Whitecat18
00734c6553
RustyPacker takes raw shellcode and emits a finished EXE, DLL, or
DLL-sideloadable DLL with the payload embedded and encrypted.
Choices exposed in the GUI:
- Encryption: AES-256-CBC, XOR, UUID-encoded.
- Remote injection: sysCRT, winCRT, ntEarlyCascade.
- Self injection: sysFIBER, EnumCalendarInfoA, EnumDesktopsW,
EnumWindowStationsW, EnumSystemGeoID, CDefFolderMenu_Create2,
RtlUserFiberStart.
- Anti-debug: CheckRemoteDebuggerPresent, NtQueryInformationProcess
(ProcessDebugPort), TEB BeingDebugged, SetUnhandledExceptionFilter
int3 trick.
- Evasion: NtDelayExecution sleep, domain pinning.
- Output: EXE, DLL, DLL Sideload, with optional Proxy mode and a
generated .def for unhandled exports.
The build flow assembles a Rust project under
shared/output_<timestamp>/, performs placeholder substitutions
requested by the chosen techniques, and runs
cargo build --release --target x86_64-pc-windows-{msvc|gnu}. Once
the final binary copies to the configured output path, cargo clean
runs against the generated folder, removing target/ to keep disk use
flat. Source files (Cargo.toml, src/, encrypted blob) stay on disk
for inspection.
Self-injection routes NtAllocateVirtualMemory and
NtProtectVirtualMemory through Dyncvoke's syscall! macro, jumping
into the real syscall instruction inside ntdll. Remote injection via
sysCRT and sysFIBER uses the same path.
build.rs walks src/techniques/ at build time to discover plugins, so
adding a new encryption, injection, anti-debug, or evasion technique
takes one manifest, one mod.rs, and an optional template folder.
Three-tab GUI: Configure, FlowCase (live execution-flow preview), and
Console (streaming cargo output line by line).
29 lines
730 B
TOML
29 lines
730 B
TOML
[package]
|
|
name = "ntEarlyCascade"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
{{DLL_FORMAT}}
|
|
|
|
[dependencies]
|
|
windows-sys = { version = "0.61", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Security",
|
|
"Win32_System_Threading",
|
|
"Win32_System_Memory",
|
|
"Win32_System_Diagnostics_Debug",
|
|
"Win32_System_LibraryLoader",
|
|
] }
|
|
# Used by domain_pin and anti_debug evasion snippets.
|
|
winapi = { version = "0.3", features = ["sysinfoapi", "ntdef", "libloaderapi", "processthreadsapi", "debugapi", "errhandlingapi", "winnt"] }
|
|
{{DEPENDENCIES}}
|
|
|
|
[profile.release]
|
|
strip = true
|
|
opt-level = "z"
|
|
codegen-units = 1
|
|
panic = "abort"
|
|
lto = true
|