Function main

src/main.rs:30–273

()

}

fn main() {
    let plaintext_data_original = [0u8; 0x20];
    println!("Original data : {:X?}", plaintext_data_original);
    let mut plaintext_data = plaintext_data_original.clone();

    unsafe {
        CryptProtectMemory(
            plaintext_data.as_mut_ptr() as *mut c_void,
            plaintext_data.len() as u32,
            CRYPTPROTECTMEMORY_SAME_PROCESS,
        )
        .expect("Failed :(")
    };

    println!("Encrypted: {:X?}", plaintext_data);

    create_dump_file(r"C:\Windows\Temp\livedump.DMP".to_string())
        .expect("[-] Failed creating livedump.");

    let dump_file = File::open(r"C:\Windows\Temp\livedump.DMP")
        .expect("[-] Failed opening livedump.");

    let dump_parser =
        KernelDumpParser::with_reader(dump_file).expect("[-] Failed parsing livedump.");

    let active_process_head = dump_parser.headers().ps_active_process_head;

    println!("[+] Found PsActiveProcessListHead: {active_process_head:#X}");

    let cng_data =
        fs::read(r"C:\Windows\System32\drivers\cng.sys").expect("[-] Failed reading cng.sys");

    let cng_object = PeObject::parse(&cng_data).expect("[-] Failed parsing cng.sys");
    let pdb_id = cng_object.debug_id().to_string().replace("-", "");
    let pdb_url = format!("https://msdl.microsoft.com/download/symbols/cng.pdb/{pdb_id}/cng.pdb");
    println!("[+] Downloading cng.sys PDB from {:?}", pdb_url);

    let cng_pdb_data = reqwest::blocking::get(pdb_url)
        .unwrap()
        .bytes()
        .unwrap()
        .to_vec();

    let mut pdb_parser =
        pdb::pdb::PDB::open(Cursor::new(cng_pdb_data)).expect("[-] Failed parsing PDB data.");

    let mut random_salt_offset = 0;
    let mut g_sha_hash_offset = 0;
    let address_map = pdb_parser
        .address_map()
        .expect("[-] Failed building address map");

    let symbol_table = pdb_parser
        .global_symbols()
        .expect("[-] Failed parsing PDB.");
    let mut symbols = symbol_table.iter();
    while let Some(sym) = symbols.next().unwrap() {
        match sym.parse() {