Struct NativeMethodMatcher 

pub struct NativeMethodMatcher { /* private fields */ }

Matches P/Invoke (native) method calls by DLL name and/or function name.

This matcher identifies calls to unmanaged code through the P/Invoke mechanism. It can match by DLL name, function name, or both.

Normalization

DLL names are normalized to lowercase and the .dll extension is removed for consistent matching. Function names are compared case-sensitively.

Examples

use dotscope::emulation::NativeMethodMatcher;

// Match all calls to kernel32.dll
let matcher = NativeMethodMatcher::new().dll("kernel32");

// Match VirtualProtect specifically
let matcher = NativeMethodMatcher::full("kernel32", "VirtualProtect");

// Match any function named GetModuleHandle (any DLL)
let matcher = NativeMethodMatcher::new().function("GetModuleHandle");

Implementations

impl NativeMethodMatcher

pub fn new() -> Self

Creates a new native method matcher with no constraints.

Use the builder methods to specify which components to match.

pub fn dll(self, dll: impl Into<String>) -> Self

Sets the DLL name to match.

The DLL name is normalized: converted to lowercase with .dll extension removed.

Arguments

• dll - The DLL name to match (e.g., “kernel32” or “kernel32.dll”)

pub fn function(self, function: impl Into<String>) -> Self

Sets the function name to match.

Function names are matched case-sensitively.

Arguments

• function - The function name to match (e.g., “VirtualProtect”)

pub fn full(dll: impl Into<String>, function: impl Into<String>) -> Self

Creates a matcher for a specific DLL and function combination.

Arguments

• dll - The DLL name (normalized automatically)
• function - The function name

Examples

use dotscope::emulation::NativeMethodMatcher;

let matcher = NativeMethodMatcher::full("kernel32", "VirtualProtect");

Trait Implementations

impl Clone for NativeMethodMatcher

fn clone(&self) -> NativeMethodMatcher

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NativeMethodMatcher

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NativeMethodMatcher

fn default() -> NativeMethodMatcher

Returns the “default value” for a type.

impl HookMatcher for NativeMethodMatcher

fn matches(&self, context: &HookContext<'_>, _thread: &EmulationThread) -> bool

Checks if this matcher matches the given context.

fn description(&self) -> String

Returns a description of this matcher for debugging.

fn name_components(&self) -> Option<(Option<&str>, Option<&str>, Option<&str>)>

Returns the name components if this is a name-based matcher.

fn is_runtime_matcher(&self) -> bool

Returns true if this matcher requires runtime argument inspection.

fn is_signature_matcher(&self) -> bool

Returns true if this matcher requires method signature information.