--- documentID: "dcb21aea2e98b1d6911a096db20ecfc07520ef1f2b4596ea86a4c337b8492e63" docname: "runtime/cpp" title: "Runtime C++ API - LIEF Documentation" description: "Runtime C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/runtime/cpp.html" markdownURL: "https://lief.re/doc/latest/runtime/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "3b45de75576df48592fc359b2e26271b8e640d413bc1e68d403ed9fe480991c0" --- # [C++]() ## [Utilities]() ### [` LIEF::runtime::is_enabled `]() static bool LIEF::runtime::is\_enabled() Whether the runtime features are enabled. ### [` LIEF::runtime::platform `]() static [PLATFORMS]( "LIEF::runtime::PLATFORMS") LIEF::runtime::platform() Platform for which the runtime is compiled. ### [` LIEF::runtime::arch `]() static [ARCH]( "LIEF::runtime::ARCH") LIEF::runtime::arch() Architecture for which the runtime is compiled. ### [` LIEF::runtime::modules `]() modules\_t LIEF::runtime::modules() Return an iterator over the different modules loaded in the current process. ### [` LIEF::runtime::assemble `]() std::vector<uint8\_t> LIEF::runtime::assemble(uint64\_t addr, const std::string &Asm, assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig") &config = assembly::[AssemblerConfig]( "LIEF::assembly::AssemblerConfig")::[default\_config]( "LIEF::assembly::AssemblerConfig::default_config")()) Assemble the provided assembly code at the specified (absolute) virtual address. The function returns the generated assembly bytes. ```cpp #include auto code = LIEF::runtime::assemble(0x7f0011223344, R"( xor rax, rbx; mov rcx, rax; )"); ``` If you need to configure the assembly engine or to define addresses for symbols, you can provide your own [assembly::AssemblerConfig]() instance. ### [` LIEF::runtime::disassemble `]() instructions\_it LIEF::runtime::disassemble(uintptr\_t addr) Start disassembling instructions at the given **absolute** virtual address. ```cpp for (const auto& inst : disassemble(0x7f0011223344)) { std::cout << inst.to_string() << '\n'; } ``` --- ## [Process]() ### [` Process `]() class Process This structure represents the current process and provides functions to query process-level information. Subclassed by [LIEF::runtime::Linux::Process](), [LIEF::runtime::android::Process](), [LIEF::runtime::osx::Process](), [LIEF::runtime::windows::Process]() Public Static Functions #### [` pid `]() static int32\_t pid() Get the [Process]() ID of the current process. #### [` tid `]() static uint32\_t tid() Get the Thread ID of the current thread. #### [` arch `]() static inline [ARCH]( "LIEF::runtime::ARCH") arch() Return the target architecture of the current process. #### [` platform `]() static inline [PLATFORMS]( "LIEF::runtime::PLATFORMS") platform() Return the target platform of the current process. #### [` page_size `]() static uint32\_t page\_size() Return the number of bytes in a memory page. For instance: - `0x1000` (4096 bytes) for x86\_64 - `0x4000` (16384 bytes) for ARM64 #### [` get_env `]() static std::optional<std::string> get\_env(const std::string &key) Return the environment variable associated with the given key. #### [` get_envs `]() static [EnvVars]( "LIEF::runtime::Process::EnvVars") get\_envs() Return the environment variables present in the current process. #### [` default_engine `]() static assembly::[Engine]( "LIEF::assembly::Engine") \*default\_engine() Return the assembler/disassembler for the current process. #### [` EnvVars `]() struct EnvVars This structure wraps environment variables. Public Functions ##### [` empty `]() inline bool empty() const Public Members ##### [` vars `]() std::unordered\_map<std::string, std::string> vars --- ## [Host]() ### [` Host `]() class Host This class represents the current host. Public Static Functions #### [` name `]() static std::string name() The machine hostname. #### [` home_dir `]() static std::string home\_dir() The user home dir (e.g. `/home/romain` or `C:\Users\romain`). #### [` tmp_dir `]() static std::string tmp\_dir() Temporary directory. This function looks at the environment variables to determine the suitable temp directory (e.g. `TEMP`, `TMPDIR`) #### [` config_dir `]() static std::string config\_dir() The directory to store user-specific configuration. #### [` cache_dir `]() static std::string cache\_dir() The directory where software should store their cache files (e.g. `$HOME/.cache`). --- ## [Module]() ### [` Module `]() class Module This class represents an in-memory module which can be an executable or a library. Subclassed by [LIEF::runtime::Linux::Module](), [LIEF::runtime::android::Module](), [LIEF::runtime::osx::Module](), [LIEF::runtime::windows::Module]() Public Functions #### [` Module `]() Module() = delete #### [` Module `]() Module(std::unique\_ptr<details::Module> impl) #### [` Module `]() Module(const [Module]( "LIEF::runtime::Module::Module")&) = delete #### [` operator= `]() [Module]( "LIEF::runtime::Module") &operator=(const [Module]( "LIEF::runtime::Module")&) = delete #### [` Module `]() Module([Module]( "LIEF::runtime::Module::Module")&&) noexcept #### [` operator= `]() [Module]( "LIEF::runtime::Module") &operator=([Module]( "LIEF::runtime::Module")&&) noexcept #### [` clone `]() virtual std::unique\_ptr<[Module]( "LIEF::runtime::Module")> clone() const #### [` imagebase `]() uint64\_t imagebase() const Base address where the module is loaded in memory. #### [` size `]() uint64\_t size() const Virtual size of the current module. #### [` end `]() inline uint64\_t end() const End address of the module. #### [` name `]() std::string name() const Name of the module (e.g. `libc.so.6, kernel32.dll, libsystem_c.dylib`). #### [` path `]() std::string path() const Path of the module. #### [` contains `]() inline bool contains(uintptr\_t addr) const Check if the current module contains the given address. #### [` dump `]() inline std::vector<uint8\_t> dump() const Return the content of the module as it is currently mapped in memory. The returned buffer spans [imagebase()]() over [size()]() bytes. An empty buffer is returned if the imagebase or the size is null. #### [` dump `]() inline std::vector<uint8\_t> dump(const std::string &filepath) const Same as [dump()]() but also writes the content into the file located at `filepath`. #### [` dump `]() inline std::vector<uint8\_t> dump(std::ostream &os) const Same as [dump()]() but also writes the content into the given output stream. #### [` to_string `]() std::string to\_string() const #### [` Tas `]() template<class T> inline const [T]( "LIEF::runtime::Module::as::T") \*as() const This function can be used to **downcast** a [Module]() instance. #### [` Tas `]() template<class T> inline [T]( "LIEF::runtime::Module::as::T") \*as() #### [` ~Module `]() virtual ~Module() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Module]( "LIEF::runtime::Module") &M) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::Module::Iterator"), std::forward\_iterator\_tag, [Module]( "LIEF::runtime::Module"), std::ptrdiff\_t, const [Module]( "LIEF::runtime::Module")\*, const [Module]( "LIEF::runtime::Module")&> Public Types ##### [` implementation `]() using implementation = details::ModuleIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::Module::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator=(const [Iterator]( "LIEF::runtime::Module::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::Module::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator=([Iterator]( "LIEF::runtime::Module::Iterator")&&) noexcept ##### [` Iterator `]() Iterator(std::unique\_ptr<details::ModuleIt> impl) ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::runtime::Module::Iterator") &operator++() ##### [` operator* `]() const [Module]( "LIEF::runtime::Module") &operator\*() const ##### [` operator-> `]() const [Module]( "LIEF::runtime::Module") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Module]( "LIEF::runtime::Module")> yield() Transfer ownership of the module at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::Module::Iterator") &LHS, const [Iterator]( "LIEF::runtime::Module::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::Module::Iterator") &LHS, const [Iterator]( "LIEF::runtime::Module::Iterator") &RHS) ### [` LIEF::runtime::module_from_name `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_name(const std::string &name) Find the module with the given name. ### [` LIEF::runtime::module_from_path `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_path(const std::string &path) Find the module with the given path. ### [` LIEF::runtime::module_from_addr `]() inline std::unique\_ptr<[Module]( "LIEF::runtime::Module")> LIEF::runtime::module\_from\_addr(uintptr\_t addr) Find the module that encompasses the given virtual address (absolute). --- ## [Memory]() ### [` Memory `]() class Memory This class exposes API to access and manage memory. Public Types #### [` MMAP_FLAGS `]() enum MMAP\_FLAGS Flags used when creating a memory map (mmap). *Values:* ##### [` MP_NONE `]() enumerator MP\_NONE = 0 ##### [` MP_PRIVATE `]() enumerator MP\_PRIVATE = 1 << 0 Changes are private to this process (copy-on-write). ##### [` MP_ANONYMOUS `]() enumerator MP\_ANONYMOUS = 1 << 1 The mapping is not backed by any file. ##### [` MP_SHARED `]() enumerator MP\_SHARED = 1 << 2 Changes are shared. ##### [` MP_FIXED `]() enumerator MP\_FIXED = 1 << 3 Interpret the address as a fixed requirement. ##### [` MP_JIT `]() enumerator MP\_JIT = 1 << 4 Map for Just-In-Time code generation. #### [` PERM `]() enum PERM *Values:* ##### [` P_NONE `]() enumerator P\_NONE = 0 ##### [` P_READ `]() enumerator P\_READ = 1 << 0 ##### [` P_WRITE `]() enumerator P\_WRITE = 1 << 1 ##### [` P_EXEC `]() enumerator P\_EXEC = 1 << 2 Public Static Functions #### [` mmap `]() static std::optional<[Chunk]( "LIEF::runtime::Memory::Chunk")> mmap(size\_t size, uint32\_t flags, uint32\_t permissions = [P\_NONE]( "LIEF::runtime::Memory::P_NONE")) Allocate a memory chunk through mmap-like function. #### [` mmap_hint `]() static std::optional<[Chunk]( "LIEF::runtime::Memory::Chunk")> mmap\_hint(uint64\_t hint, size\_t size, uint32\_t flags, uint32\_t permissions = [P\_NONE]( "LIEF::runtime::Memory::P_NONE")) Allocate a memory chunk through mmap-like function and place the allocation at or near the address given in the first parameter. This address is a **hint**: it is rounded up to the next page boundary (next allocation granularity on Windows) and the system remains free to return a chunk located somewhere else. #### [` munmap `]() static [ok\_error\_t]( "LIEF::ok_error_t") munmap([Chunk]( "LIEF::runtime::Memory::Chunk") &C) Deallocate a mmaped memory chunk. #### [` mprotect `]() static [ok\_error\_t]( "LIEF::ok_error_t") mprotect([Chunk]( "LIEF::runtime::Memory::Chunk") &C, uint32\_t flags) Sets the permission of the given memory chunk. #### [` write `]() static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const uint8\_t \*buffer, size\_t size, uintptr\_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by `addr` has the correct permission to write this buffer. #### [` write `]() static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const std::vector<uint8\_t> &buffer, uintptr\_t addr) Write the buffer at the address given in the third parameter. This function assumes that the memory pointed by `addr` has the correct permission to write this buffer. #### [` Twrite `]() template<class T, typename = std::enable\_if\_t<std::is\_standard\_layout\_v<[T]( "LIEF::runtime::Memory::write::T")> && std::is\_trivial\_v<[T]( "LIEF::runtime::Memory::write::T")>>> static inline [ok\_error\_t]( "LIEF::ok_error_t") write(const [T]( "LIEF::runtime::Memory::write::T") &value, uintptr\_t addr) Generic function to write a typed value. #### [` Tread `]() template<class T> static inline [T]( "LIEF::runtime::Memory::read::T") read(uintptr\_t addr) Generic function to read a typed value. #### [` read `]() static inline void read(uintptr\_t addr, std::vector<uint8\_t> &out, size\_t size) Read the content at the address pointed by the first parameter and write the result in the `std::vector` provided in the second parameter. #### [` read `]() static inline void read(uintptr\_t addr, uint8\_t \*out, size\_t size) Read the content at the address pointed by the first parameter and write the result in the buffer provided in the second parameter. This function assumes that the buffer in the second parameter is large enough to contain the data being read. #### [` perm_str `]() static std::string perm\_str(uint32\_t flags) #### [` support_rwx `]() static inline bool support\_rwx() #### [` Chunk `]() class Chunk Represents a contiguous chunk of memory allocated or inspected by the runtime. Public Functions ##### [` Chunk `]() inline Chunk(void \*addr, size\_t size, uint32\_t permissions) ##### [` Chunk `]() inline Chunk(void \*addr, size\_t size) ##### [` Chunk `]() inline Chunk(void \*addr) ##### [` addr_ptr `]() inline void \*addr\_ptr() Returns the start address of the memory chunk as an opaque pointer. ##### [` addr_ptr `]() inline const void \*addr\_ptr() const ##### [` addr `]() inline uintptr\_t addr() const Returns the start address of the memory chunk. ##### [` size `]() inline size\_t size() const Returns the size of the memory chunk in bytes. ##### [` permissions `]() inline uint32\_t permissions() const Returns the current permissions of the memory chunk. ##### [` page_start `]() uintptr\_t page\_start() const Returns the address of the start of the page containing this chunk. ##### [` page_end `]() uintptr\_t page\_end() const Returns the address of the end of the page containing this chunk. ##### [` change_permissions `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &change\_permissions(uint32\_t p) Changes the permissions of the memory chunk. ##### [` make_x `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_x() Sets the permissions to Execute only. ##### [` make_rw `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rw() Sets the permissions to Read and Write. ##### [` make_rx `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rx() Sets the permissions to Read and Execute. ##### [` make_rwx `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_rwx() Sets the permissions to Read, Write, and Execute. ##### [` make_ro `]() inline [Chunk]( "LIEF::runtime::Memory::Chunk") &make\_ro() Sets the permissions to Read Only. ##### [` cache_flush `]() [Chunk]( "LIEF::runtime::Memory::Chunk") &cache\_flush() Flushes the instruction cache for this memory chunk. This should be used when modifying code in memory (e.g., hooking, JIT). ##### [` is_valid `]() inline bool is\_valid() const Check if this chunk is valid. ##### [` operator bool `]() inline operator bool() const ##### [` deallocate `]() inline [ok\_error\_t]( "LIEF::ok_error_t") deallocate() ##### [` to_string `]() std::string to\_string() const Friends **friend class Memory** ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Chunk]( "LIEF::runtime::Memory::Chunk") &C) #### [` ScopedPermissions `]() class ScopedPermissions RAII interface to change the permission within a determined scope. Public Functions ##### [` ScopedPermissions `]() inline explicit ScopedPermissions([Chunk]( "LIEF::runtime::Memory::Chunk") &chunk, uint32\_t perms) ##### [` ~ScopedPermissions `]() inline ~ScopedPermissions() --- ## [MemoryLayout]() ### [` MemoryLayout `]() class MemoryLayout This class exposes the memory layout of the current process. #### [` Region `]() class Region A contiguous range of memory mapped in the current process. Public Functions ##### [` Region `]() Region() = default ##### [` Region `]() inline Region(std::string name, uint64\_t addr, uint64\_t size) ##### [` Region `]() Region(const [Region]( "LIEF::runtime::MemoryLayout::Region::Region")&) = default ##### [` operator= `]() [Region]( "LIEF::runtime::MemoryLayout::Region") &operator=(const [Region]( "LIEF::runtime::MemoryLayout::Region")&) = default ##### [` Region `]() Region([Region]( "LIEF::runtime::MemoryLayout::Region::Region")&&) noexcept = default ##### [` operator= `]() [Region]( "LIEF::runtime::MemoryLayout::Region") &operator=([Region]( "LIEF::runtime::MemoryLayout::Region")&&) noexcept = default ##### [` ~Region `]() ~Region() = default ##### [` name `]() inline std::string\_view name() const Name associated with the region: name/path of the module mapped at this address (e.g. `libc.so.6`) or the identifier of a region that is not backed by a file (e.g. `[stack]`, `[heap]`). It can be empty for anonymous regions. ##### [` addr `]() inline uint64\_t addr() const Address at which the region starts. ##### [` size `]() inline uint64\_t size() const Size of the region. ##### [` end_addr `]() inline uint64\_t end\_addr() const Address at which the region ends. ##### [` contains `]() inline bool contains(uint64\_t addr) const Whether the given address is within this region. ##### [` to_string `]() std::string to\_string() const Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Region]( "LIEF::runtime::MemoryLayout::Region") &region) #### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::MemoryLayout::Iterator"), std::forward\_iterator\_tag, [Region]( "LIEF::runtime::MemoryLayout::Region"), std::ptrdiff\_t, const [Region]( "LIEF::runtime::MemoryLayout::Region")\*, const [Region]( "LIEF::runtime::MemoryLayout::Region")&> Forward iterator over the regions of the memory layout. Public Types ##### [` implementation `]() using implementation = details::MemoryLayoutIt Public Functions ##### [` Iterator `]() Iterator() ##### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator::Iterator")&) ##### [` operator= `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator=(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator")&) ##### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::MemoryLayout::Iterator::Iterator")&&) noexcept ##### [` operator= `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator=([Iterator]( "LIEF::runtime::MemoryLayout::Iterator")&&) noexcept ##### [` Iterator `]() Iterator(std::unique\_ptr<details::MemoryLayoutIt> impl) ##### [` ~Iterator `]() ~Iterator() ##### [` operator++ `]() [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &operator++() ##### [` operator* `]() const [Region]( "LIEF::runtime::MemoryLayout::Region") &operator\*() const ##### [` operator-> `]() const [Region]( "LIEF::runtime::MemoryLayout::Region") \*operator->() const ##### [` yield `]() std::unique\_ptr<[Region]( "LIEF::runtime::MemoryLayout::Region")> yield() Transfer ownership of the region at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ##### [` operator++ `]() inline DerivedT operator++(int) Friends ##### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &LHS, const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &RHS) ##### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &LHS, const [Iterator]( "LIEF::runtime::MemoryLayout::Iterator") &RHS) ### [` LIEF::runtime::memory_layout `]() memory\_layout\_it LIEF::runtime::memory\_layout() Return an iterator over the memory layout of the current process. --- ## [Linux]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes a Linux-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path() const Parse the ELF module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory() const Parse the ELF module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::Linux::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::Linux::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::Linux::Module")> from\_handle(void \*H) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::Linux::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::Linux::Module")> LIEF::runtime::Linux::dlopen(const std::string &name) Load the library with the given path/name. --- ### [Host]() #### [` Host `]() class Host This class exposes Linux-specific host information. Public Static Functions ##### [` sys_name `]() static std::string sys\_name() Operating system name (e.g., `Linux`). ##### [` sys_release `]() static std::string sys\_release() Operating system release (e.g., `2.6.28`). ##### [` sys_version `]() static std::string sys\_version() Operating system version. ##### [` hardware `]() static std::string hardware() Hardware type identifier (e.g., `x86_64`). --- ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Linux-specific API for the current process. Public Static Functions ##### [` cmdline `]() static std::string cmdline() Return the content of `/proc/cmdline`. ##### [` glibc_version `]() static std::string glibc\_version() Return the version of the GNU C Library (glibc) loaded in the current process (e.g. `2.39`). Return an empty string if the version cannot be determined. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) --- ## [Android]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes Android-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the dlopen handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol from with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path() const Parse the ELF module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_path(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory(const ELF::[ParserConfig]( "LIEF::ELF::ParserConfig") &config) const Parse the ELF module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<ELF::[Binary]( "LIEF::ELF::Binary")> parse\_from\_memory() const Parse the ELF module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::android::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::android::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::android::Module")> from\_handle(void \*H) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::android::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::android::Module")> LIEF::runtime::android::dlopen(const std::string &name) Load the library with the given path/name. --- ### [Host]() #### [` Host `]() class Host This class exposes Android-specific host information. Public Static Functions ##### [` sdk_version `]() static std::optional<uint32\_t> sdk\_version() Return the Android SDK/API level of the device (e.g. `34` for Android 14). --- ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Android-specific API for the current process. Public Types ##### [` properties_t `]() using properties\_t = std::vector<[Property]( "LIEF::runtime::android::Property")> Public Static Functions ##### [` cmdline `]() static std::string cmdline() Return the content of `/proc/cmdline`. ##### [` get_system_property `]() static std::optional<[Property]( "LIEF::runtime::android::Property")> get\_system\_property(const std::string &name) Return the value of the Android system property with the given `name` (e.g. `ro.build.version.sdk`). ##### [` properties `]() static [properties\_t]( "LIEF::runtime::android::Process::properties_t") properties() Get all the system properties. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) ### [Property]() #### [` Property `]() class Property This class represents an Android property such as `ro.boot.hardware`. Public Functions ##### [` Property `]() Property() = default ##### [` Property `]() inline Property(std::string name, std::string value, uint32\_t serial) ##### [` Property `]() Property(const [Property]( "LIEF::runtime::android::Property::Property")&) = default ##### [` operator= `]() [Property]( "LIEF::runtime::android::Property") &operator=(const [Property]( "LIEF::runtime::android::Property")&) = default ##### [` Property `]() Property([Property]( "LIEF::runtime::android::Property::Property")&&) noexcept = default ##### [` operator= `]() [Property]( "LIEF::runtime::android::Property") &operator=([Property]( "LIEF::runtime::android::Property")&&) noexcept = default ##### [` ~Property `]() ~Property() = default ##### [` name `]() inline std::string\_view name() const Name of the property (e.g. `ro.boot.hardware`). ##### [` value `]() inline std::string\_view value() const Value associated with the property. ##### [` serial `]() inline uint32\_t serial() const Serial number of the property. It is incremented each time the property is updated and can therefore be used to detect changes. ##### [` to_string `]() std::string to\_string() const Pretty representation of the property. Public Static Functions ##### [` create_from `]() static [Property]( "LIEF::runtime::android::Property") create\_from(const prop\_info &pi) Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Property]( "LIEF::runtime::android::Property") &prop) --- ## [macOS]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes an OSX-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the `dlopen` handle for this library. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_path() const Parse the Mach-O module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_path(const MachO::[ParserConfig]( "LIEF::MachO::ParserConfig") &config) const Parse the Mach-O module from its path on the filesystem with the given parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_memory() const Parse the Mach-O module from memory. ##### [` parse_from_memory `]() std::unique\_ptr<MachO::[Binary]( "LIEF::MachO::Binary")> parse\_from\_memory(const MachO::[ParserConfig]( "LIEF::MachO::ParserConfig") &config) const Parse the Mach-O module from memory with the given configuration. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::osx::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::osx::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::osx::Module")> from\_handle(void \*handle) Instantiate a [Module]() from the given `dlopen` handle. ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::osx::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::osx::Module")> LIEF::runtime::osx::dlopen(const std::string &name) Load the library with the given path or name. ### [Host]() #### [` Host `]() class Host Public Static Functions ##### [` os_version_name `]() static std::string os\_version\_name() The OS version string (e.g. `Version 26.2 (Build 25C56)`). ##### [` os_version `]() static [version\_t]( "LIEF::runtime::osx::Host::version_t") os\_version() The OS version (e.g. `13.0.0`). ##### [` is_sip_enabled `]() static bool is\_sip\_enabled() Whether System Integrity Protection (SIP) is enabled on this host. This conservatively returns `true` when the status can’t be determined (including on a non-macOS build). ##### [` version_t `]() struct version\_t Public Functions ###### [` version_t `]() inline version\_t(uint32\_t major, uint32\_t minor, uint32\_t patch) ###### [` operator<= `]() bool operator<=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator> `]() inline bool operator>(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator>= `]() bool operator>=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator< `]() inline bool operator<(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &rhs) const ###### [` operator== `]() bool operator==(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &other) const ###### [` operator!= `]() inline bool operator!=(const [version\_t]( "LIEF::runtime::osx::Host::version_t") &other) const ###### [` to_string `]() std::string to\_string() const Public Members ###### [` major `]() uint32\_t major = 0 ###### [` minor `]() uint32\_t minor = 0 ###### [` patch `]() uint32\_t patch = 0 Public Static Functions ###### [` BigSur `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &BigSur() ###### [` Monterey `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Monterey() ###### [` Ventura `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Ventura() ###### [` Sonoma `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Sonoma() ###### [` Sequoia `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Sequoia() ###### [` Tahoe `]() static const [version\_t]( "LIEF::runtime::osx::Host::version_t") &Tahoe() Friends ###### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [version\_t]( "LIEF::runtime::osx::Host::version_t") version) ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes OSX-specific API for the current process. Public Static Functions ##### [` dyld_version `]() static std::string dyld\_version() Return the version of dyld for the current process. ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) --- ## [Windows]() ### [Module]() #### [` Module `]() class Module : public LIEF::runtime::[Module]( "LIEF::runtime::Module") This class exposes a Windows-specific API for a module. Public Functions ##### [` handle `]() void \*handle() const Return the `HMODULE` handle as an opaque pointer. Return a nullptr if the function fails or if the handler can’t be found ##### [` dlsym `]() void \*dlsym(const std::string &name) const Resolve the symbol with the given name for the current module. ##### [` parse_from_path `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_path() const Parse the PE module from its path on the filesystem. ##### [` parse_from_path `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_path(const PE::[ParserConfig]( "LIEF::PE::ParserConfig") &config) const Parse the PE module from its path on the filesystem and given the parser configuration. ##### [` parse_from_memory `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(const PE::[ParserConfig]( "LIEF::PE::ParserConfig") &config) const Parse the PE module from memory with the given configuration. ##### [` parse_from_memory `]() std::unique\_ptr<PE::[Binary]( "LIEF::PE::Binary")> parse\_from\_memory() const Parse the PE module from memory. ##### [` ~Module `]() virtual ~Module() override = default ##### [` Module `]() Module() = delete ##### [` Module `]() Module(std::unique\_ptr<details::Module> impl) ##### [` Module `]() Module(const [Module]( "LIEF::runtime::windows::Module::Module")&) = delete ##### [` Module `]() Module([Module]( "LIEF::runtime::windows::Module::Module")&&) noexcept Public Static Functions ##### [` from_handle `]() static std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> from\_handle(void \*H) ##### [` classof `]() static inline bool classof(const runtime::[Module]( "LIEF::runtime::Module")\*) #### [` LIEF::runtime::windows::dlopen `]() std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> LIEF::runtime::windows::dlopen(const std::string &name) Load the windows library with the given path or name. #### [` LIEF::runtime::windows::find_module `]() std::unique\_ptr<[Module]( "LIEF::runtime::windows::Module")> LIEF::runtime::windows::find\_module(const std::string &name) Try to get the [Module]() with the given name. Return a nullptr if the module is not found ```cpp if (auto ntdll = find_module("ntdll.dll")) { std::cout << ntdll->path() << '\n'; } ``` > **Note** > > This function relies on the Windows API `GetModuleHandle` which is more efficient than the generic implementation [LIEF::runtime::module\_from\_name]() ### [Host]() #### [` Host `]() class Host This class exposes Windows-specific host information. Public Static Functions ##### [` version `]() static [version\_t]( "LIEF::runtime::windows::Host::version_t") version() Return the Windows version (e.g., `10.0.26200`). ##### [` version_t `]() struct version\_t Public Functions ###### [` version_t `]() version\_t() = default ###### [` version_t `]() inline version\_t(uint32\_t major, uint32\_t minor, uint32\_t build\_number) ###### [` operator<= `]() bool operator<=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator> `]() inline bool operator>(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator>= `]() bool operator>=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator< `]() inline bool operator<(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &rhs) const ###### [` operator== `]() bool operator==(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &other) const ###### [` operator!= `]() inline bool operator!=(const [version\_t]( "LIEF::runtime::windows::Host::version_t") &other) const ###### [` to_string `]() std::string to\_string() const Public Members ###### [` major `]() uint32\_t major = 0 ###### [` minor `]() uint32\_t minor = 0 ###### [` build_number `]() uint32\_t build\_number = 0 Friends ###### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [version\_t]( "LIEF::runtime::windows::Host::version_t") &version) ### [Injector]() #### [` injection_context_t `]() struct injection\_context\_t Describes how to spawn a new process and inject a library into it. Public Functions ##### [` validate `]() bool validate() const Check whether the context is consistent (required paths filled-in and readable). ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` target_path `]() std::string target\_path Absolute path to the target executable to spawn. ##### [` args `]() std::string args Command-line arguments passed to the spawned process. ##### [` library `]() std::string library Absolute path to the library (DLL) that should be injected. ##### [` env `]() std::unordered\_map<std::string, std::string> env Environment variables to set in the spawned process. If left empty, the current process environment is inherited. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [injection\_context\_t]( "LIEF::runtime::windows::injection_context_t") &ctx) #### [` LIEF::runtime::windows::inject_spawn `]() [ok\_error\_t]( "LIEF::ok_error_t") LIEF::runtime::windows::inject\_spawn(const [injection\_context\_t]( "LIEF::runtime::windows::injection_context_t") &ctx) Spawn the target described by the given injection context and inject the associated library before the main thread starts executing. This is the Windows equivalent of a “create suspended + remote LoadLibrary” approach. ### [Process]() #### [` Process `]() class Process : public LIEF::runtime::[Process]( "LIEF::runtime::Process") This class exposes Windows-specific API for the current process. Public Static Functions ##### [` peb `]() static std::unique\_ptr<[PEB]( "LIEF::runtime::windows::PEB")> peb() Return an interface over the internal [Process]() Environment Block ([PEB]()). ##### [` classof `]() static inline bool classof(const runtime::[Process]( "LIEF::runtime::Process")\*) ### [PEB]() #### [` PEB `]() class PEB This class exposes a user-friendly interface over the [Process]() Environment Block ([PEB]()) of the current process. An instance can be created through [LIEF::runtime::windows::Process::peb()](). ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { if (peb->being_debugged()) { // A debugger is attached to the current process } } ``` Public Types ##### [` entries_it `]() using entries\_it = [iterator\_range]( "LIEF::iterator_range")<[LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")::[Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")> Iterator over the [LdrDataTableEntry]() referenced by the loader data. Public Functions ##### [` PEB `]() PEB() = delete ##### [` PEB `]() PEB(const [PEB]( "LIEF::runtime::windows::PEB::PEB")&) = delete ##### [` operator= `]() [PEB]( "LIEF::runtime::windows::PEB") &operator=(const [PEB]( "LIEF::runtime::windows::PEB")&) = delete ##### [` PEB `]() PEB([PEB]( "LIEF::runtime::windows::PEB::PEB")&&) noexcept ##### [` operator= `]() [PEB]( "LIEF::runtime::windows::PEB") &operator=([PEB]( "LIEF::runtime::windows::PEB")&&) noexcept ##### [` being_debugged `]() bool being\_debugged() const Whether the current process is being debugged. ##### [` ldr `]() uintptr\_t ldr() const Address of the loader data structure (`PEB_LDR_DATA`). ##### [` process_parameters `]() uintptr\_t process\_parameters() const Address of the process parameters (`RTL_USER_PROCESS_PARAMETERS`). ##### [` atl_thunk_slist_ptr `]() uintptr\_t atl\_thunk\_slist\_ptr() const Address of the per-process ATL thunk SList (single-linked list). ##### [` atl_thunk_slist_ptr32 `]() uint32\_t atl\_thunk\_slist\_ptr32() const 32-bit value of the ATL thunk SList pointer. ##### [` post_process_init_routine `]() uintptr\_t post\_process\_init\_routine() const Address of the routine called once the process completed its initialization (`PostProcessInitRoutine`). ##### [` session_id `]() uint32\_t session\_id() const Session ID associated with the current process. ##### [` entries `]() [entries\_it]( "LIEF::runtime::windows::PEB::entries_it") entries() const Return a bidirectional iterator over the modules referenced by the loader data (`Ldr`). ```cpp if (auto peb = LIEF::runtime::windows::Process::peb()) { for (const LdrDataTableEntry& entry : peb->entries()) { // entry.base_dll_name(), entry.dll_base(), ... } } ``` ##### [` ~PEB `]() ~PEB() Friends **friend class Process** ### [LdrDataTableEntry]() #### [` LdrDataTableEntry `]() class LdrDataTableEntry This class exposes a user-friendly interface over a `LDR_DATA_TABLE_ENTRY`, the structure used by the Windows loader to describe a module loaded in the current process. Public Functions ##### [` LdrDataTableEntry `]() LdrDataTableEntry() = delete ##### [` LdrDataTableEntry `]() LdrDataTableEntry(std::unique\_ptr<details::ldr\_entry> impl) ##### [` LdrDataTableEntry `]() LdrDataTableEntry(const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry")&) = delete ##### [` operator= `]() [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator=(const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&) = delete ##### [` LdrDataTableEntry `]() LdrDataTableEntry([LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry")&&) noexcept ##### [` operator= `]() [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator=([LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&&) noexcept ##### [` dll_base `]() uintptr\_t dll\_base() const Base address at which the module is mapped in memory (`DllBase`). ##### [` entry_point `]() uintptr\_t entry\_point() const Address of the entry point of the module (`EntryPoint`). ##### [` size_of_image `]() uint32\_t size\_of\_image() const Size (in bytes) of the module’s image in memory (`SizeOfImage`). ##### [` full_dll_name `]() std::string full\_dll\_name() const Full path of the module (`FullDllName`), e.g. `C:\Windows\System32\ntdll.dll`. ##### [` base_dll_name `]() std::string base\_dll\_name() const Base name of the module (`BaseDllName`), e.g. `ntdll.dll`. ##### [` flags `]() uint32\_t flags() const Loader flags describing the state of the module (`Flags`). ##### [` obsolete_load_count `]() uint16\_t obsolete\_load\_count() const Legacy load count of the module (`ObsoleteLoadCount`). Superseded by `reference_count()` on Windows 8 and later. ##### [` tls_index `]() uint16\_t tls\_index() const TLS slot index assigned to the module, or `0` when it has no TLS (`TlsIndex`). ##### [` time_date_stamp `]() uint32\_t time\_date\_stamp() const `TimeDateStamp` of the module as cached by the loader. ##### [` entry_point_activation_context `]() uintptr\_t entry\_point\_activation\_context() const Address of the activation context associated with the module’s entry point. ##### [` lock `]() uintptr\_t lock() const Address of the per-entry loader lock. ##### [` ddag_node `]() std::optional<uintptr\_t> ddag\_node() const Address of the dependency-graph node of the module (`DdagNode`). > **Note** > > Available on Windows 8 and later. ##### [` load_context `]() std::optional<uintptr\_t> load\_context() const Address of the loader context used while the module is being snapped. > **Note** > > Available on Windows 8 and later. ##### [` parent_dll_base `]() std::optional<uintptr\_t> parent\_dll\_base() const Base address of the module that triggered the load of this one. > **Note** > > Available on Windows 8 and later. ##### [` switch_back_context `]() std::optional<uintptr\_t> switch\_back\_context() const Address of the CHPE switch-back context. > **Note** > > Available on Windows 8 and later. ##### [` original_base `]() std::optional<uintptr\_t> original\_base() const Preferred base address recorded in the PE headers. > **Note** > > Available on Windows 8 and later. ##### [` load_time `]() std::optional<int64\_t> load\_time() const Time at which the module was loaded. > **Note** > > Available on Windows 8 and later. ##### [` base_name_hash_value `]() std::optional<uint32\_t> base\_name\_hash\_value() const Hash of the module’s base name used to index the loader tables. > **Note** > > Available on Windows 8 and later. ##### [` load_reason `]() std::optional<int32\_t> load\_reason() const Reason why the module was loaded, as a `LDR_DLL_LOAD_REASON` value. > **Note** > > Available on Windows 8 and later. ##### [` implicit_path_options `]() std::optional<uint32\_t> implicit\_path\_options() const Path-search options implied when the module was resolved. > **Note** > > Available on Windows 8 and later. ##### [` reference_count `]() std::optional<uint32\_t> reference\_count() const Number of references currently held on the module. > **Note** > > Available on Windows 8 and later. ##### [` dependent_load_flags `]() std::optional<uint32\_t> dependent\_load\_flags() const Flags controlling how the statically-linked dependencies of the module are loaded. > **Note** > > Available on Windows 8 and later. ##### [` signing_level `]() std::optional<uint8\_t> signing\_level() const Signing level of the module’s image, as a `SE_SIGNING_LEVEL` value. > **Note** > > Available on Windows 10 and later. ##### [` check_sum `]() std::optional<uint32\_t> check\_sum() const Image checksum cached by the loader. > **Note** > > Available on Windows 10 and later. ##### [` active_patch_image_base `]() std::optional<uintptr\_t> active\_patch\_image\_base() const Base address of the active hot-patch image, if any. > **Note** > > Available on Windows 11 and later. ##### [` hot_patch_state `]() std::optional<uint32\_t> hot\_patch\_state() const State of the hot-patch engine for this module, as a `LDR_HOT_PATCH_STATE` value. > **Note** > > Available on Windows 11 and later. ##### [` to_string `]() std::string to\_string() const Pretty-printed representation of this entry. ##### [` ~LdrDataTableEntry `]() ~LdrDataTableEntry() Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &entry) ##### [` Iterator `]() class Iterator : public LIEF::iterator\_facade\_base<[Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator"), std::bidirectional\_iterator\_tag, [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry"), std::ptrdiff\_t, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")\*, const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")&> Bidirectional iterator over the [LdrDataTableEntry]() mirroring the doubly-linked list used by Windows. Public Types ###### [` implementation `]() using implementation = details::ldr\_entry\_it Public Functions ###### [` Iterator `]() Iterator() ###### [` Iterator `]() Iterator(std::unique\_ptr<details::ldr\_entry\_it> impl) ###### [` Iterator `]() Iterator(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator::Iterator")&) ###### [` operator= `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator=(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")&) ###### [` Iterator `]() Iterator([Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator::Iterator")&&) noexcept ###### [` operator= `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator=([Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator")&&) noexcept ###### [` ~Iterator `]() ~Iterator() ###### [` operator++ `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator++() ###### [` operator-- `]() [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &operator--() ###### [` operator* `]() const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") &operator\*() const ###### [` operator-> `]() const [LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry") \*operator->() const ###### [` yield `]() std::unique\_ptr<[LdrDataTableEntry]( "LIEF::runtime::windows::LdrDataTableEntry")> yield() Transfer ownership of the entry at the current position to the caller. Returns `nullptr` if the iterator is past-the-end. ###### [` operator++ `]() inline DerivedT operator++(int) ###### [` operator-- `]() inline DerivedT operator--(int) Friends ###### [` operator== `]() friend bool operator==(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &LHS, const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &RHS) ###### [` operator!= `]() inline friend bool operator!=(const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &LHS, const [Iterator]( "LIEF::runtime::windows::LdrDataTableEntry::Iterator") &RHS) --- ## [ARCH]() ### [` LIEF::runtime::ARCH `]() enum class LIEF::runtime::ARCH : uint32\_t *Values:* #### [` NONE `]() enumerator NONE #### [` X86_64 `]() enumerator X86\_64 #### [` ARM64 `]() enumerator ARM64 #### [` RISCV64 `]() enumerator RISCV64 ## [PLATFORMS]() ### [` LIEF::runtime::PLATFORMS `]() enum class LIEF::runtime::PLATFORMS : uint32\_t *Values:* #### [` NONE `]() enumerator NONE = 0 #### [` LINUX `]() enumerator LINUX #### [` WINDOWS `]() enumerator WINDOWS #### [` ANDROID_ `]() enumerator ANDROID\_ #### [` OSX `]() enumerator OSX #### [` IOS `]() enumerator IOS