Struct LdrProxy

pub struct LdrProxy<'a> {
    pub module: &'a str,
}

A helper struct to interact with dynamic module loading with Windows APIs via Proxy.

The LdrProxy struct provides methods to queue work items and manage operations involving dynamic libraries using Windows APIs.

Fields

module: &'a str

The name of the module to be loaded or operated on.

Implementations

impl<'a> LdrProxy<'a>

pub fn new(module: &'a str) -> Self

Creates a new Loader instance for a given module.

Arguments

• module - The name of the module (e.g., "kernel32.dll") to be handled by this loader.

Return

• A new instance of the LdrProxy struct.

pub fn work(&self) -> Option<NTSTATUS>

Queues a work item to load the specified module asynchronously.

This method wraps the RtlQueueWorkItem Windows API, dynamically resolving the function and scheduling the specified module to be loaded.

Returns

• Some(NTSTATUS) - Status code returned by the RtlQueueWorkItem API if successful.
• None - If the function or module cannot be resolved.

pub fn timer(&self) -> Option<NTSTATUS>

Schedules a timer to execute the loading of the specified module.

This method uses the RtlCreateTimer API to create a timer queue and schedule the execution of the LoadLibraryA function.

Returns

• Some(NTSTATUS) - Status code returned by the RtlCreateTimer API if successful.
• None - If the function or module cannot be resolved.

pub fn register_wait(&self) -> Option<NTSTATUS>

Registers a wait event to execute the loading of the specified module.

This method uses the RtlRegisterWait API to register an event-based callback that triggers the execution of the LoadLibraryA function.

• Some(NTSTATUS) - Status code returned by the RtlRegisterWait API if successful.
• None - If the function or module cannot be resolved.