wraith-rs 0.1.8

Safe abstractions for Windows PEB/TEB manipulation and anti-detection techniques
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

//! Example: Display process memory map
//!
//! Run with: cargo run --example memory_map --features navigation

use wraith::navigation::{MemoryRegionIterator, MemoryState, MemoryType};

fn main() {
    println!("Process Memory Map:");
    println!("{:-<100}", "");
    println!(
        "{:>18} {:>12} {:>10} {:>10} {:>10}",
        "Address", "Size", "State", "Protect", "Type"
    );
    println!("{:-<100}", "");

    for region in MemoryRegionIterator::new() {
        if region.state == MemoryState::Free {
            continue; // skip free regions
        }

        let state_str = match region.state {
            MemoryState::Commit => "Commit",
            MemoryState::Reserve => "Reserve",
            MemoryState::Free => "Free",
        };

        let type_str = match region.memory_type {
            MemoryType::Image => "Image",
            MemoryType::Mapped => "Mapped",
            MemoryType::Private => "Private",
            MemoryType::Unknown => "Unknown",
        };

        let protect_str = region.protection_string();

        println!(
            "{:#018x} {:>12} {:>10} {:>10} {:>10}",
            region.base_address,
            format_size(region.region_size),
            state_str,
            protect_str,
            type_str
        );
    }
}

fn format_size(size: usize) -> String {
    if size >= 1024 * 1024 {
        format!("{} MB", size / (1024 * 1024))
    } else if size >= 1024 {
        format!("{} KB", size / 1024)
    } else {
        format!("{} B", size)
    }
}