lief 1.0.0

Official Rust bindings for LIEF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

use lief_ffi as ffi;

use crate::common::{FromFFI, into_optional};
use crate::declare_standalone_fwd_iterator;
use std::path::Path;

use super::android;
use super::linux;
use super::osx;
use super::windows;

/// This trait is shared by all system-specific modules.
/// It provides a common interface for accessing module metadata.
pub trait Module {
    #[doc(hidden)]
    fn as_generic(&self) -> &ffi::runtime_Module;

    /// Name of the module (e.g. `libc.so.6, kernel32.dll, libsystem_c.dylib`)
    fn name(&self) -> String {
        self.as_generic().name().to_string()
    }

    /// Absolute path to the module file
    fn path(&self) -> String {
        self.as_generic().path().to_string()
    }

    /// Base address where the module is loaded in memory
    fn imagebase(&self) -> u64 {
        self.as_generic().imagebase()
    }

    /// Virtual size of the current module
    fn size(&self) -> u64 {
        self.as_generic().size()
    }

    /// End address of the module
    fn end(&self) -> u64 {
        self.as_generic().end()
    }

    /// Check if the current module contains the given address
    fn contains(&self, addr: u64) -> bool {
        self.as_generic().contains(addr)
    }

    /// Return the content of the module as it is currently mapped in memory.
    ///
    /// The returned buffer spans [`Module::imagebase`] over [`Module::size`]
    /// bytes. An empty buffer is returned if the imagebase or the size is null.
    fn dump(&self) -> Vec<u8> {
        let base = self.imagebase();
        let size = self.size() as usize;
        if base == 0 || size == 0 {
            return Vec::new();
        }
        unsafe { std::slice::from_raw_parts(base as *const u8, size).to_vec() }
    }

    /// Same as [`Module::dump`] but also write the content into the file
    /// located at `path`.
    fn dump_to_file<P: AsRef<Path>>(&self, path: P) -> Vec<u8> {
        let data = self.dump();
        let _ = std::fs::write(path, &data);
        data
    }
}

/// Enum for the modules whose value depends on the current platform
pub enum Modules {
    /// A Linux module
    Linux(linux::Module),

    /// A Windows module
    Windows(windows::Module),

    /// An Android module
    Android(android::Module),

    /// An OSX module
    Osx(osx::Module),
}

impl FromFFI<ffi::runtime_Module> for Modules {
    fn from_ffi(ptr: cxx::UniquePtr<ffi::runtime_Module>) -> Self {
        unsafe {
            let mod_ref = ptr.as_ref().unwrap();
            if ffi::runtime_linux_Module::classof(mod_ref) {
                let raw = {
                    type From = cxx::UniquePtr<ffi::runtime_Module>;
                    type To = cxx::UniquePtr<ffi::runtime_linux_Module>;
                    std::mem::transmute::<From, To>(ptr)
                };
                return Modules::Linux(linux::Module::from_ffi(raw));
            } else if ffi::runtime_windows_Module::classof(mod_ref) {
                let raw = {
                    type From = cxx::UniquePtr<ffi::runtime_Module>;
                    type To = cxx::UniquePtr<ffi::runtime_windows_Module>;
                    std::mem::transmute::<From, To>(ptr)
                };
                return Modules::Windows(windows::Module::from_ffi(raw));
            } else if ffi::runtime_android_Module::classof(mod_ref) {
                let raw = {
                    type From = cxx::UniquePtr<ffi::runtime_Module>;
                    type To = cxx::UniquePtr<ffi::runtime_android_Module>;
                    std::mem::transmute::<From, To>(ptr)
                };
                return Modules::Android(android::Module::from_ffi(raw));
            } else if ffi::runtime_osx_Module::classof(mod_ref) {
                let raw = {
                    type From = cxx::UniquePtr<ffi::runtime_Module>;
                    type To = cxx::UniquePtr<ffi::runtime_osx_Module>;
                    std::mem::transmute::<From, To>(ptr)
                };
                return Modules::Osx(osx::Module::from_ffi(raw));
            }
            panic!("Unsupported module")
        }
    }
}

impl Module for Modules {
    #[doc(hidden)]
    fn as_generic(&self) -> &ffi::runtime_Module {
        match &self {
            Modules::Linux(module) => module.as_generic(),
            Modules::Windows(module) => module.as_generic(),
            Modules::Android(module) => module.as_generic(),
            Modules::Osx(module) => module.as_generic(),
        }
    }
}

/// Return an iterator over the different modules loaded in the current process.
pub fn modules() -> ModulesIt {
    ModulesIt::new(ffi::runtime_modules())
}

/// Find the module with the given name
pub fn module_from_name(name: &str) -> Option<Modules> {
    cxx::let_cxx_string!(s = name);
    into_optional(ffi::runtime_module_from_name(&s))
}

/// Find the module with the given name
pub fn module_from_path<P: AsRef<Path>>(path: P) -> Option<Modules> {
    cxx::let_cxx_string!(s = path.as_ref().to_str().unwrap());
    into_optional(ffi::runtime_module_from_path(&s))
}

/// Find the module that encompasses the given virtual address (absolute)
pub fn module_from_addr(addr: u64) -> Option<Modules> {
    into_optional(ffi::runtime_module_from_addr(addr))
}

declare_standalone_fwd_iterator!(
    ModulesIt,
    Modules,
    ffi::runtime_Module,
    ffi::runtime_it_modules
);