Crate manualmap 

Available on Windows only.

Manual PE mapping: relocations, IAT rewrite, section permissions, TLS.

read_and_map_module loads a file, maps it, and returns (PeMetadata, base). manually_map_module does the same from a buffer. Set clean_dos_header to wipe MZ / DOS stub IOCs.

let (_pe, base) = manualmap::read_and_map_module(
    r"C:\Windows\System32\ntdll.dll",
    true,
    false,
).unwrap();

Functions

add_runtime_table

get_pe_metadata

Retrieves PE headers information from the module base address.

get_runtime_table

Returns a pair containing a pointer to the Exception data of an arbitrary module and the size of the
corresponding PE section (.pdata). In case that it fails to retrieve this information, it returns null values.

manually_map_module

Manually maps a PE into the current process.

map_module_to_memory

Maps a module to a valid memory space in the current process.

map_to_allocated_memory

map_to_section

Map a module to a memory section.

read_and_map_module

Manually maps a PE from disk to the memory of the current process.

relocate_module

Relocates a module in memory.

rewrite_module_iat

Rewrites the IAT of a manually mapped module.

run_tls_callbacks

Executes any registered TLS Callback function.

set_module_section_permissions

Sets correct module section permissions for a manually mapped module.