Whitecat18
00734c6553
RustyPacker takes raw shellcode and emits a finished EXE, DLL, or
DLL-sideloadable DLL with the payload embedded and encrypted.
Choices exposed in the GUI:
- Encryption: AES-256-CBC, XOR, UUID-encoded.
- Remote injection: sysCRT, winCRT, ntEarlyCascade.
- Self injection: sysFIBER, EnumCalendarInfoA, EnumDesktopsW,
EnumWindowStationsW, EnumSystemGeoID, CDefFolderMenu_Create2,
RtlUserFiberStart.
- Anti-debug: CheckRemoteDebuggerPresent, NtQueryInformationProcess
(ProcessDebugPort), TEB BeingDebugged, SetUnhandledExceptionFilter
int3 trick.
- Evasion: NtDelayExecution sleep, domain pinning.
- Output: EXE, DLL, DLL Sideload, with optional Proxy mode and a
generated .def for unhandled exports.
The build flow assembles a Rust project under
shared/output_<timestamp>/, performs placeholder substitutions
requested by the chosen techniques, and runs
cargo build --release --target x86_64-pc-windows-{msvc|gnu}. Once
the final binary copies to the configured output path, cargo clean
runs against the generated folder, removing target/ to keep disk use
flat. Source files (Cargo.toml, src/, encrypted blob) stay on disk
for inspection.
Self-injection routes NtAllocateVirtualMemory and
NtProtectVirtualMemory through Dyncvoke's syscall! macro, jumping
into the real syscall instruction inside ntdll. Remote injection via
sysCRT and sysFIBER uses the same path.
build.rs walks src/techniques/ at build time to discover plugins, so
adding a new encryption, injection, anti-debug, or evasion technique
takes one manifest, one mod.rs, and an optional template folder.
Three-tab GUI: Configure, FlowCase (live execution-flow preview), and
Console (streaming cargo output line by line).
31 lines
553 B
TOML
31 lines
553 B
TOML
[package]
|
|
name = "RustPacker"
|
|
version = "0.1.0-beta"
|
|
edition = "2021"
|
|
authors = ["smukx <staffs@5mukx.site>"]
|
|
|
|
[lib]
|
|
name = "rustpacker"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "RustPacker"
|
|
path = "src/bin/gui.rs"
|
|
|
|
[build-dependencies]
|
|
toml = "0.8"
|
|
serde = { version = "1", features = ["derive"] }
|
|
|
|
[dependencies]
|
|
path-absolutize = "3"
|
|
fs_extra = "1"
|
|
path-clean = "1"
|
|
rand = "0.10"
|
|
libaes = "0.7"
|
|
anyhow = "1"
|
|
serde = { version = "1", features = ["derive"] }
|
|
toml = "0.8"
|
|
eframe = { version = "0.27", features = ["persistence"] }
|
|
egui = "0.27"
|
|
rfd = "0.14"
|