Benign Download

lib.rs

NtQueueApcThread user-mode APC API referenceRust test marker or harness

SHA-256c006a441aee4fd42cc4f21e5b038092d8a4bbe837dca16bee0cfeef82946d598

Evidence

Modify thread execution context lines 13–20

13:29… about:
14//! - Thread context modifications (DR register writes, `SetThreadContext`).
15//! - APC delivery (`QueueUserAPC` / `NtQueueApcThread`).
16//! - Handle duplication across privilege boundaries.
17//! - Memory allocation with suspicious permission flags.
18//! - DLL load events with signing status.
19//!
20//! Userland ETW pa …

imports edr_provider_guids::KNOWN_EDR_PROVIDERS lines 39–49

39:61… ns empty Vec.
40
41pub mod edr_provider_guids;
42
43use edr_provider_guids::KNOWN_EDR_PROVIDERS;
44
45// ── Public types ──────────────────────────────────────────────────────────────
⋯4 lines

imports windows_sys::Win32::System::Diagnostics::Etw::EventRegister lines 210–218

210:17… sys::Win32::System::Diagnostics::Etw::{
211        EventRegister, EventUnregister, GUID,
212    };
213
⋯5 lines

Rust decodes radix-16 bytes lines 274–288

11… ts.len() != 5 {
      return None;
  }
  let data1 = u32::from_str_radix(parts[0], 16).ok()?;
  let data2 = u16::from_str_radix(parts[1], 16).ok()?;
  let data3 = u16::from_str_radix(parts[2], 16).ok()?;
  let bytes34: Vec<u8> = parts[3]
      .as_bytes()
      .chunks(2)
      .filter_map(|chunk| u8::from_str_radix(std::str::from_utf8(chunk).ok()?, 16).ok())
      .collect();
  let bytes5: Vec<u8> = parts[4]
      .as_bytes()
      .chunks(2)
      .filter_map(|chunk …

imports super::* lines 296–312

296:18… ata1, data2, data3, data4 })
297}
298
299// ── Tests ──────────────────────────────────────────────────────────────────────
300
301#[cfg(test)]
302mod tests {
303    use super::*;
304
305    /// is_etw_ti_active returns false on Linux.
306    #[test]
307    #[cfg(not(target_os = "windows"))]
308    fn etw_ti_not_active_on_linux() {
⋯4 lines