mirror of
https://codeberg.org/smukx/Rust-for-Malware-Development
synced 2026-06-06 20:22:59 +00:00
Whitecat18
28e7fac1d3
Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods
89 lines
1.9 KiB
Rust
89 lines
1.9 KiB
Rust
#![allow(private_interfaces)]
|
|
#![allow(dead_code)]
|
|
#![allow(non_snake_case)]
|
|
#![allow(non_camel_case_types)]
|
|
|
|
/*
|
|
PEB Structure Implementation
|
|
Source: MSDOS.
|
|
*/
|
|
|
|
use winapi::{
|
|
ctypes::c_void,
|
|
shared::ntdef::{NTSTATUS, PWSTR},
|
|
};
|
|
|
|
#[repr(C)]
|
|
pub struct PEB {
|
|
pub Reserved1: [u8; 2],
|
|
pub BeingDebugged: u8,
|
|
pub Reserved2: [u8; 1],
|
|
pub Reserved3: [*mut c_void; 2],
|
|
pub Ldr: *mut PEB_LDR_DATA,
|
|
pub ProcessParameters: *mut RTL_USER_PROCESS_PARAMETERS,
|
|
pub Reserved4: [*mut c_void; 3],
|
|
pub AtlThunkSListPtr: *mut c_void,
|
|
pub Reserved5: *mut c_void,
|
|
pub Reserved6: u32,
|
|
pub Reserved7: *mut c_void,
|
|
pub Reserved8: u32,
|
|
pub AtlThunkSListPtr32: u32,
|
|
pub Reserved9: [*mut c_void; 45],
|
|
pub Reserved10: [u8; 96],
|
|
pub PostProcessInitRoutine: PPS_POST_PROCESS_INIT_ROUTINE,
|
|
pub Reserved11: [u8; 128],
|
|
pub Reserved12: [*mut c_void; 1],
|
|
pub SessionId: u32,
|
|
}
|
|
|
|
/*
|
|
PEB_LDR_DATA
|
|
*/
|
|
|
|
#[repr(C)]
|
|
pub struct PEB_LDR_DATA {
|
|
pub Reserved1: [u8; 8],
|
|
pub Reserved2: [*mut c_void; 3],
|
|
pub InMemoryOrderModuleList: LIST_ENTRY,
|
|
}
|
|
|
|
#[repr(C)]
|
|
pub struct LIST_ENTRY {
|
|
pub Flink: *mut LIST_ENTRY,
|
|
pub Blink: *mut LIST_ENTRY,
|
|
}
|
|
|
|
/*
|
|
RTL_USER_PROCESS_PARAMETERS
|
|
*/
|
|
|
|
#[repr(C)]
|
|
pub struct RTL_USER_PROCESS_PARAMETERS {
|
|
pub Reserved1: [u8; 16],
|
|
pub Reserved2: [*mut c_void; 10],
|
|
pub ImagePathName: UNICODE_STRING,
|
|
pub CommandLine: UNICODE_STRING,
|
|
}
|
|
|
|
#[repr(C)]
|
|
pub struct UNICODE_STRING {
|
|
pub Length: u16,
|
|
pub MaximumLength: u16,
|
|
pub Buffer: PWSTR,
|
|
}
|
|
|
|
enum PPS_POST_PROCESS_INIT_ROUTINE {
|
|
None,
|
|
Some(unsafe extern "system" fn()),
|
|
}
|
|
|
|
#[repr(C)]
|
|
pub struct PROCESS_BASIC_INFORMATION {
|
|
pub ExitStatus: NTSTATUS,
|
|
pub PebBaseAddress: *mut PEB,
|
|
pub AffinityMask: usize,
|
|
pub BasePriority: i32,
|
|
pub UniqueProcessId: usize,
|
|
pub InheritedFromUniqueProcessId: usize,
|
|
}
|