BlackBone
Windows memory hacking library
 All Classes Functions
blackbone::NameResolve Class Reference

Public Types

enum  eResolveFlag {
  Default = 0, ApiSchemaOnly = 1, EnsureFullPath = 2, NoSearch = 4,
  Wow64 = 8
}
 

Public Member Functions

BLACKBONE_API bool Initialize ()
 Initialize api set map More...
 
BLACKBONE_API NTSTATUS ResolvePath (std::wstring &path, const std::wstring &baseName, const std::wstring &searchDir, eResolveFlag flags, DWORD procID, HANDLE actx=INVALID_HANDLE_VALUE)
 Resolve image path. More...
 
BLACKBONE_API NTSTATUS ProbeSxSRedirect (std::wstring &path, HANDLE actx=INVALID_HANDLE_VALUE)
 Try SxS redirection More...
 

Static Public Member Functions

static BLACKBONE_API NameResolveInstance ()
 

Member Function Documentation

bool blackbone::NameResolve::Initialize ( )

Initialize api set map

Returns
NTSTATUS blackbone::NameResolve::ProbeSxSRedirect ( std::wstring &  path,
HANDLE  actx = INVALID_HANDLE_VALUE 
)

Try SxS redirection

Parameters
pathImage path.
actxActivation context
Returns
NTSTATUS blackbone::NameResolve::ResolvePath ( std::wstring &  path,
const std::wstring &  baseName,
const std::wstring &  searchDir,
eResolveFlag  flags,
DWORD  procID,
HANDLE  actx = INVALID_HANDLE_VALUE 
)

Resolve image path.

Parameters
pathImage to resolve
baseNameName of parent image. Used only when resolving import images
searchDirDirectory where source image is located
flagsResolve flags
procIDProcess ID. Used to search process executable directory
actxActivation context
Returns
Status

The documentation for this class was generated from the following files: