eddieivan01/memexec

A library for loading and executing PE (Portable Executable) from memory without ever touching the disk

Stats

memexec's Issues

[feature] Calling in DLL export function

It would be nice when loading the DLL to call not only DllMain, but to call the Export function by name.

Call `load_pe_into_mem` recursively while handle the IAT, to maintain clean system DLLs in memory

In order to bypass all hookings on ring3 (inline hook, IAT hook), we could load system DLLs from disk while loading the executable, instead of calling LoadLibrary.

But in my testing, I found that loading system DLLs manually is very unstable. It worked well on x64, but crashed at ntdll.dll's .mrdata section on x86.

The detail is in src/peloader/winapi.rs

Convert all `ntdll!Nt*` functions into direct syscall via the IAT hooking interface

memexec_exe should return a handle to the created process

the title says it all

Adding .NET PE support

Hi, do you plain to add the .net PE support ?

运行报错了

thread '' panicked at 'cannot access a Thread Local Storage value during or after destruction: AccessError', library\std\src\thread\local.rs:388:26
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
error: process didn't exit successfully: target\debug\saas.exe (exit code: 0xc0000409, STATUS_STACK_BUFFER_OVERRUN)

exe是用rust写的 直接运行是没问题的