donut

type DonutArch int

type DonutConfig struct {
	Len  uint32 // original length of input file
	Zlen uint32 // compressed length

	// General/misc options for loader
	Arch     DonutArch // target architecture (Sliver-compatible)
	Bypass   int       // bypass option for AMSI/WDLP
	Headers  int       // preserve PE headers option
	Compress uint32    // engine to use when compressing file via RtlCompressBuffer (Sliver-compatible)
	Entropy  int       // entropy/encryption level
	Format   uint32    // output format for loader (Sliver-compatible)
	ExitOpt  int       // return to caller, invoke RtlExitUserProcess, or block
	Thread   uint32    // run entrypoint of unmanaged EXE as a thread (Sliver-compatible)
	OEP      uint32    // original entrypoint of target host file

	// Files in/out
	Input  string // name of input file to read and load in-memory
	Output string // name of output file to save loader

	// .NET stuff
	Runtime string // runtime version to use for CLR
	Domain  string // name of domain to create for .NET DLL/EXE
	Class   string // name of class with optional namespace for .NET DLL
	Method  string // name of method or DLL function to invoke

	// Command line for DLL/EXE
	Parameters string // command line to use for unmanaged DLL/EXE and .NET DLL/EXE (Sliver-compatible, was Args)
	Unicode    uint32 // param is passed to DLL function without converting to unicode (Sliver-compatible)

	// Module overloading stuff
	Decoy string // path of decoy module

	// HTTP/DNS staging information
	Server  string // staging server hosting donut module
	Auth    string // username and password for web server (user:pass)
	ModName string // name of module written to disk for http stager

	// DONUT_MODULE
	Type   ModuleType   // VBS/JS/DLL/EXE (Sliver-compatible, was ModType)
	ModLen int          // size of DONUT_MODULE
	Mod    *DonutModule // points to DONUT_MODULE

	// DONUT_INSTANCE
	InstType InstanceType   // DONUT_INSTANCE_EMBED or DONUT_INSTANCE_HTTP (Sliver-compatible)
	InstLen  int            // size of DONUT_INSTANCE
	Inst     *DonutInstance // points to DONUT_INSTANCE

	// Shellcode generated from configuration
	PicLen int    // size of loader/shellcode
	Pic    []byte // points to loader/shellcode
}

type DonutCrypt struct {
	MasterKey [DONUT_KEY_LEN]byte // master key
	Counter   [DONUT_BLK_LEN]byte // counter + nonce
}

type DonutInstance struct {
	Len uint32     // total size of instance
	Key DonutCrypt // decrypts instance if encryption enabled

	IV uint64 // the 64-bit initial value for maru hash

	Hash [64]uint64 // holds up to 64 api hashes (or addresses at runtime)

	ExitOpt int32  // 1=thread, 2=process, 3=block
	Entropy int32  // indicates entropy level
	OEP     uint32 // original entrypoint

	// everything from here is encrypted
	ApiCnt   int32                // the 64-bit hashes of API required
	DllNames [DONUT_MAX_NAME]byte // list of DLL strings to load, separated by semi-colon

	Dataname   [8]byte  // ".data"
	Kernelbase [12]byte // "kernelbase"
	Amsi       [8]byte  // "amsi"
	Clr        [4]byte  // "clr"
	Wldp       [8]byte  // "wldp"
	Ntdll      [8]byte  // "ntdll"

	CmdSyms [DONUT_MAX_NAME]byte // symbols related to command line
	ExitApi [DONUT_MAX_NAME]byte // exit-related API

	Bypass  int32 // indicates behaviour of bypassing AMSI/WLDP/ETW
	Headers int32 // indicates whether to overwrite PE headers

	WldpQuery      [32]byte // WldpQueryDynamicCodeTrust
	WldpIsApproved [32]byte // WldpIsClassInApprovedList
	AmsiInit       [16]byte // AmsiInitialize
	AmsiScanBuf    [16]byte // AmsiScanBuffer
	AmsiScanStr    [16]byte // AmsiScanString
	EtwEventWrite  [16]byte // EtwEventWrite
	EtwEventUnreg  [20]byte // EtwEventUnregister
	EtwRet64       [1]byte  // "ret" instruction for Etw
	EtwRet32       [4]byte  // "ret 14h" instruction for Etw

	Wscript    [8]byte  // WScript
	WscriptExe [12]byte // wscript.exe

	Decoy [DONUT_MAX_PATH * 2]byte // path of decoy module

	// GUIDs
	XIID_IUnknown  GUID
	XIID_IDispatch GUID

	// GUID required to load .NET assemblies
	XCLSID_CLRMetaHost    GUID
	XIID_ICLRMetaHost     GUID
	XIID_ICLRRuntimeInfo  GUID
	XCLSID_CorRuntimeHost GUID
	XIID_ICorRuntimeHost  GUID
	XIID_AppDomain        GUID

	// GUID required to run VBS and JS files
	XCLSID_ScriptLanguage        GUID
	XIID_IHost                   GUID
	XIID_IActiveScript           GUID
	XIID_IActiveScriptSite       GUID
	XIID_IActiveScriptSiteWindow GUID
	XIID_IActiveScriptParse32    GUID
	XIID_IActiveScriptParse64    GUID

	Type     int32                // DONUT_INSTANCE_EMBED, DONUT_INSTANCE_HTTP
	Server   [DONUT_MAX_NAME]byte // staging server hosting donut module
	Username [DONUT_MAX_NAME]byte // username for web server
	Password [DONUT_MAX_NAME]byte // password for web server
	HttpReq  [8]byte              // just a buffer for "GET"

	Sig [DONUT_MAX_NAME]byte // string to hash
	Mac uint64               // to verify decryption ok

	ModKey DonutCrypt // used to decrypt module
	ModLen uint64     // total size of module

	Module *DonutModule // points to module (embedded or downloaded)
}

type DonutModule struct {
	Type     int32 // EXE/DLL/JS/VBS
	Thread   int32 // run entrypoint of unmanaged EXE as a thread
	Compress int32 // indicates engine used for compression

	Runtime [DONUT_MAX_NAME]byte // runtime version for .NET EXE/DLL
	Domain  [DONUT_MAX_NAME]byte // domain name to use for .NET EXE/DLL
	Cls     [DONUT_MAX_NAME]byte // name of class and optional namespace for .NET EXE/DLL
	Method  [DONUT_MAX_NAME]byte // name of method to invoke for .NET DLL or api for unmanaged DLL

	Args    [DONUT_MAX_NAME]byte // string arguments for both managed and unmanaged DLL/EXE
	Unicode int32                // convert param to unicode for unmanaged DLL function

	Sig [DONUT_SIG_LEN]byte // string to verify decryption
	Mac uint64              // hash of sig, to verify decryption was ok

	Zlen uint32 // compressed size of EXE/DLL/JS/VBS file
	Len  uint32 // real size of EXE/DLL/JS/VBS file
	Data []byte // data of EXE/DLL/JS/VBS file
}

type FileInfo struct {
	Len   uint32
	Zlen  uint32
	Data  []byte
	Zdata []byte
	Type  int
	Arch  int
	Ver   string
}

type GUID struct {
	Data1 uint32
	Data2 uint16
	Data3 uint16
	Data4 [8]byte
}

type ImageCor20Header struct {
	Cb                  uint32
	MajorRuntimeVersion uint16
	MinorRuntimeVersion uint16
	MetaDataRVA         uint32
	MetaDataSize        uint32
	Flags               uint32
	EntryPointToken     uint32
	ResourcesRVA        uint32
	ResourcesSize       uint32
	StrongNameSigRVA    uint32
	StrongNameSigSize   uint32
	CodeManagerTableRVA uint32
	CodeManagerTableSz  uint32
	VTableFixupsRVA     uint32
	VTableFixupsSize    uint32
	ExportAddrTableRVA  uint32
	ExportAddrTableSize uint32
	ManagedNativeHdrRVA uint32
	ManagedNativeHdrSz  uint32
}

type InstanceType int

type MDStorageSignature struct {
	Signature     uint32
	MajorVersion  uint16
	MinorVersion  uint16
	ExtraData     uint32
	VersionLength uint32
}

type ModuleType int

type Option func(*DonutConfig)

type PEInfo struct {
	Data        []byte
	Arch        int
	Type        int
	IsDLL       bool
	IsDotNet    bool
	IsManaged   bool
	IsMixed     bool
	CLRVersion  string
	EntryPoint  uint32
	ImageBase   uint64
	Sections    []pe.SectionHeader
	Relocations bool
}