ProcessGhosting 0.1.0

Process Ghosting technique implementation - Execute PE files from memory without leaving traces on disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

//! Comprehensive error handling example
//! Author: BlackTechX

use process_ghosting::{GhostingBuilder, init, parse_hex_string};

fn main() {
    init();

    println!("[*] Error Handling Example\n");

    // Test 1: Invalid file
    println!("[Test 1] Loading non-existent file:");
    match GhostingBuilder::from_file("nonexistent.exe") {
        Ok(_) => println!("    Unexpected success"),
        Err(e) => println!("    Expected error: {}", e),
    }
    println!();

    // Test 2: Invalid hex string
    println!("[Test 2] Parsing invalid hex:");
    match parse_hex_string("ZZZZ") {
        Ok(_) => println!("    Unexpected success"),
        Err(e) => println!("    Expected error: {}", e),
    }
    println!();

    // Test 3: Invalid PE (not MZ header)
    println!("[Test 3] Executing invalid PE:");
    let invalid_pe = vec![0x00, 0x00, 0x00, 0x00]; // Not MZ
    match GhostingBuilder::new(&invalid_pe).x64().execute() {
        Ok(_) => println!("    Unexpected success"),
        Err(e) => println!("    Expected error: {}", e),
    }
    println!();

    // Test 4: Empty payload
    println!("[Test 4] Empty payload:");
    match GhostingBuilder::new(&[]).x64().execute() {
        Ok(_) => println!("    Unexpected success"),
        Err(e) => println!("    Expected error: {}", e),
    }
    println!();

    // Test 5: Truncated PE
    println!("[Test 5] Truncated PE (only MZ header):");
    let truncated_pe = vec![0x4D, 0x5A]; // Just MZ
    match GhostingBuilder::new(&truncated_pe).x64().execute() {
        Ok(_) => println!("    Unexpected success"),
        Err(e) => println!("    Expected error: {}", e),
    }
    println!();

    println!("[*] Error handling tests complete.");
}