Retrieves the base address of a module loaded in the current process. In case that the module can't be found in the current process, it will return 0

Retrieves the address of an exported function from the specified module. This functions is analogous to GetProcAddress from Win32. The exported funct

Closes a HANDLE object. It will return either a boolean value or an Err with a descriptive error message. If the function fails the bool value return

Retrieves the memory address of a syscall instruction. It expects the memory address of the function as a parameter, and it will iterate over each fo

It sets a hardware breakpoint on a certain memory address. # Examples ``` let ntdll = dinvoke::get_module_base_address("ntdll.dll"); let nt_open_pro

Retrieves the address of an exported function from the specified module by its ordinal. In case that the function's address can't be retrieved, it wi

Dynamically calls NtProtectVirtualMemory. It will return the NTSTATUS value returned by the call.

Dynamically calls NtWriteVirtualMemory. It will return the NTSTATUS value returned by the call.

Loads and retrieves a module's base address by dynamically calling LoadLibraryA. It will return either the module's base address or 0. # Examples `

Manually maps a PE into the current process. It will return either a pair (PeMetadata,isize) containing the mapped PE metadata and its base address o

Dynamically calls NtAllocateVirtualMemory. It will return the NTSTATUS value returned by the call.

Dynamically calls NtQueryInformationProcess. It will return the NTSTATUS value returned by the call.

This method is reponsible of cleaning IOCs that may reveal the pressence of a manually mapped PE in a private memory region. It will remove PE magic b

Retrieves PE headers information from the module base address. It will return either a data::PeMetada struct containing the PE metadata or a String w

Retrieves the address of an exported function from the specified module either by its name or by its ordinal number. This functions internally calls

Maps a module to a valid memory space in the current process. The parameters required are a vector with the module content, the base address where th

Dynamically calls NtDuplicateObject. It will return the NTSTATUS value returned by the call.

Relocates a module in memory. The parameters required are the module's metadata information and a pointer to the base address where the module is map

Rewrites the IAT of a manually mapped module. The parameters required are the module's metadata information and a pointer to the base address where t

Sets correct module section permissions for a manually mapped module. The parameters required are the module's metadata information and a pointer to

This function acts as an Exception Handler, and should be combined with a hardware breakpoint. Whenever the HB gets triggered, this function will be

Calls the module's entry point with the option DLL_ATTACH_PROCESS. # Examples ```ignore let pe = manualmap::read_and_map_module("c:\\some\\random\\f

Returns a BTreeMap<isize,String> composed of pairs (memory address, function name) with all the Nt exported functions on ntdll.dll. This functions wi

Returns the syscall id that correspond to the function specified. This functions will return -1 in case that the syscall id of the specified function

Dynamically calls NtCreateThreadEx. It will return the NTSTATUS value returned by the call.

Dynamically calls NtOpenFile. It will return the NTSTATUS value returned by the call.

Dynamically calls NtOpenProcess. It will return the NTSTATUS value returned by the call.

Opens a HANDLE to a process. If the function fails, it will return a null HANDLE. # Examples ``` let pid = 792u32; let handle = dinvoke::open_proce

Given a valid syscall id, it will allocate the required shellcode to execute that specific syscall. This functions will return the memory address whe

Manually maps a PE from disk to the memory of the current process. It will return either a pair (PeMetadata,isize) containing the mapped PE metadata

Dynamically calls RtlAdjustPrivilege. It will return the NTSTATUS value returned by the call.

Dynamically calls RtlInitUnicodeString. It will return the NTSTATUS value returned by the call.

Dynamically calls RtlZeroMemory. It will return the NTSTATUS value returned by the call.

Dynamically calls SetUnhandledExceptionFilter.

Enables or disables the use of exception handlers in combination with hardware breakpoints.

Dynamically calls VirtualFree.