donut

type API_IMPORT struct {
	Module string
	Name   string
}

type DonutArch int

type DonutConfig struct {
	Arch       DonutArch
	Type       ModuleType
	InstType   InstanceType
	Parameters string // separated by , or ;

	Entropy uint32

	// new in 0.9.3
	Thread   uint32
	Compress uint32
	Unicode  uint32
	OEP      uint64
	ExitOpt  uint32
	Format   uint32

	Domain  string // .NET stuff
	Class   string
	Method  string // Used by Native DLL and .NET DLL
	Runtime string
	Bypass  int

	Module     *DonutModule
	ModuleName string
	URL        string
	ModuleMac  uint64
	ModuleData *bytes.Buffer

	Verbose bool // Enable/Disable verbose output
	// contains filtered or unexported fields
}

type DonutInstance struct {
	Len uint32 // total size of instance

	//Key  DonutCrypt // decrypts instance (32 bytes total = 16+16)
	KeyMk  [CipherKeyLen]byte   // master key
	KeyCtr [CipherBlockLen]byte // counter + nonce

	Iv   uint64     // the 64-bit initial value for maru hash
	Hash [64]uint64 // holds up to 64 api hashes/addrs {api}

	ExitOpt uint32 // call RtlExitUserProcess to terminate the host process
	Entropy uint32 // indicates entropt option
	OEP     uint64 // original entrypoint

	// everything from here is encrypted
	ApiCount uint32               // the 64-bit hashes of API required for instance to work
	DllNames [DONUT_MAX_NAME]byte // a list of DLL strings to load, separated by semi-colon

	Dataname   [8]byte  // ".data"
	Kernelbase [12]byte // "kernelbase"
	Amsi       [8]byte  // "amsi"
	Clr        [4]byte  // clr
	Wldp       [8]byte  // wldp

	CmdSyms [DONUT_MAX_NAME]byte // symbols related to command line
	ExitApi [DONUT_MAX_NAME]byte // exit-related API

	Bypass         uint32   // indicates behaviour of byassing AMSI/WLDP
	WldpQuery      [32]byte // WldpQueryDynamicCodeTrust
	WldpIsApproved [32]byte // WldpIsClassInApprovedList
	AmsiInit       [16]byte // AmsiInitialize
	AmsiScanBuf    [16]byte // AmsiScanBuffer
	AmsiScanStr    [16]byte // AmsiScanString

	Wscript     [8]byte  // WScript
	Wscript_exe [12]byte // wscript.exe

	XIID_IUnknown  uuid.UUID
	XIID_IDispatch uuid.UUID

	//  GUID required to load .NET assemblies
	XCLSID_CLRMetaHost    uuid.UUID
	XIID_ICLRMetaHost     uuid.UUID
	XIID_ICLRRuntimeInfo  uuid.UUID
	XCLSID_CorRuntimeHost uuid.UUID
	XIID_ICorRuntimeHost  uuid.UUID
	XIID_AppDomain        uuid.UUID

	//  GUID required to run VBS and JS files
	XCLSID_ScriptLanguage        uuid.UUID // vbs or js
	XIID_IHost                   uuid.UUID // wscript object
	XIID_IActiveScript           uuid.UUID // engine
	XIID_IActiveScriptSite       uuid.UUID // implementation
	XIID_IActiveScriptSiteWindow uuid.UUID // basic GUI stuff
	XIID_IActiveScriptParse32    uuid.UUID // parser
	XIID_IActiveScriptParse64    uuid.UUID

	Type uint32 // DONUT_INSTANCE_PIC or DONUT_INSTANCE_URL

	Url [DONUT_MAX_URL]byte // staging server hosting donut module
	Req [8]byte             // just a buffer for "GET"

	Sig [DONUT_MAX_NAME]byte // string to hash
	Mac uint64               // to verify decryption ok

	ModKeyMk  [CipherKeyLen]byte   // master key
	ModKeyCtr [CipherBlockLen]byte // counter + nonce

	Mod_len uint64 // total size of module
}

type DonutModule struct {
	ModType  uint32 // EXE, DLL, JS, VBS, XSL
	Thread   uint32 // run entrypoint of unmanaged EXE as a thread
	Compress uint32 // indicates engine used for compression

	Runtime [DONUT_MAX_NAME]byte // runtime version for .NET EXE/DLL (donut max name = 256)
	Domain  [DONUT_MAX_NAME]byte // domain name to use for .NET EXE/DLL
	Cls     [DONUT_MAX_NAME]byte // name of class and optional namespace for .NET EXE/DLL
	Method  [DONUT_MAX_NAME]byte // name of method to invoke for .NET DLL or api for unmanaged DLL
	Param   [DONUT_MAX_NAME]byte // string parameters for DLL/EXE (donut max parm = 8)

	Unicode uint32              // convert command line to unicode for unmanaged DLL function
	Sig     [DONUT_SIG_LEN]byte // random string to verify decryption
	Mac     uint64              // to verify decryption was ok
	Zlen    uint32              // compressed size of EXE/DLL/JS/VBS file
	Len     uint32              // size of EXE/DLL/XSL/JS/VBS file
	Data    [4]byte             // data of EXE/DLL/XSL/JS/VBS file
}

type InstanceType int

type ModuleType int