proc_mem_rs/
lib.rs

1#![cfg(windows)]
2#![deny(unsafe_op_in_unsafe_fn)]
3
4/*!
5ProcMem is a minimalistic rust library for dealing with processes, their modules and threads utilizing the winapi.
6(therefore solely targeting windows systems)
7
8The main purpose of ProcMem is to easily get access to running processes, their modules, threads and corresponding memory addresses.
9In addition to that, this crate provides functionality to read/write memory of processes/modules and reading pointer chains.
10
11# Installation
12
13Use the package manager [cargo](https://doc.rust-lang.org/cargo/) to install ProcMem (cargo add proc_mem).
14Or add: "proc_mem = VERSION" into your Cargo.toml file. You can find the newest version [on crates.io](https://crates.io/crates/proc_mem).
15
16# Example: get a running process
17
18In order to get a running process you will have to
19call [`Process::with_name()`], [`Process::with_pid()`] or [`Process::all_with_name()`].
20On success the returned value will be of type: [`Process`].
21
22```rust
23use proc_mem_rs::Process;
24let firefox: Result<Process, ProcMemError>      = Process::with_pid(12345);
25let chrome:  Result<Process, ProcMemError>      = Process::with_name("chrome.exe");
26let vscode: Result<Vec<Process>, ProcMemError>  = Process::all_with_name("Code.exe");
27```
28
29# Example: terminate a process
30
31```rust
32use proc_mem_rs::Process;
33let chrome:  Result<Process, ProcMemError> = Process::with_name("chrome.exe");
34let did_terminate: bool = chrome.kill();
35```
36
37# Example: get a module from a process
38
39To get a module which was loaded by a process
40you just have to call [`Process::module()`].
41which on success will return an instance of [`Module`](crate::process::Module).
42
43```rust
44use proc_mem_rs::{Process, Module};
45let chrome = Process::with_name("chrome.exe")?;
46let desired_module: Result<Module,ProcMemError> = chrome.module("kernel32.dll");
47```
48
49# Example: read/write memory
50
51To read memory you have to call [`Process::read_mem()`].
52This function takes a type and the address to read.
53On success the read value will be returned.
54
55```rust
56use proc_mem_rs::{Process, Module};
57let chrome = Process::with_name("chrome.exe")?;
58let module = chrome.module("kernel32.dll")?;
59let read_value: Result<T, ProcMemError> = chrome.read_mem::<T>(module.base_address() + 0x1337);
60```
61
62To write memory you have to call [`Process::write_mem()`].
63This function takes a type and the address to write to.
64the returned boolean will be true on success and false on failure
65
66```rust
67use proc_mem_rs::{Process, Module};
68let chrome = Process::with_name("chrome.exe")?;
69let module = chrome.module("kernel32.dll")?;
70let write_result: bool = chrome.read_mem::<T>(module.base_address() + 0x1337);
71```
72
73There is also a function to read pointer chains [`Process::read_mem_chain()`].
74This function takes a type and a Vec of addresses/offsets,
75the first entry being the base address to start from.
76On success the read value will be returned.
77
78```rust
79use proc_mem_rs::{Process, Module};
80let chrome = Process::with_name("chrome.exe")?;
81let module = chrome.module("kernel32.dll")?;
82let chain: Vec<usize> = vec![module.base_address(), 0xDEA964, 0x100]
83let read_value: Result<T, ProcMemError> = chrome.read_mem_chain::<T>(chain);
84```
85
86If you dont want to read the value from the end of the chain
87you can use the function: [`Process::read_ptr_chain()`].
88This function takes a Vec of addresses/offsets,
89the first entry being the base address to start from.
90On success the address at the end of the chain will be returned.
91
92```rust
93use proc_mem_rs::{Process, Module};
94let chrome = Process::with_name("chrome.exe")?;
95let module = chrome.module("kernel32.dll")?;
96let chain: Vec<usize> = vec![module.base_address(), 0xDEA964, 0x100]
97let desired_address: Result<usize, ProcMemError> = chrome.read_ptr_chain(chain);
98```
99
100# Example: pattern scanning
101
102It´s a pain to maintain offsets manually, but luckily proc_mem
103provides a way around that issue.
104You can scan modules for byte patterns and get the desired address
105this way.
106
107```rust
108use proc_mem_rs::{Process, Module, Signature};
109let some_game = Process::with_name("some_game.exe")?;
110let module = some_game.module("module.dll")?;
111let lp_signature = Signature {
112    name: "LocalPlayer",
113    pattern: "8D 34 85 ? ? ? ? 89 15 ? ? ? ? 8B 41 08 8B 48 04 83 F9 FF",
114    offsets: vec![3],
115    extra: 4,
116    relative: true,
117    rip_relative: false,
118    rip_offset: 0,
119};
120let lp_address: Result<usize,ProcMemError> = module.find_signature(&lp_signature);
121```
122*/
123
124/// contains data about certain processes
125mod process;
126/// error messages 
127mod errors;
128
129pub use process::Process;
130pub use process::Module;
131pub use process::Signature;
132pub use errors::ProcMemError;
proc_mem_rs/lib.rs

proc_mem_rs/
lib.rs
