Aragonite

https://docs.rs/aragonite/0.1.0
Admin
Aragonite is a set of tools that simplifies generating position-independent shellcode in Rust.
Tokens:8,473
Snippets:102
Trust Score:9.1
Update:3 months ago
Show doc for...
Tokens:
Raw
### Aragonite Library Entry Point

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/lib.rs.html

This snippet sets up the library by disabling the standard library, including the README for documentation, and defining module visibility. It's the foundational setup for the aragonite crate.

```rust
#![no_std]
#![doc = include_str!("../README.md")]

pub mod linux;
pub mod win;

pub use aragonite_macros::aragonite_main;

```

--------------------------------

### Get Module by Name

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.get_module_by_name.html

Walks the loaded modules list from the PEB to find a matching module, case insensitive. Returns the HINSTANCE of the module if found, otherwise None.

```rust
pub fn get_module_by_name(module_name: &str) -> Option<HINSTANCE>
```

--------------------------------

### Get procedure address from module handle

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/mod.rs.html

Parses the module's exports to find a function by its exact name. Requires a module handle and the function name as a string slice.

```rust
pub fn get_proc_address<T>(module_handle: HINSTANCE, func_name: &str) -> Option<T> {
    let dos_header = module_handle as *const IMAGE_DOS_HEADER;
    let module_handle = module_handle as u64;
    let nt_headers =
        (module_handle + unsafe { (*dos_header).e_lfanew as u64 }) as *const IMAGE_NT_HEADERS64;
    let data_directory =
        (&unsafe { (*nt_headers).OptionalHeader.DataDirectory[0] }) as *const IMAGE_DATA_DIRECTORY;
    let export_directory = (module_handle + unsafe { (*data_directory).VirtualAddress as u64 })
        as *const IMAGE_EXPORT_DIRECTORY;
    let address_array = module_handle + unsafe { (*export_directory).AddressOfFunctions as u64 };
    let mut name_array = module_handle + unsafe { (*export_directory).AddressOfNames as u64 };
    let mut name_ordinals =
        module_handle + unsafe { (*export_directory).AddressOfNameOrdinals as u64 };
    let num_funcs = unsafe { (*export_directory).NumberOfFunctions };
    for _ in 0..num_funcs {
        let name_offset = unsafe { *(name_array as *const u32) };

```

--------------------------------

### Macro to get procedure address from module handle

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/mod.rs.html

Use this macro to get the address of an exported function from a module, given its handle and the function's type. It simplifies the process of calling `get_proc_address`.

```rust
#[macro_export]
macro_rules! __get_proc_addr_x64 {
    ($handle:expr, $func:ty) => {
        aragonite::win::x64::pebwalk::get_proc_address::<$func>($handle, stringify!($func))
    };
}
```

--------------------------------

### Macro to get procedure address from module name

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/mod.rs.html

Use this macro to find a function within a loaded module by its name. It first finds the module handle and then retrieves the procedure address.

```rust
#[macro_export]
macro_rules! __get_proc_from_module_x64 {
    ($module_name:literal, $func:ty) => {
        match aragonite::win::x64::pebwalk::get_module_by_name($module_name) {
            Some(handle) => aragonite::win::x64::pebwalk::get_proc_addr!(handle, $func),
            None => None,
        }
    };
}
```

--------------------------------

### Linux x64 Syscall with 5 Arguments

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with five arguments. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
/// Performs a syscall with five arguments
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall5(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        in("rsi") arg2,
        in("rdx") arg3,
        in("r10") arg4,
        in("r8") arg5,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Configuring aragonite_main with Arguments

Source: https://docs.rs/aragonite/0.1.0/aragonite/attr.aragonite_main.html

Customize the behavior of the `#[aragonite_main]` macro by providing arguments. Specify the 'family' for platform-specific cleanup (e.g., 'win', 'linux') and the 'arch' for architecture-specific code (defaulting to 'x64').

```rust
#[aragonite_main(family = "win", arch = "x64")]
fn main() {
    // Windows x64 specific logic
}
```

```rust
#[aragonite_main(family = "linux")]
fn main() {
    // Linux specific logic (uses default arch = "x64")
}
```

--------------------------------

### Linux x64 Syscall with 3 Arguments

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with three arguments. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
/// Performs a syscall with three arguments
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall3(syscall: usize, arg1: usize, arg2: usize, arg3: usize) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        in("rsi") arg2,
        in("rdx") arg3,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Linux x64 Syscall with 6 Arguments

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with six arguments. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
/// Performs a syscall with six arguments
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall6(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
    arg6: usize,
) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        in("rsi") arg2,
        in("rdx") arg3,
        in("r10") arg4,
        in("r8") arg5,
        in("r9") arg6,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Linux x64 Syscall with 4 Arguments

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with four arguments. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
/// Performs a syscall with four arguments
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall4(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        in("rsi") arg2,
        in("rdx") arg3,
        in("r10") arg4,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Linux x64 Syscall with 2 Arguments

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with two arguments. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
/// Performs a syscall with two arguments
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall2(syscall: usize, arg1: usize, arg2: usize) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        in("rsi") arg2,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Linux x64 Syscall with 1 Argument

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with a single argument. Ensure the environment is x64 Linux and arguments adhere to the syscall ABI.

```rust
#![allow(dead_code)]
use core::arch::asm;

/// Performs a syscall with one argument
///
/// # Safety
/// - ensure running on x64 arch linux
/// - ensure all arguments match the underlying syscall ABI
#[inline(always)]
pub unsafe fn syscall1(syscall: usize, arg1: usize) -> usize {
    let ret: usize;
    asm!(
        "syscall",
        in("rax") syscall,
        in("rdi") arg1,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
        options(nostack),
    );
    ret
}
```

--------------------------------

### Aragonite Main Attribute for Windows

Source: https://docs.rs/aragonite/0.1.0/aragonite/index.html

Annotate your main function with `#[aragonite_main(family = "win")]` to enable automatic cleanup by calling `ExitProcess(0)` on Windows targets.

```rust
#[aragonite_main(family = "win")]
fn main() {
    // my code here, will automatically call ExitProcess(0) at the end of the function
}
```

--------------------------------

### Aragonite Main Attribute for Windows x64

Source: https://docs.rs/aragonite/0.1.0/aragonite/index.html

Use `#[aragonite_main(family = "win", arch = "x64")]` to specify Windows x64 targets. This ensures the correct ABI is used for functions like `ExitProcess(0)`.

```rust
#[aragonite_main(family = "win", arch = "x64")]
fn main() {
    // my code here, the code for ExitProcess(0) will assume it's running in a 64-bit process
}
```

--------------------------------

### Basic Usage of aragonite_main Macro

Source: https://docs.rs/aragonite/0.1.0/aragonite/attr.aragonite_main.html

Apply the `#[aragonite_main]` macro to your main function to enable automatic generation of cleanup code. This is the simplest way to integrate Aragonite's safety features.

```rust
#[aragonite_main]
fn main() {
    // Your application logic here
}
```

--------------------------------

### Define __get_proc_addr_x64 Macro

Source: https://docs.rs/aragonite/0.1.0/aragonite/macro.__get_proc_addr_x64.html

This macro defines the __get_proc_addr_x64 functionality. It takes a module handle and a type representing the function to find.

```rust
macro_rules! __get_proc_addr_x64 {
    ($handle:expr, $func:ty) => { ... };
}
```

--------------------------------

### Declare x64 Module

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/mod.rs.html

Declares the x64 module for Linux.

```Rust
1pub mod x64;

```

--------------------------------

### syscall5

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall5.html

Performs a system call with five arguments. This function is unsafe and requires specific conditions to be met for correct operation.

```APIDOC
## Function syscall5

### Summary
```
pub unsafe fn syscall5(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
) -> usize
```

### Description
Performs a syscall with five arguments.

### Safety
* ensure running on x64 arch linux
* ensure all arguments match the underlying syscall ABI
```

--------------------------------

### Export syscall module

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/mod.rs.html

This snippet shows the public module declaration for the syscall functionality within the aragonite Linux x64 platform.

```rust
1pub mod syscall;

```

--------------------------------

### Declare Public Module

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/mod.rs.html

Declares the 'pebwalk' module as public within the current module.

```rust
1pub mod pebwalk;

```

--------------------------------

### syscall6

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall6.html

Performs a system call with six arguments. This function is unsafe and requires specific conditions to be met for correct operation.

```APIDOC
## Function: syscall6

### Description
Performs a syscall with six arguments. This is an unsafe function that requires the caller to ensure specific conditions are met.

### Signature
```rust
pub unsafe fn syscall6(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
    arg6: usize,
) -> usize
```

### Safety
This function is unsafe because it performs a raw system call. The caller must ensure:

* The code is running on an x64 architecture Linux system.
* All provided arguments (`syscall`, `arg1` through `arg6`) correctly match the expected types and values for the underlying syscall ABI.
```

--------------------------------

### syscall3

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall3.html

Performs a syscall with three arguments. This function is unsafe and requires specific conditions to be met.

```APIDOC
## Function syscall3

### Signature
```rust
pub unsafe fn syscall3(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
) -> usize
```

### Description
Performs a syscall with three arguments.

### Safety
- Ensure running on x64 arch Linux.
- Ensure all arguments match the underlying syscall ABI.
```

--------------------------------

### Define __get_proc_from_module_x64 Macro

Source: https://docs.rs/aragonite/0.1.0/aragonite/macro.__get_proc_from_module_x64.html

This macro defines the __get_proc_from_module_x64 functionality. It takes a module name literal and a type as arguments.

```rust
macro_rules! __get_proc_from_module_x64 {
    ($module_name:literal, $func:ty) => { ... };
}
```

--------------------------------

### syscall4

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall4.html

Performs a syscall with four arguments. This function is unsafe and requires specific conditions to be met for correct operation.

```APIDOC
## Function syscall4

### Summary
```
pub unsafe fn syscall4(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
) -> usize
```

### Description
Performs a syscall with four arguments.

### Safety
- Ensure running on x64 arch linux.
- Ensure all arguments match the underlying syscall ABI.
```

--------------------------------

### syscall2

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with two arguments. This function is unsafe and requires the caller to ensure the correct architecture, OS, and ABI compliance.

```APIDOC
## syscall2

### Description
Performs a syscall with two arguments.

### Safety
- Ensure running on x64 arch linux
- Ensure all arguments match the underlying syscall ABI

### Signature
`pub unsafe fn syscall2(syscall: usize, arg1: usize, arg2: usize) -> usize`

### Parameters
- `syscall` (usize): The syscall number.
- `arg1` (usize): The first argument to the syscall.
- `arg2` (usize): The second argument to the syscall.

### Returns
- `usize`: The return value of the syscall.
```

--------------------------------

### get_module_by_name

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/index.html

Walks the list of loaded modules in the PEB to find a module that matches the given name, performing a case-insensitive comparison.

```APIDOC
## fn get_module_by_name(module_name: &str) -> Option<ModuleInfo>

### Description
Walks the loaded modules list from the PEB to find a matching module, case insensitive.

### Parameters
* **module_name** (&str) - The name of the module to find.

### Returns
An `Option<ModuleInfo>` containing information about the module if found, otherwise `None`.
```

--------------------------------

### syscall1 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall1.html

This is the function signature for `syscall1`. It takes a syscall number and one argument, returning a usize. Ensure you are on an x64 Linux system and that arguments match the syscall ABI.

```rust
pub unsafe fn syscall1(syscall: usize, arg1: usize) -> usize
```

--------------------------------

### get_proc_addr Macro

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/macro.get_proc_addr.html

This macro takes a HANDLE to a loaded module and a Type whose name matches one of the functions exported by the module. It returns an Option<Type> containing Type if a function of the name Type was found within the HANDLE's exports.

```APIDOC
## get_proc_addr

### Description
Retrieves the address of a function exported by a loaded module.

### Syntax
```rust
macro_rules! get_proc_addr {
    ($handle:expr, $func:ty) => { ... };
}
```

### Parameters
* `$handle` - A `HANDLE` to a loaded module.
* `$func` - A `Type` whose name matches one of the functions exported by the module.

### Returns
An `Option<Type>` containing `Type` if a function of the name `Type` was found within the `HANDLE`’s exports, otherwise `None`.
```

--------------------------------

### Disabling Cleanup and Panic Handlers with aragonite_main

Source: https://docs.rs/aragonite/0.1.0/aragonite/attr.aragonite_main.html

Control the automatic generation of cleanup and panic handling code using the `no_cleanup` and `no_panic` flags within the `#[aragonite_main]` macro. Use these options when you need to manage these aspects manually.

```rust
#[aragonite_main(no_cleanup)]
fn main() {
    // Application logic without automatic cleanup
}
```

```rust
#[aragonite_main(no_panic)]
fn main() {
    // Application logic without automatic panic handler
}
```

```rust
#[aragonite_main(no_cleanup, no_panic)]
fn main() {
    // Application logic with neither automatic cleanup nor panic handler
}
```

--------------------------------

### __readgsqword

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.__readgsqword.html

Reads a 64-bit value from a specified offset at the GS register. This function is unsafe and requires the caller to ensure the execution is on an x64 architecture.

```APIDOC
## __readgsqword

### Description
Reads a qword (64-bit value) from a specified offset relative to the GS register.

### Signature
```rust
pub unsafe fn __readgsqword(offset: u64) -> u64
```

### Parameters
#### Path Parameters
- **offset** (u64) - Description: The offset from the GS register to read from.

### Safety
This function is unsafe. The caller must ensure that the code is running on an x64 architecture before invoking it.
```

--------------------------------

### get_module_by_name

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.get_module_by_name.html

Searches the loaded modules list from the PEB for a matching module name in a case-insensitive manner. Returns an Option containing the HINSTANCE if found, otherwise None.

```APIDOC
## get_module_by_name

### Description
Walks the loaded modules list from the PEB to find a matching module, case insensitive.

### Signature
```rust
pub fn get_module_by_name(module_name: &str) -> Option<HINSTANCE>
```

### Parameters
#### Path Parameters
- **module_name** (string) - Required - The name of the module to search for (case-insensitive).

### Returns
- **Option<HINSTANCE>** - An `Option` containing the `HINSTANCE` of the found module, or `None` if the module is not found.
```

--------------------------------

### syscall6 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall6.html

Defines the signature for performing a syscall with six arguments. Ensure running on x64 arch Linux and that all arguments match the underlying syscall ABI.

```rust
pub unsafe fn syscall6(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
    arg6: usize,
) -> usize
```

--------------------------------

### syscall1

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/linux/x64/syscall/mod.rs.html

Performs a syscall with one argument. This function is unsafe and requires the caller to ensure the correct architecture, OS, and ABI compliance.

```APIDOC
## syscall1

### Description
Performs a syscall with one argument.

### Safety
- Ensure running on x64 arch linux
- Ensure all arguments match the underlying syscall ABI

### Signature
`pub unsafe fn syscall1(syscall: usize, arg1: usize) -> usize`

### Parameters
- `syscall` (usize): The syscall number.
- `arg1` (usize): The first argument to the syscall.

### Returns
- `usize`: The return value of the syscall.
```

--------------------------------

### Read QWORD from GS Register Offset (x64)

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.__readgsqword.html

Use this function to read a 64-bit value from a specified offset within the GS register. Ensure the code is running on an x64 architecture before calling.

```rust
pub unsafe fn __readgsqword(offset: u64) -> u64
```

--------------------------------

### get_proc_addr Macro Definition

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/macro.get_proc_addr.html

This macro takes a HANDLE to a loaded module and a Type whose name matches one of the functions exported by the module. It returns an Option<Type> containing the function's address if found.

```rust
macro_rules! get_proc_addr {
    ($handle:expr, $func:ty) => { ... };
}
```

--------------------------------

### syscall3 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall3.html

This is the function signature for syscall3, which performs a system call with three arguments on x64 Linux. Ensure the architecture and ABI are correctly matched before use.

```rust
pub unsafe fn syscall3(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
) -> usize
```

--------------------------------

### syscall2 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall2.html

This is the function signature for `syscall2`. It performs a system call with two arguments and returns a `usize`.

```rust
pub unsafe fn syscall2(syscall: usize, arg1: usize, arg2: usize) -> usize
```

--------------------------------

### C-String Length Calculation (no_std)

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/utils.rs.html

Calculates the length of a null-terminated C-style string from a raw pointer. Supports no_std environments.

```rust
pub fn c_strlen(ptr: *const u8) -> usize {
    let mut i = 0;
    unsafe {
        let mut curr = *(ptr.add(i));
        while curr != 0 {
            i += 1;
            curr = *(ptr.add(i));
        }
    }
    i
}
```

--------------------------------

### syscall5 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall5.html

This is the function signature for syscall5, which performs a system call with five arguments. Ensure you are on an x64 arch Linux system and that all arguments match the underlying syscall ABI.

```rust
pub unsafe fn syscall5(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
    arg5: usize,
) -> usize
```

--------------------------------

### get_proc_address

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.get_proc_address.html

Parses the module exports to find the function with the exact match name.

```APIDOC
## get_proc_address

### Description
Parses the module exports to find the function with the exact match name.

### Signature
```rust
pub fn get_proc_address<T>(
    module_handle: HINSTANCE,
    func_name: &str,
) -> Option<T>
```

### Parameters
* `module_handle` (HINSTANCE): A handle to the module.
* `func_name` (&str): The exact name of the function to find.

### Returns
* `Option<T>`: An Option containing a pointer to the function if found, otherwise None.
```

--------------------------------

### Case-insensitive UTF-16 ASCII String Comparison

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/utils.rs.html

Compares a UTF-16 slice with a string slice case-insensitively, supporting ASCII characters. Useful for comparing Windows API strings.

```rust
pub(crate) fn cmp_utf16_ascii_caseinsensitive(left: &[u16], right: &str) -> bool {
    let left = core::char::decode_utf16(left.iter().copied());
    let right = right.chars();
    for (lc, rc) in core::iter::zip(left, right) {
        let lc = lc.unwrap();
        if lc.to_ascii_lowercase() != rc.to_ascii_lowercase() {
            return false;
        }
    }
    true
}
```

--------------------------------

### get_proc_address

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/index.html

Parses the exports of a module to locate a function with an exact name match.

```APIDOC
## fn get_proc_address(module_name: &str, func_name: &str) -> Option<ty>

### Description
Parses the module exports to find the function with the exact match name.

### Parameters
* **module_name** (&str) - The name of the module containing the exports.
* **func_name** (&str) - The exact name of the function to find.

### Returns
An `Option<ty>` containing the function's address if found, otherwise `None`.
```

--------------------------------

### Slice Comparison (no_std)

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/utils.rs.html

Compares two slices element by element for equality. Supports no_std environments.

```rust
pub fn slicecmp<T: core::cmp::PartialEq>(left: &[T], right: &[T]) -> bool {
    if left.len() != right.len() {
        return false;
    }

    for (l, r) in core::iter::zip(left, right) {
        if l != r {
            return false;
        }
    }
    true
}
```

--------------------------------

### syscall4 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall4.html

This is the function signature for syscall4. It performs a syscall with four arguments. Ensure you are running on an x64 arch Linux and that all arguments match the underlying syscall ABI.

```rust
pub unsafe fn syscall4(
    syscall: usize,
    arg1: usize,
    arg2: usize,
    arg3: usize,
    arg4: usize,
) -> usize
```

--------------------------------

### get_proc_addr

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/index.html

Retrieves the address of a procedure from a loaded module. It takes a module handle and a type representing the procedure to find.

```APIDOC
## fn get_proc_addr(module_name: HANDLE, func: ty) -> Option<ty>

### Description
Retrieves the address of a procedure from a loaded module.

### Parameters
* **module_name** (HANDLE) - Handle to the loaded module.
* **func** (ty) - Type representing the procedure to find.

### Returns
An `Option<ty>` containing the procedure's address if found, otherwise `None`.
```

--------------------------------

### Macro Definition for get_proc_from_module

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/macro.get_proc_from_module.html

Defines the `get_proc_from_module` macro, which takes a module name literal and a function type. The implementation is indicated by `...`.

```rust
macro_rules! get_proc_from_module {
    ($module_name:literal, $func:ty) => { ... };
}
```

--------------------------------

### get_proc_address Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/fn.get_proc_address.html

This is the function signature for `get_proc_address`. It takes a module handle and a function name as input and returns an optional generic type `T`.

```rust
pub fn get_proc_address<T>(
    module_handle: HINSTANCE,
    func_name: &str,
) -> Option<T>
```

--------------------------------

### Aragonite Main Attribute with No Cleanup

Source: https://docs.rs/aragonite/0.1.0/aragonite/index.html

The `no_cleanup` flag can be used with `#[aragonite_main]` to disable the automatic generation of cleanup code, even when a `family` is specified.

```rust
#[aragonite_main(no_cleanup, family = "win")]
fn main() {
    // my code here, no extra code will be added
}
```

--------------------------------

### Traversing PEB_LDR_DATA for Module Information

Source: https://docs.rs/aragonite/0.1.0/src/aragonite/win/x64/pebwalk/mod.rs.html

This Rust code snippet demonstrates how to iterate through the PEB_LDR_DATA structure to find a specific module by its name. It involves unsafe operations to dereference pointers and access memory directly, common in low-level Windows programming.

```rust
let curr_func_name = (module_handle + name_offset as u64) as *const u8;
        let curr_func_name = 
            unsafe { core::slice::from_raw_parts(curr_func_name, c_strlen(curr_func_name)) };
        if slicecmp(curr_func_name, func_name.as_bytes()) {
            let address_array = address_array 
                + (unsafe { *(name_ordinals as *const u16) } as u64 
                    * (core::mem::size_of::<u32>() as u64));
            let func_addr: T = unsafe {
                core::mem::transmute_copy(&(module_handle + *(address_array as *const u32) as u64))
            };
            return Some(func_addr);
        }

        name_array += core::mem::size_of::<u32>() as u64;
        name_ordinals += core::mem::size_of::<u16>() as u64;
```

--------------------------------

### syscall2 Function Signature

Source: https://docs.rs/aragonite/0.1.0/aragonite/linux/x64/syscall/fn.syscall2.html

The syscall2 function performs a system call with two arguments. It requires the system call number and two arguments. The function is unsafe and requires specific safety conditions to be met.

```APIDOC
## syscall2

### Description
Performs a syscall with two arguments.

### Signature
```rust
pub unsafe fn syscall2(syscall: usize, arg1: usize, arg2: usize) -> usize
```

### Safety
* ensure running on x64 arch linux
* ensure all arguments match the underlying syscall ABI

```

--------------------------------

### get_proc_from_module

Source: https://docs.rs/aragonite/0.1.0/aragonite/win/x64/pebwalk/index.html

Finds a procedure's address within a module specified by its name. This function is case-insensitive when matching module names.

```APIDOC
## fn get_proc_from_module(module_name: &str, func: ty) -> Option<ty>

### Description
Finds a procedure's address within a module specified by its name.

### Parameters
* **module_name** (&str) - The name of the module to search within.
* **func** (ty) - Type representing the procedure to find.

### Returns
An `Option<ty>` containing the procedure's address if found, otherwise `None`.
```
Tokens:
Raw