LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
LdrDataTableEntry.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_RUNTIME_WINDOWS_LDR_DATA_TABLE_ENTRY_H
17#define LIEF_RUNTIME_WINDOWS_LDR_DATA_TABLE_ENTRY_H
18#include <cstdint>
19#include <memory>
20#include <ostream>
21#include <string>
22
23#include <LIEF/visibility.h>
25#include <LIEF/iterators.hpp>
26#include <LIEF/optional.hpp>
27
28namespace LIEF {
29namespace runtime {
30namespace windows {
31
32namespace details {
33class ldr_entry;
34class ldr_entry_it;
35}
36
41 public:
44 class Iterator final
45 : public iterator_facade_base<Iterator, std::bidirectional_iterator_tag,
46 LdrDataTableEntry, std::ptrdiff_t,
47 const LdrDataTableEntry*,
48 const LdrDataTableEntry&> {
49 public:
50 using implementation = details::ldr_entry_it;
51 using iterator_facade_base::operator++;
52 using iterator_facade_base::operator--;
53
55
56 LIEF_API Iterator(std::unique_ptr<details::ldr_entry_it> impl);
57
60
62 LIEF_API Iterator& operator=(Iterator&&) noexcept;
63
65
66 friend LIEF_API bool operator==(const Iterator& LHS, const Iterator& RHS);
67 friend bool operator!=(const Iterator& LHS, const Iterator& RHS) {
68 return !(LHS == RHS);
69 }
70
71 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
73
74 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
76
78
79 // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
81
84 LIEF_API std::unique_ptr<LdrDataTableEntry> yield();
85
86 private:
87 void load() const;
88
89 std::unique_ptr<details::ldr_entry_it> impl_;
90 mutable std::unique_ptr<LdrDataTableEntry> cached_;
91 };
92
94 LdrDataTableEntry(std::unique_ptr<details::ldr_entry> impl);
95
97 LdrDataTableEntry& operator=(const LdrDataTableEntry&) = delete;
98
100 LdrDataTableEntry& operator=(LdrDataTableEntry&&) noexcept;
101
103 uintptr_t dll_base() const;
104
106 uintptr_t entry_point() const;
107
109 uint32_t size_of_image() const;
110
113 std::string full_dll_name() const;
114
116 std::string base_dll_name() const;
117
119 uint32_t flags() const;
120
123 uint16_t obsolete_load_count() const;
124
127 uint16_t tls_index() const;
128
130 uint32_t time_date_stamp() const;
131
135
137 uintptr_t lock() const;
138
142 optional<uintptr_t> ddag_node() const;
143
147 optional<uintptr_t> load_context() const;
148
152 optional<uintptr_t> parent_dll_base() const;
153
157 optional<uintptr_t> switch_back_context() const;
158
162 optional<uintptr_t> original_base() const;
163
167 optional<int64_t> load_time() const;
168
173
177 optional<int32_t> load_reason() const;
178
183
187 optional<uint32_t> reference_count() const;
188
194
198 optional<uint8_t> signing_level() const;
199
203 optional<uint32_t> check_sum() const;
204
209
214 optional<uint32_t> hot_patch_state() const;
215
217 std::string to_string() const;
218
219 LIEF_API friend std::ostream& operator<<(std::ostream& os,
220 const LdrDataTableEntry& entry) {
221 os << entry.to_string();
222 return os;
223 }
224
226
227 private:
228 std::unique_ptr<details::ldr_entry> impl_;
229};
230
231}
232}
233}
234#endif
CRTP base class which implements the entire standard iterator facade in terms of a minimal subset of ...
Definition iterators.hpp:750
Definition optional.hpp:23
Iterator(std::unique_ptr< details::ldr_entry_it > impl)
details::ldr_entry_it implementation
Definition LdrDataTableEntry.hpp:50
std::unique_ptr< LdrDataTableEntry > yield()
Transfer ownership of the entry at the current position to the caller. Returns nullptr if the iterato...
optional< uintptr_t > active_patch_image_base() const
Base address of the active hot-patch image, if any.
optional< uintptr_t > original_base() const
Preferred base address recorded in the PE headers.
uintptr_t dll_base() const
Base address at which the module is mapped in memory (DllBase).
optional< uintptr_t > load_context() const
Address of the loader context used while the module is being snapped.
std::string to_string() const
Pretty-printed representation of this entry.
uint32_t flags() const
Loader flags describing the state of the module (Flags).
optional< uintptr_t > switch_back_context() const
Address of the CHPE switch-back context.
optional< uint32_t > implicit_path_options() const
Path-search options implied when the module was resolved.
optional< uint32_t > base_name_hash_value() const
Hash of the module's base name used to index the loader tables.
uint32_t size_of_image() const
Size (in bytes) of the module's image in memory (SizeOfImage).
uint16_t tls_index() const
TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).
uintptr_t entry_point() const
Address of the entry point of the module (EntryPoint).
optional< uintptr_t > ddag_node() const
Address of the dependency-graph node of the module (DdagNode).
optional< int64_t > load_time() const
Time at which the module was loaded.
optional< uint32_t > dependent_load_flags() const
Flags controlling how the statically-linked dependencies of the module are loaded.
optional< uint8_t > signing_level() const
Signing level of the module's image, as a SE_SIGNING_LEVEL value.
optional< uint32_t > check_sum() const
Image checksum cached by the loader.
optional< int32_t > load_reason() const
Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.
optional< uintptr_t > parent_dll_base() const
Base address of the module that triggered the load of this one.
uint16_t obsolete_load_count() const
Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and...
uintptr_t lock() const
Address of the per-entry loader lock.
std::string base_dll_name() const
Base name of the module (BaseDllName), e.g. ntdll.dll.
optional< uint32_t > hot_patch_state() const
State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.
uintptr_t entry_point_activation_context() const
Address of the activation context associated with the module's entry point.
optional< uint32_t > reference_count() const
Number of references currently held on the module.
std::string full_dll_name() const
Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.
uint32_t time_date_stamp() const
TimeDateStamp of the module as cached by the loader.
#define LIEF_LIFETIMEBOUND
Definition compiler_attributes.hpp:72
Definition LdrDataTableEntry.hpp:32
Definition windows/Host.hpp:25
Definition android/Host.hpp:24
LIEF namespace.
Definition Abstract/Binary.hpp:41
#define LIEF_API
Definition visibility.h:45