How natimerry/glazier works
Glazier is an experimental Windows PE analysis and process-interaction library. A user can parse a PE from disk or inspect a running process: static parsing exposes headers, sections, imports, and exports, while runtime helpers inspect processes, memory, and loaded-module exports. Separate capabilities support pattern scanning and hooks, hardware breakpoints, dynamically resolved APIs, and direct syscalls. The graph reflects README-described capabilities where source excerpts were unavailable; links for those unsampled implementations are limited to paths supported by the tree and README.
Main entry points: pe64_runtime.rs Runtime PE · lib.rs Runtime Helpers · mod.rs Hooking Support · process.rs Process Inspection
Components 19
PE Analysis
- Static PE Parser
crates/pe/src/pe/pe64_static.rs - PE Structures
crates/pe/src/pe
Runtime Inspection
- Runtime Helpers
crates/runtime/src/lib.rs - Process Inspection
crates/runtime/src/runtime/process.rs - Memory Access
crates/runtime/src/runtime/memory.rs - Runtime PE
crates/runtime/src/runtime/pe64_runtime.rs - Export Walking
crates/runtime/src/runtime/exports.rs
Code Instrumentation
- Pattern Scanning
src/hooking/pattern.rs - Hooking Support
src/hooking/mod.rs - Instruction Tracing
src/hooking/trace_instructions.rs - Hardware Breakpoints
src/hardware_breakpoint.rs
API Access
- Raw API Bindings
crates/bindings/src/lib.rs - Dynamic Resolution
crates/winapi/src/resolver.rs - Win32 NT Wrappers
crates/winapi/src/lib.rs - Direct Syscalls
crates/winapi/src/lib.rs
Other components
- Library User
- Windows System
- PE File
- Target Process
Connections 27
- Library User → Static PE Parser: parses
- PE File → Static PE Parser: reads
- Static PE Parser → PE Structures: parses headers
- Library User → Runtime Helpers: uses
- Runtime Helpers → Process Inspection: exposes
- Runtime Helpers → Memory Access: exposes
- Runtime Helpers → Runtime PE: exposes
- Process Inspection → Windows System: queries
- Memory Access → Windows System: reads and writes
- Runtime PE → Memory Access: reads
- Runtime PE → Process Inspection: inspects
- Runtime PE → Export Walking: walks exports
- Target Process → Process Inspection: is inspected
- Library User → Pattern Scanning: scans
- Library User → Hooking Support: installs hooks
- Hooking Support → Memory Access: patches
- Hooking Support → Pattern Scanning: locates targets
- Hooking Support → Instruction Tracing: uses tracing
- Library User → Hardware Breakpoints: sets breakpoints
- Hardware Breakpoints → Windows System: configures
- Raw API Bindings → Windows System: declares APIs
- Library User → Win32 NT Wrappers: calls APIs
- Win32 NT Wrappers → Dynamic Resolution: resolves dynamically
- Dynamic Resolution → Windows System: locates APIs
- Library User → Direct Syscalls: invokes
- Direct Syscalls → Windows System: issues syscall
- Runtime PE → Direct Syscalls: reads syscall numbers