initial commit

.gitignore

···
+target/
+.zed/

Cargo.lock

···
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cc"
+version = "1.2.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+
+[[package]]
+name = "generic-array"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.177"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+
+[[package]]
+name = "libudis86-sys"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139bbf9ddb1bfc90c1ac64dd2923d9c957cd433cee7315c018125d72ab08a6b0"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "log"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+
+[[package]]
+name = "lumen-plugin"
+version = "0.1.0"
+dependencies = [
+ "cc",
+ "log",
+ "retour",
+ "windows",
+]
+
+[[package]]
+name = "mach2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d640282b302c0bb0a2a8e0233ead9035e3bed871f0b7e81fe4a1ec829765db44"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "mmap-fixed-fixed"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0681853891801e4763dc252e843672faf32bcfee27a0aa3b19733902af450acc"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "region"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6b6ebd13bc009aef9cd476c1310d49ac354d36e240cf1bd753290f3dc7199a7"
+dependencies = [
+ "bitflags",
+ "libc",
+ "mach2",
+ "windows-sys",
+]
+
+[[package]]
+name = "retour"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9af44d40e2400b44d491bfaf8eae111b09f23ac4de6e92728e79d93e699c527"
+dependencies = [
+ "cfg-if",
+ "generic-array",
+ "libc",
+ "libudis86-sys",
+ "mmap-fixed-fixed",
+ "once_cell",
+ "region",
+ "slice-pool2",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "slice-pool2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a3d689654af89bdfeba29a914ab6ac0236d382eb3b764f7454dde052f2821f8"
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e745dab35a0c4c77aa3ce42d595e13d2003d6902d6b08c9ef5fc326d08da12b"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

Cargo.toml

···
+
+[package]
+name = "lumen-plugin"
+version = "0.1.0"
+edition = "2021"
+
+build = "build.rs"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+log = "0.4"
+retour = { version = "0.3.1" }
+
+[profile.release]
+panic = 'unwind'
+strip = 'debuginfo'
+lto = 'thin'
+
+[target.'cfg(windows)'.dependencies]
+windows = { version = "0.44", features = ["Win32_System_Diagnostics_ToolHelp", "Win32_System_Diagnostics_Debug", "Win32_System_SystemInformation", "Win32_UI_WindowsAndMessaging", "Win32_System_Memory", "Win32_Foundation"] }
+
+[build-dependencies]
+cc = "1.0.83"

build.rs

···
+fn main() {
+    cc::Build::default().file("helper.c").compile("helper");
+    println!("cargo:rustc-link-lib=static=helper");
+    println!("cargo:rerun-if-changed=helper.c");
+}

helper.c

···
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdint.h>
+
+extern size_t get_callui();
+#define callui(...) ((int(*)(int,...))get_callui())( __VA_ARGS__ )
+
+
+static int vmsg(const char *fmt, va_list ca) {
+    return callui(23, fmt, ca);
+}
+
+int msg(const char *fmt, ...) {
+    va_list va;
+    va_start(va, fmt);
+    int r = vmsg(fmt, va);
+    va_end(va);
+    return r;
+}

rust-toolchain.toml

···
+[toolchain]
+channel = "nightly-2025-11-20"
+targets = ["x86_64-pc-windows-gnu"]

src/ida/bindings.rs

···
+/// Provides low-level interface to IDA
+use std::ffi::{c_char, CStr};
+
+#[cfg_attr(target_os = "windows", link(name = "ida", kind = "raw-dylib"))]
+extern "C" {
+    pub static callui: extern "C" fn(i32, ...) -> usize;
+    fn verror(fmt: *const c_char, va: std::ffi::VaList) -> !;
+}
+
+#[link(name = "helper", kind = "static")]
+extern "C" {
+    fn msg(fmt: *const c_char, ...);
+}
+
+#[no_mangle]
+unsafe extern "C" fn get_callui() -> usize {
+    callui as _
+}
+
+pub fn info<T: AsRef<CStr>>(s: T) {
+    let s = s.as_ref().as_ptr();
+
+    unsafe {
+        msg(c"%s\n".as_ptr(), s);
+    }
+}
+
+unsafe extern "C" fn _fatal(fmt: *const c_char, mut va: ...) -> ! {
+    verror(fmt, va.as_va_list());
+}
+
+/// Display fatal error message to UI and quit.
+pub fn fatal<T: AsRef<CStr>>(msg: T) -> ! {
+    unsafe {
+        _fatal(c"%s".as_ptr(), msg.as_ref().as_ptr());
+    }
+}
+
+pub fn get_kernel_version() -> String {
+    let mut buf = [0u8; 1024];
+    let res = unsafe { callui(52, buf.as_mut_ptr(), buf.len()) as isize };
+    assert!(res > 0, "failed to get kernel version");
+    let r = (buf[..res as usize]).to_owned();
+    String::from_utf8(r).unwrap()
+}

src/ida/logging.rs

···
+use std::ffi::CStr;
+
+use super::bindings::info;
+use log::Log;
+
+pub struct IdaLogger;
+impl Log for IdaLogger {
+    fn enabled(&self, _metadata: &log::Metadata) -> bool {
+        true
+    }
+
+    fn log(&self, record: &log::Record) {
+        let level = record.level().as_str().chars().next().unwrap_or_default();
+        let msg = format!("lumen: {level} {}\x00", record.args());
+        if let Ok(cs) = CStr::from_bytes_until_nul(msg.as_bytes()) {
+            info(cs);
+        }
+    }
+
+    fn flush(&self) {}
+}
+impl IdaLogger {
+    pub fn init() {
+        unsafe {
+            let _ = log::set_logger_racy(&IdaLogger);
+            log::set_max_level(log::LevelFilter::Trace);
+        }
+    }
+}

src/ida/mod.rs

···
+mod bindings;
+mod logging;
+mod plugin_wrapper;

src/ida/plugin_wrapper.rs

···
+use std::{
+    ffi::{c_void, CString},
+    os::raw::c_char,
+    panic::PanicHookInfo,
+    ptr::null_mut,
+    sync::{Mutex, Once},
+};
+
+use log::{error, info, trace};
+
+use super::bindings::fatal;
+use super::logging::IdaLogger;
+
+#[no_mangle]
+#[used]
+static PLUGIN: Plugin = Plugin::new();
+
+static PLUGIN_DATA: Mutex<Option<crate::Plugin>> = Mutex::new(None);
+
+fn handle_panic(pi: &PanicHookInfo) {
+    let msg = pi.to_string();
+    let msg = CString::new(msg).unwrap_or_default();
+    fatal(msg);
+}
+
+fn init_globals() {
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        IdaLogger::init();
+        std::panic::set_hook(Box::new(handle_panic));
+    });
+}
+
+#[repr(C)]
+struct Plugin {
+    version: i32,
+    flags: i32,
+    init: extern "C" fn() -> *mut c_void,
+    term: Option<extern "C" fn()>,
+    run: Option<extern "C" fn(usize) -> bool>,
+    comment: *const c_char,
+    help: *const c_char,
+    wanted_name: *const c_char,
+    wanted_hotkey: *const c_char,
+}
+unsafe impl Sync for Plugin {}
+impl Plugin {
+    const fn new() -> Self {
+        Self {
+            version: 900,
+            flags: 0, //0x08, // 0x08 /* PLUGIN_UNL */,
+            init: Self::init,
+            run: Some(Self::run),
+            term: Some(Self::term),
+            comment: c"CMT".as_ptr(),
+            help: c"Assists in switching between default and custom lumina servers".as_ptr(),
+            wanted_name: c"Lumina switcher".as_ptr(),
+            wanted_hotkey: c"ALT+L".as_ptr(),
+        }
+    }
+
+    extern "C" fn init() -> *mut c_void {
+        init_globals();
+        trace!("init() called");
+
+        let mut lock = PLUGIN_DATA.lock().unwrap();
+        if lock.is_none() {
+            if let Some(x) = crate::Plugin::new() {
+                *lock = Some(x);
+            } else {
+                error!("failed to init plugin");
+                return null_mut();
+            }
+        }
+
+        2 as _
+    }
+
+    extern "C" fn run(arg: usize) -> bool {
+        trace!("run({arg}) called");
+        let mut lock = PLUGIN_DATA.lock().unwrap();
+        if let Some(plugin) = lock.as_mut() {
+            return plugin.run(arg);
+        }
+        true
+    }
+
+    extern "C" fn term() {
+        info!("term() called");
+        let mut lock = PLUGIN_DATA.lock().unwrap();
+        lock.take();
+    }
+}

src/lib.rs

···
+#![feature(c_variadic)]
+
+use std::ffi::c_void;
+
+use log::{error, info, trace, warn};
+use platform::Module;
+
+mod ida;
+mod platform;
+
+const ANCHOR_STR: &[u8] = b"2.5.4.3";
+
+fn get_verify_function_addr() -> Option<usize> {
+    let module = match Module::get_module_by_name(&["ida64.dll", "ida.dll"]) {
+        Ok(None) => {
+            error!("IDA64 module not found!");
+            return None;
+        }
+        Ok(Some(v)) => v,
+        Err(err) => {
+            error!("Failed to enumerate modules! err={err}");
+            return None;
+        }
+    };
+    trace!("ida @ 0x{:06x}", module.get_base());
+    let cert_field_str_addr = match module.find_in_image(ANCHOR_STR, 8) {
+        None => {
+            error!("anchor not found!");
+            return None;
+        }
+        Some(v) => v,
+    };
+    trace!("anchor string found @ 0x{cert_field_str_addr:06x}, finding xrefs");
+    let mut xrefs = module.xrefs_to(cert_field_str_addr);
+    let xref = xrefs.next()?;
+    if xrefs.next().is_some() {
+        warn!("more than 1 xrefs found!");
+    }
+    trace!("xref @ {xref:08x} ({:08x})", xref - module.get_base());
+
+    let is_cert_valid = module.find_prologue(xref)?;
+    trace!("cert_valid_offset @ {is_cert_valid:08x}");
+
+    Some(is_cert_valid)
+}
+
+/// IDA 9.1: Size 0xE0
+#[repr(C)]
+struct IdaTlsConnection {
+    vtable: *const c_void,
+}
+
+struct Plugin {
+    verify_cert_detour: retour::GenericDetour<extern "C" fn(thus: *mut IdaTlsConnection) -> bool>,
+}
+impl Plugin {
+    extern "C" fn patch_is_cert_valid(this: *mut IdaTlsConnection) -> bool {
+        trace!("patch_is_cert_valid(this={this:p})");
+
+        true
+    }
+
+    pub fn new() -> Option<Self> {
+        let cert_offset = get_verify_function_addr()?;
+
+        let verify_cert_detour = unsafe {
+            retour::GenericDetour::new::<extern "C" fn(thus: *mut IdaTlsConnection) -> bool>(
+                std::mem::transmute(cert_offset),
+                Self::patch_is_cert_valid,
+            )
+        }
+        .inspect_err(|err| {
+            error!("failed to init detour: {err}");
+        })
+        .ok()?;
+        unsafe {
+            if let Err(err) = verify_cert_detour.enable() {
+                error!("failed to enable detour: {err}");
+                return None;
+            }
+        }
+
+        Some(Self { verify_cert_detour })
+    }
+
+    pub fn run(&mut self, _: usize) -> bool {
+        let is_enabled = self.verify_cert_detour.is_enabled();
+        let res = unsafe {
+            if is_enabled {
+                self.verify_cert_detour.disable()
+            } else {
+                self.verify_cert_detour.enable()
+            }
+        };
+        if let Err(err) = res {
+            error!("failed to toggle detour: {err}");
+        } else {
+            if is_enabled {
+                info!("detour disabled")
+            } else {
+                info!("detour enabled");
+            }
+        }
+        true
+    }
+}
+impl Drop for Plugin {
+    fn drop(&mut self) {
+        trace!("cleaning up...");
+        unsafe {
+            _ = self.verify_cert_detour.disable();
+        }
+    }
+}

src/platform/mod.rs

···
+#[cfg(target_os = "windows")]
+mod windows;
+
+#[cfg(target_os = "windows")]
+use self::windows as plat;
+
+pub use plat::Module;

src/platform/windows.rs

···
+use std::marker::PhantomData;
+use std::ptr::addr_of;
+use windows::Win32::{
+    Foundation::CloseHandle,
+    System::Diagnostics::{
+        Debug::{ImageNtHeader, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SECTION_HEADER},
+        ToolHelp::{
+            CreateToolhelp32Snapshot, Module32FirstW, Module32NextW, MODULEENTRY32W,
+            TH32CS_SNAPMODULE,
+        },
+    },
+};
+
+unsafe fn get_name(ptr: *const u16) -> String {
+    let mut len = 0;
+    while unsafe { *ptr.add(len) } != 0 {
+        len += 1;
+    }
+
+    let data = unsafe { core::slice::from_raw_parts(ptr, len) };
+    String::from_utf16_lossy(data)
+}
+
+#[repr(transparent)]
+struct Handle(windows::Win32::Foundation::HANDLE);
+impl From<&Handle> for windows::Win32::Foundation::HANDLE {
+    fn from(val: &Handle) -> Self {
+        val.0
+    }
+}
+impl Drop for Handle {
+    fn drop(&mut self) {
+        unsafe {
+            CloseHandle(self.0);
+        }
+    }
+}
+
+pub struct Module {
+    base: usize,
+}
+
+struct SectionIter<'a> {
+    base: usize,
+    idx: usize,
+    _phantom: std::marker::PhantomData<&'a ()>,
+}
+impl<'a> Iterator for SectionIter<'a> {
+    type Item = Section<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        unsafe {
+            let nt_image = ImageNtHeader(self.base as _);
+            let section_addr_start = addr_of!((*nt_image).OptionalHeader) as usize
+                + (*nt_image).FileHeader.SizeOfOptionalHeader as usize;
+            let sections = core::slice::from_raw_parts(
+                section_addr_start as *const IMAGE_SECTION_HEADER,
+                (*nt_image).FileHeader.NumberOfSections as usize,
+            );
+
+            if self.idx >= sections.len() {
+                return None;
+            }
+
+            loop {
+                let r = &sections[self.idx];
+                self.idx += 1;
+
+                let is_read = (r.Characteristics.0 & (IMAGE_SCN_MEM_READ.0)) != 0;
+
+                if !is_read {
+                    continue;
+                }
+
+                let is_execute = (r.Characteristics.0 & (IMAGE_SCN_MEM_EXECUTE.0)) != 0;
+
+                let start = self.base + r.VirtualAddress as usize;
+                let len = r.Misc.VirtualSize as usize;
+
+                return Some(Section {
+                    base: std::slice::from_raw_parts(start as *const u8, len),
+                    is_execute,
+                });
+            }
+        }
+    }
+}
+
+struct Section<'a> {
+    base: &'a [u8],
+    is_execute: bool,
+}
+
+impl Module {
+    fn walk_sections<'a>(&self) -> impl Iterator<Item = Section<'a>> {
+        SectionIter {
+            base: self.base,
+            idx: 0,
+            _phantom: PhantomData,
+        }
+    }
+
+    pub fn find_in_image(&self, needle: &[u8], alignment: usize) -> Option<usize> {
+        for section_data in self
+            .walk_sections()
+            .filter(|s| !s.is_execute)
+            .map(|v| v.base)
+        {
+            for idx in (0..section_data.len() - needle.len()).step_by(alignment) {
+                let scope = &section_data[idx..][..needle.len()];
+                if scope == needle {
+                    let cert_data_addr = addr_of!(section_data[idx]);
+                    return Some(cert_data_addr as usize);
+                }
+            }
+        }
+
+        None
+    }
+
+    pub fn get_base(&self) -> usize {
+        self.base
+    }
+
+    pub fn get_module_by_name(names: &[&str]) -> Result<Option<Module>, windows::core::Error> {
+        let handle = unsafe { CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0)? };
+        let handle = &Handle(handle);
+
+        let mut entry = MODULEENTRY32W {
+            dwSize: std::mem::size_of::<MODULEENTRY32W>() as _,
+            ..Default::default()
+        };
+
+        if !unsafe { Module32FirstW(handle, &mut entry).as_bool() } {
+            return Err(windows::core::Error::from_win32());
+        }
+
+        loop {
+            let module_base = entry.modBaseAddr as usize;
+            let module_name = unsafe { get_name(entry.szModule.as_ptr()) };
+
+            for name in names {
+                if module_name == *name {
+                    return Ok(Some(Module { base: module_base }));
+                }
+            }
+
+            if unsafe { !Module32NextW(handle, &mut entry).as_bool() } {
+                break;
+            }
+        }
+
+        Ok(None)
+    }
+
+    pub fn xrefs_to(&self, ptr: usize) -> impl Iterator<Item = usize> {
+        self.walk_sections()
+            .filter(|sec| sec.is_execute)
+            .map(move |section| {
+                let ptr = ptr;
+                section
+                    .base
+                    .windows(7)
+                    .filter(move |&b| {
+                        if !(b[0] == 0x4c && b[1] == 0x8d) {
+                            return false;
+                        }
+                        let modrm = b[2];
+                        let mod_bits = (modrm & 0b1100_0000) >> 6;
+                        let rm_bits = modrm & 0b0111;
+                        if mod_bits != 0 || rm_bits != 5 {
+                            return false;
+                        }
+
+                        let displacement = &b[3..];
+
+                        let base = b.as_ptr() as usize + b.len();
+                        let displacement = {
+                            let mut v = [0u8; 4];
+                            v.copy_from_slice(displacement);
+                            i32::from_ne_bytes(v)
+                        };
+
+                        base.wrapping_add_signed(displacement as isize) as usize == ptr
+                    })
+                    .map(|v| v.as_ptr() as usize)
+            })
+            .flatten()
+    }
+
+    pub fn find_prologue(&self, addr: usize) -> Option<usize> {
+        for section in self.walk_sections().filter(|v| v.is_execute) {
+            let start = section.base.as_ptr() as usize;
+            let end = start + section.base.len();
+            if !(start <= addr && addr < end) {
+                continue;
+            }
+            let scan_len = addr - start;
+            let search_space = &section.base[..scan_len];
+            for idx in (2..search_space.len() - 1).filter(|v| v % 0x10 == 0).rev() {
+                let data = &search_space[idx..];
+                if data.len() < 4 {
+                    continue;
+                }
+
+                // alignment data...
+                if !(search_space[idx - 2] == 0xcc && search_space[idx - 1] == 0xcc) {
+                    continue;
+                }
+
+                // REX prefix
+                if !(0x40..=0x4f).contains(&data[0]) {
+                    continue;
+                }
+
+                return Some(idx + search_space.as_ptr() as usize);
+            }
+        }
+        return None;
+    }
+}