Skip to main content

read_and_map_module

Function read_and_map_module 

Source
pub fn read_and_map_module(
    filepath: &str,
    clean_dos_header: bool,
    run_callbacks: bool,
) -> Result<(PeMetadata, usize), String>
Available on Windows only.
Expand description

Manually maps a PE from disk to the memory of the current process.

If the clean_headers parameters is set to true, the mapped pe’s dos header will be removed during the mapping process. Otherwise, the dos header will be kept untouched.

The third parameter determines whether TLS callbacks are executed (true) or not (false).

It will return either a pair (PeMetadata,usize) containing the mapped PE metadata and its base address or a String with a descriptive error message.

§Examples

let ntdll = manualmap::read_and_map_module(r"c:\windows\system32\ntdll.dll", true, false);

match ntdll {
    Ok(x) => if x.1 != 0 {println!("The base address of ntdll.dll is 0x{:X}.", x.1);},
    Err(e) => println!("{}", e),
}