RustyPacker takes raw shellcode and emits a finished EXE, DLL, or
DLL-sideloadable DLL with the payload embedded and encrypted.
Choices exposed in the GUI:
- Encryption: AES-256-CBC, XOR, UUID-encoded.
- Remote injection: sysCRT, winCRT, ntEarlyCascade.
- Self injection: sysFIBER, EnumCalendarInfoA, EnumDesktopsW,
EnumWindowStationsW, EnumSystemGeoID, CDefFolderMenu_Create2,
RtlUserFiberStart.
- Anti-debug: CheckRemoteDebuggerPresent, NtQueryInformationProcess
(ProcessDebugPort), TEB BeingDebugged, SetUnhandledExceptionFilter
int3 trick.
- Evasion: NtDelayExecution sleep, domain pinning.
- Output: EXE, DLL, DLL Sideload, with optional Proxy mode and a
generated .def for unhandled exports.
The build flow assembles a Rust project under
shared/output_<timestamp>/, performs placeholder substitutions
requested by the chosen techniques, and runs
cargo build --release --target x86_64-pc-windows-{msvc|gnu}. Once
the final binary copies to the configured output path, cargo clean
runs against the generated folder, removing target/ to keep disk use
flat. Source files (Cargo.toml, src/, encrypted blob) stay on disk
for inspection.
Self-injection routes NtAllocateVirtualMemory and
NtProtectVirtualMemory through Dyncvoke's syscall! macro, jumping
into the real syscall instruction inside ntdll. Remote injection via
sysCRT and sysFIBER uses the same path.
build.rs walks src/techniques/ at build time to discover plugins, so
adding a new encryption, injection, anti-debug, or evasion technique
takes one manifest, one mod.rs, and an optional template folder.
Three-tab GUI: Configure, FlowCase (live execution-flow preview), and
Console (streaming cargo output line by line).
Whitecat18
00734c6553