myph-v2

~ rust shellcode loader with evasive capabilities
git clone https://github.com/djnnvx/myph-v2.git
README.md (6091B)
      1 # Custom API Resolver Usage
      2 
      3 ## Overview
      4 
      5 The custom API resolver provides stealthy Windows API resolution without static Import Address Table (IAT) artifacts using Process Environment Block (PEB) walking.
      6 
      7 ## Key Features
      8 
      9 - **No IAT artifacts**: Module resolution bypasses standard Windows APIs
     10 - **PEB-based**: Manual traversal of PEB's InLoadOrderModuleList
     11 - **Runtime resolution**: Dynamic module handle resolution
     12 - **Multi-architecture**: Supports x64 (GS:[0x60]) and x86 (FS:[0x30])
     13 - **Unicode support**: Full Unicode case folding for DLL names
     14 - **Forwarded exports**: Automatic resolution across DLLs
     15 
     16 ## Generated Code Structure
     17 
     18 The resolver generates three components:
     19 
     20 1. **PEB Structures**: `PEB`, `PEB_LDR_DATA`, `LIST_ENTRY`, `LDR_DATA_TABLE_ENTRY`, `UNICODE_STRING`
     21 2. **Helper Function**: `is_dll_match()` - Compares module names using UTF-16
     22 3. **Main Resolver**: `get_module_base(target_dll: &str) -> *mut c_void` - Walks PEB module list
     23 
     24 ## Usage Example
     25 
     26 ```rust
     27 use myph_v2::internals::templates::resolver::generate_api_resolver;
     28 
     29 let resolver_code = generate_api_resolver();
     30 let template = format!(
     31     r#"
     32     use std::ffi::c_void;
     33     use std::ptr;
     34 
     35     {}
     36 
     37     fn main() {{
     38         unsafe {{
     39             let kernel32_base = get_module_base("kernel32.dll");
     40             if !kernel32_base.is_null() {{
     41                 println!("kernel32.dll base: {{:p}}", kernel32_base);
     42             }}
     43         }}
     44     }}
     45     "#,
     46     resolver_code
     47 );
     48 ```
     49 
     50 ## Export Parsing
     51 
     52 Resolve specific functions from a module's exports:
     53 
     54 ```rust
     55 unsafe {
     56     let kernel32_base = get_module_base("kernel32.dll");
     57     
     58     if !kernel32_base.is_null() {
     59         let load_library = get_function_address(kernel32_base, "LoadLibraryA");
     60         let virtual_alloc = get_function_address(kernel32_base, "VirtualAlloc");
     61         
     62         if !load_library.is_null() && !virtual_alloc.is_null() {
     63             type LoadLibraryAFn = unsafe extern "system" fn(*const u8) -> *mut c_void;
     64             type VirtualAllocFn = unsafe extern "system" fn(*mut c_void, usize, u32, u32) -> *mut c_void;
     65             
     66             let load_library_fn: LoadLibraryAFn = std::mem::transmute(load_library);
     67             let virtual_alloc_fn: VirtualAllocFn = std::mem::transmute(virtual_alloc);
     68         }
     69     }
     70 }
     71 ```
     72 
     73 The parser validates PE signatures, locates export directory, and returns function addresses.
     74 
     75 ## String Obfuscation Integration
     76 
     77 Combine with string obfuscation to hide module names:
     78 
     79 ```rust
     80 const ENCRYPTED_DLL_NAME: &[u8] = &[/* encrypted "kernel32.dll\0" */];
     81 
     82 unsafe {
     83     let dll_name = internals::decrypt_xor(ENCRYPTED_DLL_NAME, &DECRYPTION_KEY);
     84     let dll_name_str = std::str::from_utf8(&dll_name).unwrap();
     85     let module_base = get_module_base(dll_name_str);
     86 }
     87 ```
     88 
     89 ## Advanced Features
     90 
     91 ### Architecture Support
     92 
     93 Automatic detection for correct PEB access:
     94 - **x64**: Uses `GS:[0x60]`
     95 - **x86**: Uses `FS:[0x30]`
     96 
     97 ### Unicode Case Folding
     98 
     99 Case-insensitive DLL name matching supporting Latin, Greek, Cyrillic:
    100 
    101 ```rust
    102 unsafe {
    103     // All resolve to same module
    104     let base1 = get_module_base("kernel32.dll");
    105     let base2 = get_module_base("KERNEL32.DLL");
    106     let base3 = get_module_base("Kernel32.dll");
    107     assert_eq!(base1, base2);
    108 }
    109 ```
    110 
    111 ### Forwarded Exports
    112 
    113 Automatic handling of forwarded exports with recursive resolution:
    114 
    115 ```rust
    116 unsafe {
    117     let kernel32 = get_module_base("kernel32.dll");
    118     let heap_alloc = get_function_address(kernel32, "HeapAlloc");
    119     // Automatically resolves "NTDLL.RtlAllocateHeap" if forwarded
    120 }
    121 ```
    122 
    123 Features:
    124 - Detects forwarded exports via bounds checking
    125 - Parses "DLL.Function" format
    126 - Recursive resolution with depth limiting (max 10)
    127 - Auto-adds ".dll" extension if missing
    128 
    129 ## Testing
    130 
    131 ### Unit Tests
    132 
    133 Verify structure definitions, helper functions, and code generation:
    134 
    135 ```bash
    136 cargo test resolver
    137 ```
    138 
    139 ### Windows Integration Tests
    140 
    141 On Windows, integration tests validate against actual Windows API:
    142 
    143 ```bash
    144 cargo test test_resolve_kernel32_integrity
    145 cargo test test_resolve_function_address_from_exports
    146 cargo test test_unicode_case_folding_dll_names
    147 cargo test test_forwarded_exports_resolution
    148 cargo test test_resolve_with_encrypted_dll_name
    149 ```
    150 
    151 Tests compare:
    152 - Module resolution: PEB walking vs `GetModuleHandleA`
    153 - Function resolution: Export parsing vs `GetProcAddress`
    154 - Unicode case folding across variations
    155 - Forwarded export detection and resolution
    156 
    157 ## Implementation Details
    158 
    159 ### PEB Walking
    160 - Accesses PEB via GS:[0x60] (x64) or FS:[0x30] (x86) using inline assembly
    161 - Walks InMemoryOrderModuleList linked list
    162 - Uses CONTAINING_RECORD offset (0x10) for InMemoryOrderLinks
    163 
    164 ### String Comparison
    165 - Converts to UTF-16 for comparison
    166 - Full Unicode case folding (100+ mappings)
    167 - Supports Latin, Greek, Cyrillic scripts
    168 
    169 ### Structure Definitions
    170 - Uses ntapi crate for PEB structures
    171 - Uses winapi crate for LIST_ENTRY and UNICODE_STRING
    172 - PE structures for x86 and x64 with conditional compilation
    173 
    174 ### Export Directory Parsing
    175 - Validates DOS (0x5A4D "MZ") and PE (0x4550 "PE\0\0") signatures
    176 - Locates export directory via OptionalHeader.DataDirectory[0]
    177 - Supports x64 and x86 PE formats
    178 - Maps name → ordinal → RVA → absolute address
    179 
    180 ### Forwarded Exports
    181 - Detects via RVA bounds checking within export directory
    182 - Parses "DLL.Function" format
    183 - Recursive resolution with max depth 10
    184 - Returns null on failure
    185 
    186 ## Security Considerations
    187 
    188 - Multi-architecture support (x64/x86)
    189 - Unicode case folding for international DLLs
    190 - Forwarded export handling with depth limiting
    191 - No error handling in generated code (returns null on failure)
    192 - Uses unsafe and inline assembly
    193 - Relies on ntapi/winapi for correct structure layouts
    194 
    195 ## Future Enhancements
    196 
    197 1. ~~Export parsing~~ ✅ Implemented
    198 2. ~~x86 support~~ ✅ Implemented
    199 3. ~~Unicode case folding~~ ✅ Implemented
    200 4. ~~Forwarded exports~~ ✅ Implemented
    201 5. Error codes: Return structured errors instead of null pointers
    202 6. Caching: Cache frequently resolved modules and functions
    203 7. Hash-based resolution: Resolve by hash for additional obfuscation