pe_dumper.h

Go to the documentation of this file.

 
#pragma once
 
#include <windows.h>
#include "exports_mapper.h"
 
namespace peconv {

    typedef enum {
        PE_DUMP_AUTO = 0, 
        PE_DUMP_VIRTUAL,
        PE_DUMP_UNMAP, 
        PE_DUMP_REALIGN, 
        PE_DUMP_MODES_COUNT 
    } t_pe_dump_mode;
    typedef enum {…};

    t_pe_dump_mode detect_dump_mode(IN const BYTE* buffer, IN size_t buffer_size);

    bool dump_pe(
        IN LPCTSTR outputFilePath,
        IN OUT BYTE* buffer,
        IN size_t buffer_size,
        IN const ULONGLONG module_base,
        IN OUT t_pe_dump_mode &dump_mode,
        IN OPTIONAL const peconv::ExportsMapper* exportsMap = nullptr
    );
 
};// namespace peconv