lazy_importer 0.1.0

Rust port of Justas Masiulis's lazy_importer for Windows module and export resolution.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151

#![no_std]
#![deny(unsafe_op_in_unsafe_fn)]
#![doc = include_str!("../README.md")]

#[cfg(not(windows))]
compile_error!("lazy_importer supports Windows targets only.");

#[cfg(test)]
extern crate std;

mod hash;
mod pe;
mod peb;
mod resolver;
mod types;

#[doc(hidden)]
pub mod __private {
    pub use const_random::const_random;

    pub use crate::hash::khash;
    pub use crate::resolver::Cache;
}

pub use resolver::{LazyFunction, LazyModule, ModuleHandle};

mod macros;

#[cfg(test)]
mod windows_tests {
    use core::ffi::{c_char, c_int, c_void};

    #[allow(non_snake_case)]
    #[link(name = "kernel32")]
    unsafe extern "system" {
        fn GetCurrentProcessId() -> u32;
        fn GetModuleHandleA(module_name: *const c_char) -> *mut c_void;
        fn GetProcAddress(module: *mut c_void, proc_name: *const c_char) -> *mut c_void;
    }

    #[allow(non_snake_case)]
    #[link(name = "user32")]
    unsafe extern "system" {
        fn MessageBoxA(
            window: *mut c_void,
            text: *const c_char,
            caption: *const c_char,
            typ: u32,
        ) -> c_int;
    }

    #[test]
    fn resolves_loaded_module() {
        let module = crate::li_module!("KERNEL32.DLL").get();
        assert!(module.is_some());
    }

    #[cfg(feature = "case-insensitive")]
    #[test]
    fn resolves_loaded_module_case_insensitively() {
        let module = crate::li_module!("kernel32.dll").get();
        assert!(module.is_some());
    }

    #[test]
    fn resolves_and_invokes_export() {
        type GetCurrentProcessIdFn = unsafe extern "system" fn() -> u32;

        let function = unsafe {
            crate::li_fn!(GetCurrentProcessId)
                .get::<GetCurrentProcessIdFn>()
                .expect("GetCurrentProcessId should resolve")
        };

        let direct = unsafe { GetCurrentProcessId() };
        let resolved = unsafe { function() };

        assert_eq!(resolved, direct);
    }

    #[test]
    fn resolves_export_in_module() {
        type GetCurrentProcessIdFn = unsafe extern "system" fn() -> u32;

        let kernel32 = crate::li_module!("KERNEL32.DLL")
            .get()
            .expect("kernel32 should resolve");
        let function = unsafe {
            crate::li_fn!(GetCurrentProcessId)
                .get_in::<GetCurrentProcessIdFn>(kernel32)
                .expect("GetCurrentProcessId should resolve in kernel32")
        };

        assert_eq!(unsafe { function() }, unsafe { GetCurrentProcessId() });
    }

    #[test]
    fn resolves_message_box_a() {
        type MessageBoxAFn =
            unsafe extern "system" fn(*mut c_void, *const c_char, *const c_char, u32) -> c_int;

        core::hint::black_box(MessageBoxA as *const ());

        let lazy_message_box = crate::li_fn!(MessageBoxA);
        let address = lazy_message_box
            .address()
            .expect("MessageBoxA address should resolve");
        let function = unsafe {
            lazy_message_box
                .get::<MessageBoxAFn>()
                .expect("MessageBoxA should resolve")
        };

        assert_eq!(address.as_ptr(), function as *const () as *mut c_void);
    }

    #[test]
    fn resolves_api_set_forwarded_export() {
        let kernel32 = crate::li_module!("KERNEL32.DLL")
            .get()
            .expect("kernel32 should resolve");
        let export = crate::li_fn!("SetProcessMitigationPolicy");
        let raw = export
            .raw_address_in(kernel32)
            .expect("kernel32!SetProcessMitigationPolicy should exist");
        let exports = unsafe {
            crate::pe::ExportsDirectory::new(kernel32.as_non_null())
                .expect("kernel32 export directory should parse")
        };

        assert!(
            exports.is_forwarded(raw),
            "SetProcessMitigationPolicy should be a forwarded export"
        );

        let resolved_in_module = export
            .address_in(kernel32)
            .expect("API-set forwarded export should resolve to its host DLL");
        let resolved_global = export
            .address()
            .expect("API-set forwarded export should resolve globally");
        let kernel32_direct = unsafe { GetModuleHandleA(c"kernel32.dll".as_ptr()) };
        assert!(!kernel32_direct.is_null());

        let expected =
            unsafe { GetProcAddress(kernel32_direct, c"SetProcessMitigationPolicy".as_ptr()) };
        assert!(!expected.is_null());
        assert_eq!(resolved_in_module.as_ptr(), expected);
        assert_eq!(resolved_global.as_ptr(), expected);
    }
}