lazy importer

A simple and easy to use header only library to make the life of a reverse engineer much harder.

small example

LI_FN(OutputDebugStringA)("hello world");
LI_FN(VirtualProtect).in(LI_MODULE("kernel32.dll").cached());

IDA output when compiling first line

features

• Does not leave any strings in memory.
• Does not allocate any memory.
• Can be easily inlined.
• Does not leave any imports in the executable.
• Produces extremely small assembly.
• Non caching functions do not leave anything in data sections.
• Hashes are randomized for each compilation to defeat basic hash database attacks.

documentation

• LI_FN(function_pointer) -> lazy_function
• LI_FN_DEF(function_type) -> lazy_function
• LI_MODULE(module_name) -> lazy_module

---

• safe indicates that when function cannot complete its task successfully 0 is returned instead of undefined behaviour manifesting.
• cached indicates that the result is only computed during the first call and later reused.
• forwarded indicates that export forwarding will be correctly resolved.

lazy_module

function	safe	cached
Attempts to find the given module and returns its address
get<T = void*>() -> T	:x:	:x:
safe<T = void*>() -> T	:white_check_mark:	:x:
cached<T = void*>() -> T	:x:	:white_check_mark:
safe_cached<T = void*>() -> T	:white_check_mark:	:white_check_mark:
Attemps to find the given module using the given LDR_DATA_TABLE_ENTRY pointer
in<T = void*, Ldr>(Ldr ldr_entry) -> T	:white_check_mark:	:x:
in_cached<T = void*, Ldr>(Ldr ldr_entry) -> T	:white_check_mark:	:white_check_mark:

lazy_function<F>

function	safe	cached	forwarded
calls resolved export using given arguments
operator()(...) -> result_of<F, ...>	:x:	:x:	:x:
attempts to resolve an export in all loaded modules and returns the function address
get<T = F>() -> T	:x:	:x:	:x:
safe<T = F>() -> T	:white_check_mark:	:x:	:x:
cached<T = F>() -> T	:x:	:white_check_mark:	:x:
safe_cached<T = F>() -> T	:white_check_mark:	:white_check_mark:	:x:
forwarded<T = F>() -> T	:x:	:x:	:white_check_mark:
forwarded_safe<T = F>() -> T	:white_check_mark:	:x:	:white_check_mark:
forwarded_cached<T = F>() -> T	:x:	:white_check_mark:	:white_check_mark:
forwarded_safe_cached<T = F>() -> T	:white_check_mark:	:white_check_mark:	:white_check_mark:
attempts to resolve an export in the given module and returns the function address
in<T = F, A>(A module_address) -> T	:x:	:x:	:x:
in_safe<T = F, A>(A module_address) -> T	:white_check_mark:	:x:	:x:
in_cached<T = F, A>(A module_address) -> T	:x:	:white_check_mark:	:x:
in_safe_cached<T = F, A>(A module_address) -> T	:white_check_mark:	:white_check_mark:	:x:
attempts to resolve an export in ntdll and returns the function address
nt<T = F>() -> T	:x:	:x:	:x:
nt_safe<T = F>() -> T	:white_check_mark:	:x:	:x:
nt_cached<T = F>() -> T	:x:	:white_check_mark:	:x:
nt_safe_cached<T = F>() -> T	:white_check_mark:	:white_check_mark:	:x:

extra configuration

#define	effects
LAZY_IMPORTER_NO_FORCEINLINE	disables force inlining
LAZY_IMPORTER_CASE_INSENSITIVE	enables case insensitive comparison. Might be required for forwarded export resolution.
LAZY_IMPORTER_CACHE_OPERATOR_PARENS	uses cached() instead of get() in operator() of lazy_function
LAZY_IMPORTER_RESOLVE_FORWARDED_EXPORTS	uses forwarded() in get(). WARNING does not apply to nt() and in().
LAZY_IMPORTER_HARDENED_MODULE_CHECKS	adds extra sanity checks to module enumeration.
LAZY_IMPORTER_NO_CPP_FORWARD	Removes dependence on <utility> c++ header.

example output