lazy_importer

Open source

library for importing functions from dlls in a hidden, reverse engineer unfriendly way

1.9K stars0 likes0 views

About

library for importing functions from dlls in a hidden, reverse engineer unfriendly way

A simple and easy to use header only library to make the life of a reverse engineer much harder.

cpp

LI_FN(OutputDebugStringA)("hello world");
LI_FN(VirtualProtect).in(LI_MODULE("kernel32.dll").cached());

Does not leave any strings in memory.
Does not allocate any memory.
Can be easily inlined.
Does not leave any imports in the executable.
Produces extremely small assembly.
Non caching functions do not leave anything in data sections.
Hashes are randomized for each compilation to defeat basic hash database attacks.

safe indicates that when function cannot complete its task successfully 0 is returned instead of undefined behaviour manifesting.
cached indicates that the result is only computed during the first call and later reused.
forwarded indicates that export forwarding will be correctly resolved.

function	safe	cached
Attempts to find the given module and returns its address
`get<T = void*>() -> T`	:x:	:x:
`safe<T = void*>() -> T`	:white_check_mark:	:x:
`cached<T = void*>() -> T`	:x:	:white_check_mark:
`safe_cached<T = void*>() -> T`	:white_check_mark:	:white_check_mark:
Attemps to find the given module using the given LDR_DATA_TABLE_ENTRY pointer
`in<T = void*, Ldr>(Ldr ldr_entry) -> T`	:white_check_mark:	:x:
`in_cached<T = void*, Ldr>(Ldr ldr_entry) -> T`	:white_check_mark:	:white_check_mark:

function	safe	cached	forwarded
calls resolved export using given arguments
`operator()(...) -> result_of<F, ...>`	:x:	:x:	:x:
attempts to resolve an export in all loaded modules and returns the function address
`get<T = F>() -> T`	:x:	:x:	:x:
`safe<T = F>() -> T`	:white_check_mark:	:x:	:x:
`cached<T = F>() -> T`	:x:	:white_check_mark:	:x:
`safe_cached<T = F>() -> T`	:white_check_mark:	:white_check_mark:	:x:
`forwarded<T = F>() -> T`	:x:	:x:	:white_check_mark:
`forwarded_safe<T = F>() -> T`	:white_check_mark:	:x:	:white_check_mark:
`forwarded_cached<T = F>() -> T`	:x:	:white_check_mark:	:white_check_mark:
`forwarded_safe_cached<T = F>() -> T`	:white_check_mark:	:white_check_mark:	:white_check_mark:
attempts to resolve an export in the given module and returns the function address
`in<T = F, A>(A module_address) -> T`	:x:	:x:	:x:
`in_safe<T = F, A>(A module_address) -> T`	:white_check_mark:	:x:	:x:
`in_cached<T = F, A>(A module_address) -> T`	:x:	:white_check_mark:	:x:
`in_safe_cached<T = F, A>(A module_address) -> T`	:white_check_mark:	:white_check_mark:	:x:
attempts to resolve an export in `ntdll` and returns the function address
`nt<T = F>() -> T`	:x:	:x:	:x:
`nt_safe<T = F>() -> T`	:white_check_mark:	:x:	:x:
`nt_cached<T = F>() -> T`	:x:	:white_check_mark:	:x:
`nt_safe_cached<T = F>() -> T`	:white_check_mark:	:white_check_mark:	:x:

`#define`	effects
`LAZY_IMPORTER_NO_FORCEINLINE`	disables force inlining
`LAZY_IMPORTER_CASE_INSENSITIVE`	enables case insensitive comparison. Might be required for forwarded export resolution.
`LAZY_IMPORTER_CACHE_OPERATOR_PARENS`	uses `cached()` instead of `get()` in `operator()` of lazy_function
`LAZY_IMPORTER_RESOLVE_FORWARDED_EXPORTS`	uses `forwarded()` in `get()`. WARNING does not apply to `nt()` and `in()`.
`LAZY_IMPORTER_HARDENED_MODULE_CHECKS`	adds extra sanity checks to module enumeration.
`LAZY_IMPORTER_NO_CPP_FORWARD`	Removes dependence on `<utility>` c++ header.