Struct ModuleQuery 

pub struct ModuleQuery<'a> { /* private fields */ }

module query builder

Implementations

impl<'a> ModuleQuery<'a>

pub fn new(peb: &'a Peb) -> Self

create new query for given PEB

pub fn find_by_name(&self, name: &str) -> Result<Module<'a>>

find module by name (case-insensitive)

searches by base name (e.g., “ntdll.dll”, not full path)

pub fn find_by_hash(&self, hash: u32) -> Result<Module<'a>>

find module by hash of name (for API hashing)

hash is computed lowercase

pub fn find_by_address(&self, address: usize) -> Result<Module<'a>>

find module containing an address

pub fn find_by_base(&self, base: usize) -> Result<Module<'a>>

find module by base address (exact match)

pub fn find_by_path_contains(&self, substring: &str) -> Result<Module<'a>>

find module by partial path match

pub fn ntdll(&self) -> Result<Module<'a>>

get ntdll.dll module

pub fn kernel32(&self) -> Result<Module<'a>>

get kernel32.dll module

pub fn kernelbase(&self) -> Result<Module<'a>>

get kernelbase.dll module

pub fn current_module(&self) -> Result<Module<'a>>

get current executable module

pub fn find_all<F>(&self, predicate: F) -> Result<Vec<Module<'a>>>

where F: Fn(&Module<'_>) -> bool,

find all modules matching a predicate

pub fn is_loaded(&self, name: &str) -> bool

check if a module is loaded