LIEF::runtime::windows Namespace Reference

Namespaces
namespace	details

Classes
class	Host
	This class exposes Windows-specific host information. More...
struct	injection_context_t
	Describes how to spawn a new process and inject a library into it. More...
class	LdrDataTableEntry
	This class exposes a user-friendly interface over a LDR_DATA_TABLE_ENTRY, the structure used by the Windows loader to describe a module loaded in the current process. More...
class	Module
	This class exposes a Windows-specific API for a module. More...
class	PEB
	This class exposes a user-friendly interface over the Process Environment Block (PEB) of the current process. More...
class	Process
	This class exposes Windows-specific API for the current process. More...

Functions
ok_error_t	inject_spawn (const injection_context_t &ctx)
	Spawn the target described by the given injection context and inject the associated library before the main thread starts executing.
std::unique_ptr< Module >	dlopen (const std::string &name)
	Load the windows library with the given path or name.
std::unique_ptr< Module >	find_module (const std::string &name)
	Try to get the Module with the given name.

Function Documentation

dlopen()

std::unique_ptr< Module > LIEF::runtime::windows::dlopen

(

const std::string &

name

)

Load the windows library with the given path or name.

References LIEF_API.

find_module()

std::unique_ptr< Module > LIEF::runtime::windows::find_module

(

const std::string &

name

)

Try to get the Module with the given name.

Return a nullptr if the module is not found

if (auto ntdll = find_module("ntdll.dll")) {
  std::cout << ntdll->path() << '\n';
}

Note

This function relies on the Windows API GetModuleHandle which is more efficient than the generic implementation LIEF::runtime::module_from_name

References LIEF_API.

inject_spawn()

ok_error_t LIEF::runtime::windows::inject_spawn

(

const injection_context_t &

ctx

)

Spawn the target described by the given injection context and inject the associated library before the main thread starts executing.

This is the Windows equivalent of a "create suspended + remote LoadLibrary" approach.

References LIEF_API.