memexec 0.2.0

A library for loading and executing PE (Portable Executable) from memory without ever touching the disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

use super::def::*;
use super::error::{Error, Result};
use std::ffi::CString;
use std::mem;
use std::os::raw::c_char;

extern "system" {
    fn LoadLibraryA(lpLibFileName: LPCSTR) -> HMODULE;
    fn GetProcAddress(hModule: HMODULE, lpProcName: LPCSTR) -> PVOID;
    fn GetCurrentProcess() -> HANDLE;
}

pub fn load_library(lib: &str) -> Result<HMODULE> {
    if let Ok(lib) = CString::new(lib) {
        let hmod = unsafe { LoadLibraryA(lib.as_ptr()) };
        if hmod == 0 as HMODULE {
            Err(Error::LoadLibararyFail)
        } else {
            Ok(hmod)
        }
    } else {
        Err(Error::InvalidCString)
    }
}

pub fn get_proc_address_by_name(hmod: HMODULE, proc_name: &str) -> Result<PVOID> {
    if let Ok(proc_name) = CString::new(proc_name) {
        let proc = unsafe { GetProcAddress(hmod, proc_name.as_ptr()) };
        if proc == 0 as PVOID {
            Err(Error::GetProcAddressFail)
        } else {
            Ok(proc)
        }
    } else {
        Err(Error::InvalidCString)
    }
}

pub fn get_proc_address_by_ordinal(hmod: HMODULE, proc_ordinal: isize) -> Result<PVOID> {
    let proc = unsafe { GetProcAddress(hmod, proc_ordinal as *const c_char) };
    if proc == 0 as PVOID {
        Err(Error::GetProcAddressFail)
    } else {
        Ok(proc)
    }
}

// raw pointer doesn't implement `Sync` trait
static mut p_nt_alloc_vm: usize = 0_usize;
static mut p_nt_protect_vm: usize = 0_usize;

/*
#[link(name = "ntdll")]
extern "system" {
    fn NtAllocateVirtualMemory(
        ProcessHandle: HANDLE,
        BaseAddress: *const PVOID,
        ZeroBits: ULONG_PTR,
        RegionSize: PSIZE_T,
        AllocationType: ULONG,
        Protect: ULONG,
    ) -> NTSTATUS;
}
*/
// bypass possible hooks
pub unsafe fn nt_alloc_vm(
    base_addr: *const PVOID,
    size: PSIZE_T,
    allocation_typ: ULONG,
    protect: ULONG,
) -> Result<()> {
    if p_nt_alloc_vm == 0 as _ {
        p_nt_alloc_vm =
            get_proc_address_by_name(load_library("ntdll.dll")?, "NtAllocateVirtualMemory")? as _;
    };

    let ret = mem::transmute::<
        usize,
        unsafe extern "system" fn(
            HANDLE,
            *const PVOID,
            ULONG_PTR,
            PSIZE_T,
            ULONG,
            ULONG,
        ) -> NTSTATUS,
    >(p_nt_alloc_vm)(
        GetCurrentProcess(),
        base_addr,
        0,
        size,
        allocation_typ,
        protect,
    );

    if 0 == ret {
        Ok(())
    } else {
        Err(Error::NtAllocVmErr(ret))
    }
}

/*
#[link(name = "ntdll")]
extern "system" {
    fn NtProtectVirtualMemory(
        ProcessHandle: HANDLE,
        BaseAddress: *const PVOID,
        RegionSize: PSIZE_T,
        NewProtect: ULONG,
        OldProtect: PULONG,
    ) -> NTSTATUS;
}
*/
pub unsafe fn nt_protect_vm(
    base_addr: *const PVOID,
    size: PSIZE_T,
    new_protect: ULONG,
) -> Result<()> {
    if p_nt_protect_vm == 0 as _ {
        p_nt_protect_vm =
            get_proc_address_by_name(load_library("ntdll.dll")?, "NtProtectVirtualMemory")? as _;
    };

    let old_protect: ULONG = 0;
    let ret = mem::transmute::<
        usize,
        unsafe extern "system" fn(HANDLE, *const PVOID, PSIZE_T, ULONG, PULONG) -> NTSTATUS,
    >(p_nt_protect_vm)(
        GetCurrentProcess(),
        base_addr,
        size,
        new_protect,
        &old_protect as PULONG,
    );

    if 0 == ret {
        Ok(())
    } else {
        Err(Error::NtProtectVmErr(ret))
    }
}