This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process. More...

#include <LdrDataTableEntry.hpp>

Classes
class	Iterator
	Bidirectional iterator over the LdrDataTableEntry mirroring the doubly-linked list used by Windows. More...

Public Member Functions
	LdrDataTableEntry ()=delete
	LdrDataTableEntry (std::unique_ptr< details::ldr_entry > impl)
	LdrDataTableEntry (const LdrDataTableEntry &)=delete
LdrDataTableEntry &	operator= (const LdrDataTableEntry &)=delete
	LdrDataTableEntry (LdrDataTableEntry &&) noexcept
LdrDataTableEntry &	operator= (LdrDataTableEntry &&) noexcept
uintptr_t	dll_base () const
	Base address at which the module is mapped in memory (DllBase).
uintptr_t	entry_point () const
	Address of the entry point of the module (EntryPoint).
uint32_t	size_of_image () const
	Size (in bytes) of the module's image in memory (SizeOfImage).
std::string	full_dll_name () const
	Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.
std::string	base_dll_name () const
	Base name of the module (BaseDllName), e.g. ntdll.dll.
uint32_t	flags () const
	Loader flags describing the state of the module (Flags).
uint16_t	obsolete_load_count () const
	Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and later.
uint16_t	tls_index () const
	TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).
uint32_t	time_date_stamp () const
	TimeDateStamp of the module as cached by the loader.
uintptr_t	entry_point_activation_context () const
	Address of the activation context associated with the module's entry point.
uintptr_t	lock () const
	Address of the per-entry loader lock.
optional< uintptr_t >	ddag_node () const
	Address of the dependency-graph node of the module (DdagNode).
optional< uintptr_t >	load_context () const
	Address of the loader context used while the module is being snapped.
optional< uintptr_t >	parent_dll_base () const
	Base address of the module that triggered the load of this one.
optional< uintptr_t >	switch_back_context () const
	Address of the CHPE switch-back context.
optional< uintptr_t >	original_base () const
	Preferred base address recorded in the PE headers.
optional< int64_t >	load_time () const
	Time at which the module was loaded.
optional< uint32_t >	base_name_hash_value () const
	Hash of the module's base name used to index the loader tables.
optional< int32_t >	load_reason () const
	Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.
optional< uint32_t >	implicit_path_options () const
	Path-search options implied when the module was resolved.
optional< uint32_t >	reference_count () const
	Number of references currently held on the module.
optional< uint32_t >	dependent_load_flags () const
	Flags controlling how the statically-linked dependencies of the module are loaded.
optional< uint8_t >	signing_level () const
	Signing level of the module's image, as a SE_SIGNING_LEVEL value.
optional< uint32_t >	check_sum () const
	Image checksum cached by the loader.
optional< uintptr_t >	active_patch_image_base () const
	Base address of the active hot-patch image, if any.
optional< uint32_t >	hot_patch_state () const
	State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.
std::string	to_string () const
	Pretty-printed representation of this entry.
	~LdrDataTableEntry ()

Detailed Description

This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process.

Constructor & Destructor Documentation

◆ LdrDataTableEntry() [1/4]

LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry ( )

delete

References LdrDataTableEntry().

Referenced by LdrDataTableEntry(), LdrDataTableEntry(), LdrDataTableEntry(), LdrDataTableEntry(), LIEF::runtime::windows::LdrDataTableEntry::Iterator::operator*(), LIEF::runtime::windows::LdrDataTableEntry::Iterator::operator->(), operator<<, operator=(), operator=(), and LIEF::runtime::windows::LdrDataTableEntry::Iterator::yield().

◆ LdrDataTableEntry() [2/4]

LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry ( std::unique_ptr< details::ldr_entry > impl )

References LdrDataTableEntry().

◆ LdrDataTableEntry() [3/4]

LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry ( const LdrDataTableEntry & )

delete

References LdrDataTableEntry().

◆ LdrDataTableEntry() [4/4]

LIEF::runtime::windows::LdrDataTableEntry::LdrDataTableEntry ( LdrDataTableEntry && )

noexcept

References LdrDataTableEntry().

◆ ~LdrDataTableEntry()

LIEF::runtime::windows::LdrDataTableEntry::~LdrDataTableEntry ( )

Member Function Documentation

◆ active_patch_image_base()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::active_patch_image_base ( ) const

Base address of the active hot-patch image, if any.

Note: Available on Windows 11 and later.

References active_patch_image_base().

Referenced by active_patch_image_base().

◆ base_dll_name()

std::string LIEF::runtime::windows::LdrDataTableEntry::base_dll_name ( ) const

Base name of the module (BaseDllName), e.g. ntdll.dll.

References base_dll_name().

Referenced by base_dll_name().

◆ base_name_hash_value()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::base_name_hash_value ( ) const

Hash of the module's base name used to index the loader tables.

Note: Available on Windows 8 and later.

References base_name_hash_value().

Referenced by base_name_hash_value().

◆ check_sum()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::check_sum ( ) const

Image checksum cached by the loader.

Note: Available on Windows 10 and later.

References check_sum().

Referenced by check_sum().

◆ ddag_node()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::ddag_node ( ) const

Address of the dependency-graph node of the module (DdagNode).

Note: Available on Windows 8 and later.

References ddag_node().

Referenced by ddag_node().

◆ dependent_load_flags()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::dependent_load_flags ( ) const

Flags controlling how the statically-linked dependencies of the module are loaded.

Note: Available on Windows 8 and later.

References dependent_load_flags().

Referenced by dependent_load_flags().

◆ dll_base()

uintptr_t LIEF::runtime::windows::LdrDataTableEntry::dll_base ( ) const

Base address at which the module is mapped in memory (DllBase).

References dll_base().

Referenced by dll_base().

◆ entry_point()

uintptr_t LIEF::runtime::windows::LdrDataTableEntry::entry_point ( ) const

Address of the entry point of the module (EntryPoint).

References entry_point().

Referenced by entry_point().

◆ entry_point_activation_context()

uintptr_t LIEF::runtime::windows::LdrDataTableEntry::entry_point_activation_context ( ) const

Address of the activation context associated with the module's entry point.

References entry_point_activation_context().

Referenced by entry_point_activation_context().

◆ flags()

uint32_t LIEF::runtime::windows::LdrDataTableEntry::flags ( ) const

Loader flags describing the state of the module (Flags).

References flags().

Referenced by flags().

◆ full_dll_name()

std::string LIEF::runtime::windows::LdrDataTableEntry::full_dll_name ( ) const

Full path of the module (FullDllName), e.g. C:\Windows\System32\ntdll.dll.

References full_dll_name().

Referenced by full_dll_name().

◆ hot_patch_state()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::hot_patch_state ( ) const

State of the hot-patch engine for this module, as a LDR_HOT_PATCH_STATE value.

Note: Available on Windows 11 and later.

References hot_patch_state().

Referenced by hot_patch_state().

◆ implicit_path_options()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::implicit_path_options ( ) const

Path-search options implied when the module was resolved.

Note: Available on Windows 8 and later.

References implicit_path_options().

Referenced by implicit_path_options().

◆ load_context()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::load_context ( ) const

Address of the loader context used while the module is being snapped.

Note: Available on Windows 8 and later.

References load_context().

Referenced by load_context().

◆ load_reason()

optional< int32_t > LIEF::runtime::windows::LdrDataTableEntry::load_reason ( ) const

Reason why the module was loaded, as a LDR_DLL_LOAD_REASON value.

Note: Available on Windows 8 and later.

References load_reason().

Referenced by load_reason().

◆ load_time()

optional< int64_t > LIEF::runtime::windows::LdrDataTableEntry::load_time ( ) const

Time at which the module was loaded.

Note: Available on Windows 8 and later.

References load_time().

Referenced by load_time().

◆ lock()

uintptr_t LIEF::runtime::windows::LdrDataTableEntry::lock ( ) const

Address of the per-entry loader lock.

References lock().

Referenced by lock().

◆ obsolete_load_count()

uint16_t LIEF::runtime::windows::LdrDataTableEntry::obsolete_load_count ( ) const

Legacy load count of the module (ObsoleteLoadCount). Superseded by reference_count() on Windows 8 and later.

References obsolete_load_count().

Referenced by obsolete_load_count().

◆ operator=() [1/2]

LdrDataTableEntry & LIEF::runtime::windows::LdrDataTableEntry::operator= ( const LdrDataTableEntry & )

delete

References LdrDataTableEntry().

◆ operator=() [2/2]

LdrDataTableEntry & LIEF::runtime::windows::LdrDataTableEntry::operator= ( LdrDataTableEntry && )

noexcept

References LdrDataTableEntry().

◆ original_base()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::original_base ( ) const

Preferred base address recorded in the PE headers.

Note: Available on Windows 8 and later.

References original_base().

Referenced by original_base().

◆ parent_dll_base()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::parent_dll_base ( ) const

Base address of the module that triggered the load of this one.

Note: Available on Windows 8 and later.

References parent_dll_base().

Referenced by parent_dll_base().

◆ reference_count()

optional< uint32_t > LIEF::runtime::windows::LdrDataTableEntry::reference_count ( ) const

Number of references currently held on the module.

Note: Available on Windows 8 and later.

References reference_count().

Referenced by reference_count().

◆ signing_level()

optional< uint8_t > LIEF::runtime::windows::LdrDataTableEntry::signing_level ( ) const

Signing level of the module's image, as a SE_SIGNING_LEVEL value.

Note: Available on Windows 10 and later.

References signing_level().

Referenced by signing_level().

◆ size_of_image()

uint32_t LIEF::runtime::windows::LdrDataTableEntry::size_of_image ( ) const

Size (in bytes) of the module's image in memory (SizeOfImage).

References size_of_image().

Referenced by size_of_image().

◆ switch_back_context()

optional< uintptr_t > LIEF::runtime::windows::LdrDataTableEntry::switch_back_context ( ) const

Address of the CHPE switch-back context.

Note: Available on Windows 8 and later.

References switch_back_context().

Referenced by switch_back_context().

◆ time_date_stamp()

uint32_t LIEF::runtime::windows::LdrDataTableEntry::time_date_stamp ( ) const

TimeDateStamp of the module as cached by the loader.

References time_date_stamp().

Referenced by time_date_stamp().

◆ tls_index()

uint16_t LIEF::runtime::windows::LdrDataTableEntry::tls_index ( ) const

TLS slot index assigned to the module, or 0 when it has no TLS (TlsIndex).

References tls_index().

Referenced by tls_index().

◆ to_string()

std::string LIEF::runtime::windows::LdrDataTableEntry::to_string ( ) const

Pretty-printed representation of this entry.

References to_string().

Referenced by to_string().

The documentation for this class was generated from the following file:

LdrDataTableEntry.hpp

Classes

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ LdrDataTableEntry() [1/4]

◆ LdrDataTableEntry() [2/4]

◆ LdrDataTableEntry() [3/4]

◆ LdrDataTableEntry() [4/4]

◆ ~LdrDataTableEntry()

Member Function Documentation

◆ active_patch_image_base()

◆ base_dll_name()

◆ base_name_hash_value()

◆ check_sum()

◆ ddag_node()

◆ dependent_load_flags()

◆ dll_base()

◆ entry_point()

◆ entry_point_activation_context()

◆ flags()

◆ full_dll_name()

◆ hot_patch_state()

◆ implicit_path_options()

◆ load_context()

◆ load_reason()

◆ load_time()

◆ lock()

◆ obsolete_load_count()

◆ operator=() [1/2]

◆ operator=() [2/2]

◆ original_base()

◆ parent_dll_base()

◆ reference_count()

◆ signing_level()

◆ size_of_image()

◆ switch_back_context()

◆ time_date_stamp()

◆ tls_index()

◆ to_string()