🦀 winproc-rs

A Rust library for interacting with Win32 processes from usermode.

winproc-rs provides safe Rust abstractions over common Win32 process operations while staying close to the Windows API. The goal is simply to make process-related code easier to write.

Features

Currently, the crate exposes helpers for:

• 🔍 Finding processes
• 📂 Opening existing processes
• 📦 Enumerating loaded modules (process.modules())
• 🧵 Enumerating process threads (process.threads())
• 📖 Reading process memory
• ✍️ Writing process memory
• 🗺️ Querying memory regions (VirtualQueryEx)
• 💾 Allocating and freeing remote memory (VirtualAllocEx / VirtualFreeEx)
• 🛡️ Changing page protections (VirtualProtectEx)
• 🚀 Creating remote threads (CreateRemoteThread)
• 📍 Retrieving the executable/modules path of a process

Most Windows resources exposed by the library implement Drop, so handles are automatically released when they go out of scope.

Import resolution

The Win32 APIs used by winproc-rs are resolved through a custom import table instead of the executable's Import Address Table (IAT).

Because of this, the Win32 functions used by the library do not appear in the executable's IAT.

Example

use winproc_rs::{Process, ProcessAccess};

let proc = Process::find_from_name("notepad.exe")?;
let process = Process::open(ProcessAccess::ALL_ACCESS, false, proc[0].th32ProcessID)?;

println!("PID: {}", process.pid());

for module in process.modules()? {
    println!("{:#x} {}", module.base(), module.name()?);
}

let mut buffer = [0u8; 16];
// just for test
process.read_process_memory(0x140000000, &mut buffer)?;

Goals

winproc-rs tries to stay fairly close to the Win32 API while providing a more idiomatic Rust interface.

The crate is intended for projects involving:

• Windows tooling
• Process inspection
• Memory analysis
• Reverse engineering
• Debugging
• Research and experimentation

Status

The crate is still under development and the API may evolve between releases.

Contributions, suggestions and bug reports are always welcome.

License

MIT