LIEF::runtime::windows::PEB Class Reference

This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process. More...

#include <PEB.hpp>

Public Types
using	entries_it = iterator_range<LdrDataTableEntry::Iterator>
	Iterator over the LdrDataTableEntry referenced by the loader data.

Public Member Functions
	PEB ()=delete
	PEB (const PEB &)=delete
PEB &	operator= (const PEB &)=delete
	PEB (PEB &&) noexcept
PEB &	operator= (PEB &&) noexcept
bool	being_debugged () const
	Whether the current process is being debugged.
uintptr_t	ldr () const
	Address of the loader data structure (PEB_LDR_DATA).
uintptr_t	process_parameters () const
	Address of the process parameters (RTL_USER_PROCESS_PARAMETERS).
uintptr_t	atl_thunk_slist_ptr () const
	Address of the per-process ATL thunk SList (single-linked list).
uint32_t	atl_thunk_slist_ptr32 () const
	32-bit value of the ATL thunk SList pointer.
uintptr_t	post_process_init_routine () const
	Address of the routine called once the process completed its initialization (PostProcessInitRoutine).
uint32_t	session_id () const
	Session ID associated with the current process.
entries_it	entries () const
	Return a bidirectional iterator over the modules referenced by the loader data (Ldr).
	~PEB ()

Detailed Description

This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process.

An instance can be created through LIEF::runtime::windows::Process::peb().

if (auto peb = LIEF::runtime::windows::Process::peb()) {
  if (peb->being_debugged()) {
    // A debugger is attached to the current process
  }
}

Member Typedef Documentation

entries_it

using LIEF::runtime::windows::PEB::entries_it = iterator_range<LdrDataTableEntry::Iterator>

Iterator over the LdrDataTableEntry referenced by the loader data.

Constructor & Destructor Documentation

PEB() [1/3]

LIEF::runtime::windows::PEB::PEB ( )

delete

Referenced by operator=(), operator=(), PEB(), PEB(), and ~PEB().

PEB() [2/3]

LIEF::runtime::windows::PEB::PEB ( const PEB & )

delete

References PEB().

PEB() [3/3]

LIEF::runtime::windows::PEB::PEB ( PEB && )

noexcept

References PEB().

~PEB()

LIEF::runtime::windows::PEB::~PEB

(

)

References PEB().

Member Function Documentation

atl_thunk_slist_ptr()

uintptr_t LIEF::runtime::windows::PEB::atl_thunk_slist_ptr

(

)

const

Address of the per-process ATL thunk SList (single-linked list).

References atl_thunk_slist_ptr().

Referenced by atl_thunk_slist_ptr().

atl_thunk_slist_ptr32()

uint32_t LIEF::runtime::windows::PEB::atl_thunk_slist_ptr32

(

)

const

32-bit value of the ATL thunk SList pointer.

References atl_thunk_slist_ptr32().

Referenced by atl_thunk_slist_ptr32().

being_debugged()

bool LIEF::runtime::windows::PEB::being_debugged

(

)

const

Whether the current process is being debugged.

References being_debugged().

Referenced by being_debugged().

entries()

entries_it LIEF::runtime::windows::PEB::entries

(

)

const

Return a bidirectional iterator over the modules referenced by the loader data (Ldr).

if (auto peb = LIEF::runtime::windows::Process::peb()) {
  for (const LdrDataTableEntry& entry : peb->entries()) {
    // entry.base_dll_name(), entry.dll_base(), ...
  }
}

References entries().

Referenced by entries().

ldr()

uintptr_t LIEF::runtime::windows::PEB::ldr

(

)

const

Address of the loader data structure (PEB_LDR_DATA).

References ldr().

Referenced by ldr().

operator=() [1/2]

PEB & LIEF::runtime::windows::PEB::operator= ( const PEB & )

delete

References PEB().

operator=() [2/2]

PEB & LIEF::runtime::windows::PEB::operator= ( PEB && )

noexcept

References PEB().

post_process_init_routine()

uintptr_t LIEF::runtime::windows::PEB::post_process_init_routine

(

)

const

Address of the routine called once the process completed its initialization (PostProcessInitRoutine).

References post_process_init_routine().

Referenced by post_process_init_routine().

process_parameters()

uintptr_t LIEF::runtime::windows::PEB::process_parameters

(

)

const

Address of the process parameters (RTL_USER_PROCESS_PARAMETERS).

References process_parameters().

Referenced by process_parameters().

session_id()

uint32_t LIEF::runtime::windows::PEB::session_id

(

)

const

Session ID associated with the current process.

References session_id().

Referenced by session_id().

---

The documentation for this class was generated from the following file:

• PEB.hpp