astraguard 1.1.7

Official AstraGuard SDK - license validation, HWID binding, anti-debug, and offline cache for Rust applications
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

//! XOR string obfuscation for security-sensitive constants.
//!
//! Strings are stored XOR-scrambled at compile time and decoded to plaintext
//! at runtime. This prevents trivial `strings`-tool extraction of debugger
//! names, pipe names, and registry paths from the compiled binary.

use zeroize::Zeroize;

/// XOR key used for compile-time obfuscation.
pub const XOR_KEY: u8 = 0x5A;

/// XOR a fixed-size byte array at compile time.
pub const fn xor_bytes<const N: usize>(s: &[u8; N]) -> [u8; N] {
    let mut out = [0u8; N];
    let mut i = 0;
    while i < N {
        out[i] = s[i] ^ XOR_KEY;
        i += 1;
    }
    out
}

/// Decode an XOR-obfuscated byte slice back to a `String` at runtime.
pub fn decode(obfuscated: &[u8]) -> String {
    // All stored constants are XOR of ASCII bytes, so the result is valid UTF-8.
    let decoded: Vec<u8> = obfuscated.iter().map(|&b| b ^ XOR_KEY).collect();
    String::from_utf8(decoded).unwrap_or_default()
}

/// Decode an XOR-obfuscated byte slice, compare to `target`, then zero the
/// intermediate buffer so the plaintext does not linger in memory.
#[allow(dead_code)]
pub fn decode_and_compare(obfuscated: &[u8], target: &str) -> bool {
    let mut decoded: Vec<u8> = obfuscated.iter().map(|&b| b ^ XOR_KEY).collect();
    let result = decoded.as_slice() == target.as_bytes();
    decoded.zeroize();
    result
}

// ── Obfuscated string constants ───────────────────────────────────────────────
// All values are stored XOR-scrambled. Call `decode(&CONSTANT)` at runtime.

// Debugger / instrumentation process names
#[allow(dead_code)]
pub static FRIDA_SERVER: [u8; 12] = xor_bytes(b"frida-server");
#[allow(dead_code)]
pub static FRIDA_AGENT: [u8; 11] = xor_bytes(b"frida-agent");
#[allow(dead_code)]
pub static GADGET: [u8; 6] = xor_bytes(b"gadget");
pub static X64DBG: [u8; 6] = xor_bytes(b"x64dbg");
pub static X32DBG: [u8; 6] = xor_bytes(b"x32dbg");
pub static OLLYDBG: [u8; 7] = xor_bytes(b"ollydbg");
pub static WINDBG: [u8; 6] = xor_bytes(b"windbg");
pub static CHEATENGINE: [u8; 11] = xor_bytes(b"cheatengine");
pub static IDA_PRO: [u8; 7] = xor_bytes(b"ida_pro");
pub static DNSPY: [u8; 5] = xor_bytes(b"dnspy");
pub static PROCESSHACKER: [u8; 13] = xor_bytes(b"processhacker");

// Frida named pipe prefixes
pub static PIPE_FRIDA_PREFIX: [u8; 14] = xor_bytes(b"\\\\.\\pipe\\frida");
pub static PIPE_LINJECTOR_PREFIX: [u8; 18] = xor_bytes(b"\\\\.\\pipe\\linjector");

// DLL names to check in loaded modules
pub static FRIDA_DLL: [u8; 9] = xor_bytes(b"frida.dll");
pub static GADGET_DLL: [u8; 10] = xor_bytes(b"gadget.dll");

// VM process names
#[allow(dead_code)]
pub static VMTOOLSD: [u8; 9] = xor_bytes(b"vmtoolsd.");
#[allow(dead_code)]
pub static VMWARETRAY: [u8; 12] = xor_bytes(b"vmwaretray.e");
#[allow(dead_code)]
pub static VMWAREUSER: [u8; 12] = xor_bytes(b"vmwareuser.e");
#[allow(dead_code)]
pub static VBOXSERVICE: [u8; 14] = xor_bytes(b"vboxservice.ex");
#[allow(dead_code)]
pub static VBOXTRAY: [u8; 11] = xor_bytes(b"vboxtray.ex");
#[allow(dead_code)]
pub static VMUSRVC: [u8; 10] = xor_bytes(b"vmusrvc.ex");
#[allow(dead_code)]
pub static VMSRVC: [u8; 9] = xor_bytes(b"vmsrvc.ex");

// VM driver file paths
pub static VMMOUSE_SYS: [u8; 39] = xor_bytes(b"C:\\Windows\\System32\\drivers\\vmmouse.sys");
pub static VMHGFS_SYS: [u8; 38] = xor_bytes(b"C:\\Windows\\System32\\drivers\\vmhgfs.sys");
pub static VBOXGUEST_SYS: [u8; 41] = xor_bytes(b"C:\\Windows\\System32\\drivers\\VBoxGuest.sys");
pub static VBOXMOUSE_SYS: [u8; 41] = xor_bytes(b"C:\\Windows\\System32\\drivers\\VBoxMouse.sys");

// VM CPUID vendor strings
pub static CPUID_VMWARE: [u8; 12] = xor_bytes(b"VMwareVMware");
pub static CPUID_VBOX: [u8; 12] = xor_bytes(b"VBoxVBoxVBox");
pub static CPUID_KVM: [u8; 12] = xor_bytes(b"KVMKVMKVM\x00\x00\x00");
pub static CPUID_HYPERV: [u8; 12] = xor_bytes(b"Microsoft Hv");

// VM MAC OUI prefixes (6 hex chars without colons)
pub static MAC_VBOX: [u8; 6] = xor_bytes(b"080027");
pub static MAC_VMWARE1: [u8; 6] = xor_bytes(b"000C29");
pub static MAC_VMWARE2: [u8; 6] = xor_bytes(b"005056");
pub static MAC_QEMU: [u8; 6] = xor_bytes(b"525400");

// Registry path for MachineGuid (with trailing NUL padding to match const-array size)
pub static REG_MACHINE_GUID_PATH: [u8; 40] =
    xor_bytes(b"SOFTWARE\\Microsoft\\Cryptography\x00\x00\x00\x00\x00\x00\x00\x00\x00");
pub static REG_MACHINE_GUID_KEY: [u8; 11] = xor_bytes(b"MachineGuid");