Skip to content

Commit e05348c

Browse files
h3zh1h3zh1
committed
bump v0.1.1
1 parent a3816c4 commit e05348c

75 files changed

Lines changed: 4154 additions & 1395 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.cargo/config.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,18 @@
1+
[build]
2+
jobs=8
3+
14
[net]
25
retry = 3
36
git-fetch-with-cli = true
47

58
[target.x86_64-pc-windows-gnu]
69
rustflags = [
710
"-C", "link-arg=-s",
8-
"-C", "link-arg=-fuse-ld=lld",
911
]
12+
1013
[target.i686-pc-windows-gnu]
1114
rustflags = [
1215
"-C", "link-arg=-s",
13-
"-C", "link-arg=-fuse-ld=lld",
1416
]
1517

1618
[target.x86_64-pc-windows-msvc]

‎.github/workflows/generate.yaml‎

Lines changed: 96 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -58,24 +58,62 @@ jobs:
5858
matrix:
5959
target: ${{ fromJson(needs.set_targets.outputs.targets_json) }}
6060
steps:
61-
6261
- name: Checkout code
6362
uses: actions/checkout@v4
6463
with:
6564
token: ${{ secrets.GITHUB_TOKEN }}
6665
submodules: recursive
6766
fetch-depth: 0
6867

69-
- name: Judge target_triple is win
68+
- name: Judge platform and arch
7069
run: |
7170
if [[ "${{matrix.target}}" == *"windows"* ]]; then
72-
echo "is_win=1" >> $GITHUB_ENV
73-
wget https://github.com/chainreactors/malefic/releases/latest/download/resources.zip
74-
unzip resources.zip -d resources
71+
echo "platform=win" >> $GITHUB_ENV
72+
elif [[ "${{matrix.target}}" == *"linux"* ]]; then
73+
echo "platform=linux" >> $GITHUB_ENV
74+
elif [[ "${{matrix.target}}" == *"darwin"* ]]; then
75+
echo "platform=darwin" >> $GITHUB_ENV
76+
fi
77+
78+
if [[ "${{matrix.target}}" == *"x86_64"* ]]; then
79+
echo "arch=x64" >> $GITHUB_ENV
7580
else
76-
echo "is_win=0" >> $GITHUB_ENV
81+
echo "arch=x86" >> $GITHUB_ENV
7782
fi
78-
wget https://github.com/chainreactors/malefic/releases/latest/download/malefic-mutant-x86_64-unknown-linux-musl
83+
84+
- name: Install Resource
85+
run: |
86+
wget https://github.com/chainreactors/malefic/releases/latest/download/resources.zip
87+
unzip resources.zip -d resources
88+
89+
- name: Generate cache key
90+
id: mutant_cache_key
91+
run: |
92+
HASH=$(find malefic-mutant -name "*.rs" -o -name "Cargo.toml" -o -name "Cargo.lock" | sort | xargs cat | sha256sum | cut -d' ' -f1)
93+
echo "key=mutant-$HASH" >> $GITHUB_OUTPUT
94+
95+
- name: Cache malefic-mutant binary
96+
id: cache_mutant
97+
uses: actions/cache@v4
98+
with:
99+
path: |
100+
target/x86_64-unknown-linux-musl/release/malefic-mutant
101+
key: ${{ steps.mutant_cache_key.outputs.key }}
102+
103+
- name: Pull Docker image
104+
run: |
105+
docker pull ghcr.io/chainreactors/malefic-builder:latest
106+
107+
- name: Build malefic-mutant
108+
if: steps.cache_mutant.outputs.cache-hit != 'true'
109+
run: |
110+
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:latest \
111+
bash -c "cargo build -p malefic-mutant --release --target x86_64-unknown-linux-musl"
112+
113+
- name: Setup malefic-mutant
114+
run: |
115+
mkdir -p target/x86_64-unknown-linux-musl/release/
116+
cp target/x86_64-unknown-linux-musl/release/malefic-mutant malefic-mutant-x86_64-unknown-linux-musl
79117
chmod +x malefic-mutant-x86_64-unknown-linux-musl
80118
81119
- name: Generate config.yaml
@@ -95,48 +133,84 @@ jobs:
95133
echo "SECRET_AUTORUN_YAML_CONTENT=$SECRET_AUTORUN_YAML_CONTENT" >> $GITHUB_ENV
96134
echo "$SECRET_AUTORUN_YAML_CONTENT" | base64 -d > autorun.yaml
97135
136+
- name: Setup Cargo cache directories
137+
run: |
138+
mkdir -p ~/.cargo/registry
139+
mkdir -p ~/.cargo/git
140+
mkdir -p ./cargo-cache/registry
141+
mkdir -p ./cargo-cache/git
142+
143+
- name: Cache Rust dependencies
144+
id: cache_rust
145+
uses: actions/cache@v4
146+
with:
147+
path: |
148+
./cargo-cache/registry
149+
./cargo-cache/git
150+
target
151+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }}-${{ github.event.inputs.package }}
152+
restore-keys: |
153+
${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }}-
154+
${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}-
155+
${{ runner.os }}-cargo-
156+
157+
- name: Verify cache restore
158+
run: |
159+
echo "Cache hit: ${{ steps.cache_rust.outputs.cache-hit }}"
160+
echo "Checking cargo cache directories:"
161+
ls -la ./cargo-cache/ || echo "cargo-cache directory not found"
162+
ls -la ./cargo-cache/registry/ || echo "registry directory not found"
163+
ls -la ./cargo-cache/git/ || echo "git directory not found"
164+
98165
- name: Build(${{ github.event.inputs.package }}, ${{matrix.target}})
99166
if : ${{ github.event.inputs.package == 'beacon' }}
100167
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
101168
run: |
102-
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:latest \
103-
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate beacon;./malefic-mutant-x86_64-unknown-linux-musl build malefic --target ${{matrix.target}} "
169+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
170+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate beacon && ./malefic-mutant-x86_64-unknown-linux-musl build malefic --target ${{matrix.target}}"
104171
105172
- name: Build(${{ github.event.inputs.package }}, ${{matrix.target}})
106173
if : ${{ github.event.inputs.package == 'pulse' }}
107174
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
108175
run: |
109-
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:latest \
110-
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate pulse x64 win;./malefic-mutant-x86_64-unknown-linux-musl build pulse;"
176+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
177+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate pulse -p $platform -a $arch && ./malefic-mutant-x86_64-unknown-linux-musl build pulse --target ${{matrix.target}}"
111178
112179
- name: Build(${{ github.event.inputs.package }}, ${{matrix.target}})
113180
if : ${{ github.event.inputs.package == 'bind' }}
114181
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
115182
run: |
116-
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:latest \
117-
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate bind;./malefic-mutant-x86_64-unknown-linux-musl build bind --target ${{matrix.target}} "
183+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
184+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate bind && ./malefic-mutant-x86_64-unknown-linux-musl build bind --target ${{matrix.target}}"
118185
119186
- name: Build(${{ github.event.inputs.package }}, ${{matrix.target}})
120187
if : ${{ github.event.inputs.package == 'prelude' }}
121188
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
122189
run: |
123-
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:latest \
124-
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate prelude autorun.yaml;./malefic-mutant-x86_64-unknown-linux-musl build prelude"
190+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
191+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate prelude autorun.yaml && ./malefic-mutant-x86_64-unknown-linux-musl build prelude --target ${{matrix.target}}"
192+
193+
- name: Build(${{ github.event.inputs.package }},${{matrix.target}})
194+
if : ${{ github.event.inputs.package == '3rd' }}
195+
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
196+
run: |
197+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
198+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate modules -m full && ./malefic-mutant-x86_64-unknown-linux-musl build 3rd -m ${{ github.event.inputs.malefic_modules_features }} --target ${{matrix.target}}"
125199
126200
- name: Build(${{ github.event.inputs.package }},${{matrix.target}})
127201
if : ${{ github.event.inputs.package == 'modules' }}
128202
shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'
129203
run: |
130-
docker run -v $(pwd):/root/src ghcr.io/chainreactors/malefic-builder:v0.0.4 \
131-
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate modules ${{ github.event.inputs.malefic_modules_features }};./malefic-mutant-x86_64-unknown-linux-musl build modules"
204+
docker run -v $(pwd):/root/src -v $(pwd)/cargo-cache/registry:/root/cargo/registry -v $(pwd)/cargo-cache/git:/root/cargo/git ghcr.io/chainreactors/malefic-builder:latest \
205+
bash -c "./malefic-mutant-x86_64-unknown-linux-musl generate modules -m ${{ github.event.inputs.malefic_modules_features }} && ./malefic-mutant-x86_64-unknown-linux-musl build modules -m ${{ github.event.inputs.malefic_modules_features }} --target ${{matrix.target}}"
132206
133207
- name: Move ${{ github.event.inputs.package }} to output
134208
run: |
135209
mkdir -p output
136210
sudo chmod -R 777 target
137211
sudo chmod -R 777 output
138212
export prefix=./target/${{matrix.target}}/release
139-
export suffix=$([ "$is_win" = "1" ] && echo ".exe" || echo "")
213+
export suffix=$([ "$platform" = "win" ] && echo ".exe" || echo "")
140214
tree ./target
141215
if ${{ github.event.inputs.package == 'beacon' }} || ${{ github.event.inputs.package == 'bind' }}; then \
142216
mv $prefix/malefic$suffix output/malefic-${{ github.event.inputs.package }}$suffix; \
@@ -145,7 +219,9 @@ jobs:
145219
elif ${{ github.event.inputs.package == 'pulse' }}; then \
146220
mv $prefix/malefic-pulse$suffix output/malefic-pulse$suffix;
147221
elif ${{ github.event.inputs.package == 'modules' }}; then \
148-
mv $prefix/modules.dll output/modules-${{matrix.target}}.dll; \
222+
mv $prefix/malefic_modules.dll output/malefic_modules-${{matrix.target}}.dll; \
223+
elif ${{ github.event.inputs.package == '3rd' }}; then \
224+
mv $prefix/malefic_3rd.dll output/malefic_3rd-${{matrix.target}}.dll; \
149225
fi
150226
151227
- name: Upload artifact ${{matrix.target}}
@@ -154,4 +230,4 @@ jobs:
154230
with:
155231
name: malefic-${{matrix.target}}-${{ github.run_id }}
156232
path: output/*
157-
retention-days: 3 # you can change this value
233+
retention-days: 2 # you can change this value

‎.gitignore‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
/target
22
.vscode
33
.DS_store
4-
.idea
5-
remap-path.env
4+
.idea

‎Cargo.lock‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,12 @@ opt-level = 1
2222
opt-level = 3
2323

2424
[profile.release]
25-
panic_unwind = false
2625
panic = "abort"
2726
opt-level = "z"
2827
debug-assertions = false
2928
strip = true
3029
lto = "fat"
31-
codegen-units = 1
30+
codegen-units = 16
3231
incremental = false
3332
rustflags = [
3433
"-Z", "trim-diagnostic-paths",

‎config.yaml‎

Lines changed: 37 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,19 @@ basic:
33
targets:
44
- "127.0.0.1:5001"
55
protocol: "tcp"
6-
tls: false
7-
proxy:
6+
tls:
7+
enable: true # 启用TLS
8+
version: "auto" # TLS版本: "auto", "1.2", "1.3"
9+
sni: "localhost" # 服务器名称指示（SNI）
10+
skip_verification: true
11+
# mtls: # mTLS客户端证书配置（可选）
12+
# enable: false # 启用mTLS
13+
# client_cert: "client.crt" # 客户端证书文件路径
14+
# client_key: "client.key" # 客户端私钥文件路径
15+
# server_ca: "" # 用于验证服务端的CA证书路径（可选）
16+
proxy:
817
interval: 5
918
jitter: 0.2
10-
ca:
1119
encryption: aes
1220
key: maliceofinternal
1321
rem:
@@ -23,13 +31,27 @@ basic:
2331
#any-header: any-value
2432
build:
2533
zigbuild: false
34+
remap: false # Force refresh remap-path-prefix configuration even if it already exists
2635
ollvm:
2736
enable: false
2837
bcfobf: false # Bogus Control Flow Obfuscation
2938
splitobf: false # Split Control Flow Obfuscation
3039
subobf: false # Instruction Substitution Obfuscation
3140
fco: false # Function CallSite Obfuscation
3241
constenc: false # Constant Encryption Obfuscation
42+
metadata:
43+
remap_path: "C:/Windows/Users/"
44+
icon: ""
45+
compile_time: "24 Jun 2015 18:03:01"
46+
file_version: ""
47+
product_version: ""
48+
company_name: ""
49+
product_name: ""
50+
original_filename: "normal.exe"
51+
file_description: "normal"
52+
internal_name: ""
53+
require_admin: false # whether to require admin privilege
54+
require_uac: false # whether to require uac privilege
3355

3456
pulse:
3557
flags:
@@ -49,19 +71,6 @@ pulse:
4971
headers:
5072
User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"
5173

52-
metadata:
53-
remap_path: "C:/Windows/Users/"
54-
icon: ""
55-
compile_time: "24 Jun 2015 18:03:01"
56-
file_version: ""
57-
product_version: ""
58-
company_name: ""
59-
product_name: ""
60-
original_filename: "normal.exe"
61-
file_description: "normal"
62-
internal_name: ""
63-
require_admin: false # whether to require admin privilege
64-
require_uac: false # whether to require uac privilege
6574

6675
implants:
6776
runtime: tokio # async runtime: smol/tokio/async-std
@@ -72,11 +81,9 @@ implants:
7281
- "full"
7382
enable_3rd: false # enable 3rd module
7483
3rd_modules: # 3rd module when malefic compile
84+
# - curl
85+
# - rem_static
7586
- full
76-
# - curl
77-
# - rem_dial
78-
# - rem_static
79-
# - rem_reflection
8087

8188
autorun: "" # autorun config filename
8289
pack: # pack
@@ -89,6 +96,14 @@ implants:
8996
artifact_id: 0x1
9097

9198
# for professional
99+
anti: # 反沙箱反调试反编译反取证相关
100+
sandbox: true
101+
vm: true # enable anti vm
102+
# debug: true # enable anti debug
103+
# disasm: true # enable anti disasm
104+
# emulator: true # enable anti emulator
105+
# forensic: true # enable anti forensic
106+
92107
apis:
93108
# apis_level: "sys_apis", "nt_apis"
94109
level: "nt_apis"
@@ -114,6 +129,7 @@ implants:
114129
# "VirtualAllocExNuma", "NtMapViewOfSection"
115130
crossprocess: "NtAllocateVirtualMemory"
116131
sleep_mask: true
132+
stack_spool: true
117133
sacrifice_process: true
118134
fork_and_run: false
119135
hook_exit: true
@@ -122,4 +138,4 @@ implants:
122138
feature: true
123139
modify:
124140
magic: "\x00\x00"
125-
signature: "\x00\x00"
141+
signature: "\x00\x00"

0 commit comments

Comments
 (0)