maple-rs 0.1.2

A Rust library for loading Windows PE executables and DLLs directly from memory without writing to disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157

use crate::Result;
use std::ffi::OsStr;

pub trait MemoryModule {
    fn get_proc_address(&self, name: &str) -> Result<*const u8>;
    fn get_proc_address_ordinal(&self, ordinal: u16) -> Result<*const u8>;
    fn execute_entry_point(&self) -> Result<()>;
    fn call_dll_entry_point(&self, reason: u32) -> Result<bool>;
    fn execute_dll_application(&self) -> Result<()>;
    fn free(&mut self) -> Result<()>;
    fn is_loaded(&self) -> bool;
    fn base_address(&self) -> *const u8;
    fn size(&self) -> usize;

    // Resource management
    fn find_resource(&self, name: Option<&str>, resource_type: Option<&str>) -> Result<*const u8>;
    fn find_resource_ex(
        &self,
        name: Option<&str>,
        resource_type: Option<&str>,
        language: u16,
    ) -> Result<*const u8>;
    fn sizeof_resource(&self, resource: *const u8) -> Result<usize>;
    fn load_resource(&self, resource: *const u8) -> Result<*const u8>;
    fn load_string(&self, id: u32, buffer: &mut [u16]) -> Result<usize>;
    fn load_string_ex(&self, id: u32, buffer: &mut [u16], language: u16) -> Result<usize>;
}

// Function type definitions for custom callbacks
pub type CustomAllocFunction = fn(
    size: usize,
    allocation_type: u32,
    protect: u32,
    user_data: *mut std::ffi::c_void,
) -> *mut u8;
pub type CustomFreeFunction =
    fn(ptr: *mut u8, size: usize, free_type: u32, user_data: *mut std::ffi::c_void) -> bool;
pub type CustomLoadLibraryFunction =
    fn(filename: &OsStr, user_data: *mut std::ffi::c_void) -> *mut std::ffi::c_void;
pub type CustomGetProcAddressFunction =
    fn(module: *mut std::ffi::c_void, name: &str, user_data: *mut std::ffi::c_void) -> *const u8;
pub type CustomFreeLibraryFunction =
    fn(module: *mut std::ffi::c_void, user_data: *mut std::ffi::c_void) -> bool;

pub struct MemoryModuleBuilder {
    pub resolve_imports: bool,
    pub process_relocations: bool,
    pub call_dll_main: bool,
    pub ignore_missing_imports: bool,
    pub is_application_dll: bool,
    pub alloc_function: Option<CustomAllocFunction>,
    pub free_function: Option<CustomFreeFunction>,
    pub load_library_function: Option<CustomLoadLibraryFunction>,
    pub get_proc_address_function: Option<CustomGetProcAddressFunction>,
    pub free_library_function: Option<CustomFreeLibraryFunction>,
    pub user_data: *mut std::ffi::c_void,
}

impl Default for MemoryModuleBuilder {
    fn default() -> Self {
        Self {
            resolve_imports: true,
            process_relocations: true,
            call_dll_main: true,
            ignore_missing_imports: false,
            is_application_dll: false,
            alloc_function: None,
            free_function: None,
            load_library_function: None,
            get_proc_address_function: None,
            free_library_function: None,
            user_data: std::ptr::null_mut(),
        }
    }
}

impl MemoryModuleBuilder {
    pub fn new() -> Self {
        Self::default()
    }

    pub fn resolve_imports(mut self, resolve: bool) -> Self {
        self.resolve_imports = resolve;
        self
    }

    pub fn process_relocations(mut self, process: bool) -> Self {
        self.process_relocations = process;
        self
    }

    pub fn call_dll_main(mut self, call: bool) -> Self {
        self.call_dll_main = call;
        self
    }

    pub fn ignore_missing_imports(mut self, ignore: bool) -> Self {
        self.ignore_missing_imports = ignore;
        self
    }

    pub fn is_application_dll(mut self, is_app_dll: bool) -> Self {
        self.is_application_dll = is_app_dll;
        self
    }

    pub fn alloc_function(mut self, func: CustomAllocFunction) -> Self {
        self.alloc_function = Some(func);
        self
    }

    pub fn free_function(mut self, func: CustomFreeFunction) -> Self {
        self.free_function = Some(func);
        self
    }

    pub fn load_library_function(mut self, func: CustomLoadLibraryFunction) -> Self {
        self.load_library_function = Some(func);
        self
    }

    pub fn get_proc_address_function(mut self, func: CustomGetProcAddressFunction) -> Self {
        self.get_proc_address_function = Some(func);
        self
    }

    pub fn free_library_function(mut self, func: CustomFreeLibraryFunction) -> Self {
        self.free_library_function = Some(func);
        self
    }

    pub fn user_data(mut self, data: *mut std::ffi::c_void) -> Self {
        self.user_data = data;
        self
    }

    pub fn load_from_memory(self, data: &[u8]) -> Result<Box<dyn MemoryModule>> {
        #[cfg(windows)]
        {
            use crate::windows::WindowsMemoryModule;
            WindowsMemoryModule::from_memory_with_options(data, &self)
                .map(|m| Box::new(m) as Box<dyn MemoryModule>)
        }

        #[cfg(unix)]
        {
            use crate::linux::LinuxMemoryModule;
            LinuxMemoryModule::from_memory_with_options(data, &self)
                .map(|m| Box::new(m) as Box<dyn MemoryModule>)
        }
    }
}

pub const DLL_PROCESS_ATTACH: u32 = 1;
pub const DLL_THREAD_ATTACH: u32 = 2;
pub const DLL_THREAD_DETACH: u32 = 3;
pub const DLL_PROCESS_DETACH: u32 = 0;