memexec

A library for loading and executing PE (Portable Executable) from memory without ever touching the disk

Features

• Applicable to EXE and DLL (except .NET assembly)
• Cross-architecture, applicable to x86 and x86-64
• Zero-dependency
• Contains a simple, zero-copy PE parser submodule
• Provides an IAT hooking interface

Install

```toml

Cargo.toml

[dependencies] memexec = "0.2" ```

Usage

Execute from memory

⚠The architecture of target program must be same as current process, otherwise an error will occur

```rust use memexec; use std::fs::File; use std::io::Read;

/******************/ / EXE / /******************/ let mut buf = Vec::new(); File::open("./test.exe") .unwrap() .readtoend(&mut buf) .unwrap();

unsafe { // If you need to pass command line parameters, // try to modify PEB's command line buffer // Or use memexec_exe_with_hooks to hook related functions (see below) memexec::memexec_exe(&buf).unwrap(); }

/******************/ / DLL / /******************/ let mut buf = Vec::new(); File::open("./test.dll") .unwrap() .readtoend(&mut buf) .unwrap();

use memexec::peloader::def::DLLPROCESSATTACH; unsafe { // DLL's entry point is DllMain memexecdll(&buf, 0 as _, DLLPROCESS_ATTACH, 0 as _).unwrap(); } ```

IAT hooking

Add the hook feature in Cargo.toml

toml [dependencies] memexec = { version="0.2", features=[ "hook" ] }

Hook the __wgetmainargs function (see example/hook.rs)

```rust let mut buf = Vec::new(); File::open("./test.x64.exe") .unwrap() .readtoend(&mut buf) .unwrap();

let mut hooks = HashMap::new();

unsafe { hooks.insert( "msvcrt.dll!_wgetmainargs".into(), mem::transmute::< extern "win64" fn( *mut i32, *mut *const *const u16, *const cvoid, i32, *const cvoid, ) -> i32, *const cvoid,

(_wgetmainargs), ); memexec::memexecexewithhooks(&buf, &hooks).unwrap(); } ```

The definition of __wgetmainargs (notice the calling convention on different archtectures):

```rust // https://docs.microsoft.com/en-us/cpp/c-runtime-library/getmainargs-wgetmainargs?view=msvc-160 /* int _wgetmainargs ( int *Argc, wchart *Argv, wchart *Env, int _DoWildCard, _startupinfo * _StartInfo) */

[cfg(all(targetarch = "x8664", target_os = "windows"))]

extern "win64" fn _wgetmainargs( _Argc: *mut i32, _Argv: *mut *const *const u16, _Env: *const cvoid, DoWildCard: i32, _StartInfo: *const cvoid, ) -> i32 { unsafe { *Argc = 2; let a0: Vec<_> = "programname\0" .chars() .map(|c| (c as u16).tole()) .collect(); let a1: Vec<_> = "token::whoami\0" .chars() .map(|c| (c as u16).tole()) .collect(); *Argv = [a0.asptr(), a1.asptr()].asptr();

    // Avoid calling destructor
    mem::forget(a0);
    mem::forget(a1);
}

0

} ```

Parse PE

PE parser could parse programs which have different architectures from current process

```rust use memexec::peparser::PE;

// Zero copy // Make sure that the lifetime of buf is longer than pe let pe = PE::new(&buf); println!("{:?}", pe); ```

TODO

• [ ] Replace LoadLibrary with calling load_pe_into_mem recursively

• [ ] Replace GetProcAddress with self-implemented LdrpSnapThunk, so as to support resolving proc address by IMAGE_IMPORT_BY_NAME.Hint

License

The GPLv3 license