smukx-Rust-for-Malware-Development/NtApi

NTAPI Usage

Welcome to the NtApi directory of Rust-for-Malware-Development. The Native API (the Nt* / Zw* functions inside ntdll.dll) sits one layer below the documented Win32 functions. Calling it directly skips many user-mode hooks and gives access to behaviour that Win32 never exposes.

Cargo Projects

• NtMapViewOfSection: Builds a writable shared section with NtCreateSection, then maps it into a target process using NtMapViewOfSection. The foundation for mapping-based code injection.

• Shellcode_Exectuion_NtApi: End-to-end shellcode loader built entirely from native APIs — NtAllocateVirtualMemory → NtProtectVirtualMemory → NtCreateThreadEx. No kernel32 calls at all.

Standalone Snippets

• NtMapViewOfSection.rs — Single-file version of the section-mapping flow above.
• remote_process.rs — Opens a handle to a remote process via NtOpenProcess.

How to Use

git clone https://github.com/Whitecat18/Rust-for-Malware-Development.git
cd Rust-for-Malware-Development/NtApi

For the Cargo projects, cd in and run cargo build --release. For the loose .rs files, drop them into your own project's src/ and call them from main.