analyze-module

To enumerate exports and reconstruct RTTI class hierarchies from a loaded DLL, you analyze the module's PE headers and RTTI descriptors to extract API tables and class relationships. This process provides structured reporting of the module's underlying architecture.

Finding string references and key functions during reverse engineering involves scanning the loaded module to discover text references with cross-reference context. This identifies notable entry points and provides structured data suitable for both tooling and human review.

You cannot analyze a loaded module's RTTI data without external probe tools, as this process requires host tooling such as probe_modules, probe_pattern_scan, or probe_dump. These tools are necessary to access the target process and parse the required PE headers and RTTI descriptors.

To extract RTTI data and exports from a target process automatically, you initiate an automated analysis by specifying the target module name, such as target.dll. The system then parses the loaded module to extract exports, class hierarchies, and string references.

Yes, this module analysis approach works for understanding C++ class structures in memory by leveraging RTTI-based class discovery. It parses RTTI descriptors within the loaded target process to reconstruct the class hierarchy and identify object relationships.