memexec 0.2.0

A library for loading and executing PE (Portable Executable) from memory without ever touching the disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

use super::def::*;
use super::error::Result;
use std::mem;
use std::ptr;

#[repr(C)]
#[derive(Debug)]
pub struct SectionArea<'a> {
    pub section_table: &'a [IMAGE_SECTION_HEADER],
    pub section_data: &'a [u8],
}

impl<'a> SectionArea<'a> {
    pub fn new(bs: &'a [u8], n_sections: u16) -> Result<SectionArea<'a>> {
        let section_table = unsafe {
            &*ptr::slice_from_raw_parts(
                mem::transmute::<*const u8, *const IMAGE_SECTION_HEADER>(bs.as_ptr()),
                n_sections as usize,
            )
        };

        Ok(SectionArea {
            section_table: section_table,
            section_data: &bs[(n_sections as usize) * mem::size_of::<IMAGE_SECTION_HEADER>()..],
        })
    }
}

/*
pub const PAGE_NOACCESS: DWORD = 0x01;
pub const PAGE_READONLY: DWORD = 0x02;
pub const PAGE_READWRITE: DWORD = 0x04;
pub const PAGE_EXECUTE: DWORD = 0x10;
pub const PAGE_EXECUTE_READ: DWORD = 0x20;
pub const PAGE_EXECUTE_READWRITE: DWORD = 0x40;
*/
impl IMAGE_SECTION_HEADER {
    #[inline]
    pub fn can_read(&self) -> bool {
        self.Characteristics & IMAGE_SCN_MEM_READ != 0
    }

    #[inline]
    pub fn can_write(&self) -> bool {
        self.Characteristics & IMAGE_SCN_MEM_WRITE != 0
    }

    #[inline]
    pub fn can_exec(&self) -> bool {
        self.Characteristics & IMAGE_SCN_MEM_EXECUTE != 0
    }

    pub fn get_protection(&self) -> DWORD {
        match self.can_exec() {
            true => match self.can_read() {
                true => match self.can_write() {
                    true => PAGE_EXECUTE_READWRITE,
                    false => PAGE_EXECUTE_READ,
                },
                false => PAGE_EXECUTE,
            },
            false => match self.can_read() {
                true => match self.can_write() {
                    true => PAGE_READWRITE,
                    false => PAGE_READONLY,
                },
                false => PAGE_NOACCESS,
            },
        }
    }
}