/petricks

Primary LanguageC++MIT LicenseMIT

petricks

petricks is a header-only C++ library for manipulating PE files. Basically C++11 compliant.

Contents

  • Headers that helps interpret PE structure & some windows internal buffers with some handy inline functions and operator overloading, which does not pollute your global namespace with macros and capitalized typedefs.
  • Implementation for:
    • getting base address of a loaded module, i.e. GetModuleHandle
    • finding address of exported functions in a loaded module (forwarders supported), i.e. GetProcAddress
    • loading a module from memory

Features

  • Zero dependency on windows.h!
  • A "no static import" mode, where this library produces no import table entries.

TODO

  • This is not tested, written for learning purpose.
  • Module name must be all ASCII chars.
  • pe::runtime::reflect::get_module_base can only find already loaded modules from its base name.
  • pe::runtime::loader::memory_module::open skips ISA-specific relocations. (which is fine on x86, for they have none)
  • pe::runtime::loader::memory_module::open requires all imports to be findable through LoadLibraryA, i.e. the in-memory module cannot depend on other in-memory modules.
  • pe::runtime::loader::memory_module::open does not utilize bound imports.

See Also