Marina v1.0

Marina v1.0: A Reflective PE Loader

Hey everyone! I'm excited to release the first version of Marina, a C# tool I built to learn about reflective PE loading.

This project is my attempt to show the low-level steps the Windows loader takes to run an .exe or .dll. It's a cool tool for anyone curious about Windows internals or security research.

What It Can Do

• Read PE Headers: Parses the DOS, NT (File/Optional), and Section headers for both 32-bit and 64-bit files.
• Map to Memory: Correctly takes a file's disk layout and maps it to a virtual memory layout.
• Patch Relocations: Fixes all the hardcoded addresses in the code so it can run from any memory location (not just the one it was compiled for).
• Fix Imports (IAT): Finds all the Windows functions the program needs (like MessageBoxA) and patches in the real memory addresses using LoadLibrary and GetProcAddress.
• Run It: Can "jump" to the program's starting point, either by launching a new thread (for EXEs) or calling DllMain (for DLLs).
• Handle TLS: It can even run Thread-Local Storage (TLS) callbacks, which some programs need before their main code starts.

v1.0: It's Now Tested Automatically!

The biggest new feature is a CI/CD pipeline using GitHub Actions. This isn't just a simple compile check; it's a full end-to-end test.

Here's what it does on every push:

1. Builds my Marina.exe loader on a Windows runner.
2. Creates a tiny, custom C-based executable (minimal_ci.exe) right in the workflow.
3. Runs Marina.exe and tells it to load the minimal_ci.exe.
4. Marina then reflectively loads the C app into its own memory, patches it, and runs it.
5. The C app prints a "magic string" (MAGIC_STRING_SUCCESS) to the console.
6. The workflow checks for that string. If it's there, the test passes!

This pipeline makes sure that every commit to master results in a fully working loader.

Warning

Security & Usage Warning

Just a heads-up: this is an educational tool, not a production-grade loader. It's powerful and bypasses all normal OS security.

• Architecture: Your Marina.exe's architecture MUST match the target PE's architecture (e.g., build Marina as x86 to load x86 PEs).

• CRT Dependency: This loader CANNOT run complex apps (like BakkesModSetup.exe) that need the C/C++ Runtime (CRT). The CRT requires a ton of extra setup (like security cookies and exception tables) that I haven't built.

• Test PEs: This loader only works with simple PEs, like the minimal.c example we worked on (which was built without a CRT).

Never run an untrusted PE file with this loader.