//! API Hammering - Evasion technique to defeat behavioral analysis
 //!
 //! This module implements API hammering, an anti-analysis technique that adds
 //! random CPU-intensive and I/O operations between API calls to evade sandbox
 //! detection and behavioral analysis engines.
 //!
 //! # Techniques Used
 //!
 //! - **Random File I/O**: Creates, writes, reads, and deletes temporary files
 //!   with random names and extensions to generate I/O noise
 //! - **CPU-Intensive Operations**: Calculates prime numbers to consume CPU
 //!   cycles and add timing variations
 //!
 //! # Usage
 //!
 //! These functions are injected into the generated payload code when the
 //! `--with-api-hammering` flag is enabled. They are called between critical
 //! API operations to mask the actual malicious behavior.
 
 use rand::{thread_rng, Rng};
 use std::fs::{remove_file, File};
 use std::io::{self, Read, Write};
 
 pub fn write_random_files(num: usize) -> io::Result<()> {
     let dir = std::env::temp_dir();
 
     for _ in 0..num {
         let mut rng = thread_rng();
         let random_suffix: u32 = rng.gen();
         let extensions = [".log", ".bitmap", ".txt"];
         let extension = extensions[rng.gen_range(0..extensions.len())];
         let file_name = format!("{:x}{}", random_suffix, extension);
         let path = dir.as_path().join(&file_name);
 
         let size = 0xFFFFF;
 
         let mut file = File::create(&path)?;
         let data: Vec<u8> = (0..size).map(|_| rng.gen()).collect();
         file.write_all(&data)?;
 
         let mut file = File::open(&path)?;
         let mut buffer = vec![0; size];
         file.read_exact(&mut buffer)?;
 
         remove_file(path)?;
     }
 
     Ok(())
 }
 
 #[no_mangle]
 #[inline(never)]
 pub fn calc_primes(iterations: usize) {
     let mut prime = 2;
     let mut i = 0;
     while i < iterations {
         if (2..prime).all(|j| prime % j != 0) {
             i += 1;
         }
         prime += 1;
     }
 }
 
 pub fn allocate_random_memory(num_allocs: usize) {
     let mut allocations = Vec::new();
     let mut rng = thread_rng();
 
     for _ in 0..num_allocs {
         let size = 1024 + rng.gen_range(0..8192);
         let data: Vec<u8> = (0..size).map(|_| rng.gen()).collect();
         allocations.push(data);
     }
 }
 
 pub fn transform_strings(iterations: usize) {
     let mut rng = thread_rng();
 
     for _ in 0..iterations {
         let len = rng.gen_range(5..15);
         let s: String = (0..len)
             .map(|_| {
                 let idx = rng.gen_range(0..26);
                 (b'a' + idx) as char
             })
             .collect();
         let _uppercase = s.to_uppercase();
         let _lowercase = s.to_lowercase();
         let _repeated = s.repeat(3);
         let _reversed: String = s.chars().rev().collect();
     }
 }
 
 pub fn sleep_random_jitter(max_millis: u64) {
     let mut rng = thread_rng();
     let jitter = rng.gen_range(0..max_millis);
     std::thread::sleep(std::time::Duration::from_millis(jitter));
 }
 
 #[cfg(windows)]
 pub fn query_registry_keys(num_queries: usize) -> io::Result<()> {
     use std::process::Command;
 
     let keys = [
         r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion",
         r"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion",
         r"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control",
         r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion",
         r"HKEY_CURRENT_USER\Environment",
         r"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services",
         r"HKEY_LOCAL_MACHINE\SOFTWARE\Classes",
         r"HKEY_CURRENT_USER\Software\Classes",
         r"HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System",
         r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
     ];
     let mut rng = thread_rng();
 
     for _ in 0..num_queries {
         let key = keys[rng.gen_range(0..keys.len())];
         let _ = Command::new("reg").args(&["query", key]).output();
     }
 
     Ok(())
 }
 
 #[cfg(not(windows))]
 pub fn query_registry_keys(_num_queries: usize) -> io::Result<()> {
     Ok(())
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_calc_primes_completes() {
         calc_primes(5);
     }
 
     #[test]
     fn test_write_random_files_succeeds() {
         let result = write_random_files(1);
         if let Err(e) = &result {
             eprintln!("Error: {:?}", e);
         }
         assert!(result.is_ok());
     }
 
     #[test]
     fn test_write_random_files_creates_and_removes() {
         let result = write_random_files(1);
         if let Err(e) = &result {
             eprintln!("Error during write_random_files: {:?}", e);
         }
         assert!(result.is_ok(), "write_random_files should succeed");
     }
 
     #[test]
     fn test_allocate_random_memory_completes() {
         allocate_random_memory(5);
     }
 
     #[test]
     fn test_transform_strings_completes() {
         transform_strings(10);
     }
 
     #[test]
     fn test_sleep_random_jitter_completes() {
         sleep_random_jitter(5);
     }
 
     #[test]
     fn test_query_registry_keys_succeeds() {
         let result = query_registry_keys(1);
         assert!(result.is_ok());
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit