noexcept¶

~Iterator()¶

Iterator &operator++()¶

Iterator &operator--()¶

const LdrDataTableEntry &operator*() const¶

const LdrDataTableEntry *operator->() const¶

std::unique_ptr<LdrDataTableEntry> yield()¶: Transfer ownership of the entry at the current position to the caller. Returns nullptr if the iterator is past-the-end.

inline DerivedT operator++(int)¶

inline DerivedT operator--(int)¶

Friends

friend bool operator==(const Iterator &LHS, const Iterator &RHS)¶

inline friend bool operator!=(const Iterator &LHS, const Iterator &RHS)¶

ARCH¶

enum class LIEF::runtime::ARCH : uint32_t¶

Values:

enumerator NONE¶

enumerator X86_64¶

enumerator ARM64¶

enumerator RISCV64¶

PLATFORMS¶

enum class LIEF::runtime::PLATFORMS : uint32_t¶

Values:

enumerator NONE = 0¶

enumerator LINUX¶

enumerator WINDOWS¶

enumerator ANDROID_¶

enumerator OSX¶

enumerator IOS¶