memexec 0.2.0

A library for loading and executing PE (Portable Executable) from memory without ever touching the disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use super::def::*;
use super::error::{Error, Result};
use super::header::ImageNtHeaders;

impl IMAGE_DOS_HEADER {
    pub(crate) fn is_valid(&self) -> Result<()> {
        if self.e_magic != IMAGE_DOS_SIGNATURE {
            return Err(Error::InvalidDosSignature);
        }

        if self.e_lfanew == 0 {
            return Err(Error::InvalidNtHeaderOffset);
        }

        Ok(())
    }
}

impl<'a> ImageNtHeaders<'a> {
    pub(crate) fn is_valid(&self) -> Result<()> {
        match *self {
            ImageNtHeaders::x86(h) => {
                if h.Signature != IMAGE_NT_SIGNATURE {
                    return Err(Error::InvalidNtSignature);
                };

                if h.FileHeader.Machine != IMAGE_FILE_MACHINE_I386 {
                    return Err(Error::UnsupportedMachine);
                }

                // 32-bit .NET assembly may not set IMAGE_FILE_32BIT_MACHINE
                if h.FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE == 0
                //    || h.FileHeader.Characteristics & IMAGE_FILE_32BIT_MACHINE == 0
                {
                    return Err(Error::InvalidFileHeaderCharacteristics);
                }
            }
            ImageNtHeaders::x64(h) => {
                if h.Signature != IMAGE_NT_SIGNATURE {
                    return Err(Error::InvalidNtSignature);
                };

                if h.FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 {
                    return Err(Error::UnsupportedMachine);
                }

                if h.FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE == 0
                //    || h.FileHeader.Characteristics & IMAGE_FILE_LARGE_ADDRESS_AWARE == 0
                {
                    return Err(Error::InvalidFileHeaderCharacteristics);
                }
            }
        };

        Ok(())
    }
}