Stardust Advanced Framework

A modern, modular, and feature-rich shellcode framework for security research and red team operations.

Features

Enhanced Modularity

• Advanced plugin system with dynamic loading
• Microservices architecture with message passing
• Plugin dependency management and sandboxing
• Support for COFF/BOF style object files

Advanced API Resolution

• Name-based and ordinal-based API resolution
• Intelligent caching system for improved performance
• Forwarded export resolution support
• Fallback mechanisms for robustness

Security Features

• Anti-analysis and anti-debugging techniques
• String encryption and control flow obfuscation
• Runtime packing/unpacking capabilities
• Environmental keying and time-based activation

Network Capabilities

• Lightweight TCP/IP stack implementation
• HTTP/HTTPS client functionality
• DNS resolution capabilities
• Proxy support and tunneling

Developer Experience

• Comprehensive unit testing framework
• Detailed API documentation
• Step-by-step tutorials and examples
• Analysis and debugging utilities

Architecture Overview

Stardust Core
├── Core Modules
│   ├── Memory Manager
│   ├── API Resolver
│   ├── String Handler
│   └── Error Handler
├── Plugin System
│   ├── Plugin Loader
│   ├── Plugin Manager
│   └── Plugin Sandbox
├── Communication Layer
│   ├── IPC Manager
│   └── Message Queue
└── Security Layer
    ├── Encryption Engine
    ├── Obfuscation Engine
    └── Anti-Analysis Module

Plugin System

The advanced plugin system supports dynamic loading, dependency management, and secure sandboxing:

class IPlugin {
public:
    virtual PluginResult Initialize(PluginContext* context) = 0;
    virtual PluginResult Execute(PluginContext* context) = 0;
    virtual PluginResult Cleanup(PluginContext* context) = 0;
    virtual const PluginInfo* GetInfo() const = 0;
    virtual uint32_t GetCapabilities() const = 0;
    virtual PluginResult SendMessage(uint32_t message_id, const void* data, uint32_t data_size) = 0;
    virtual PluginResult ReceiveMessage(uint32_t message_id, void* data, uint32_t* data_size) = 0;
};

API Resolution

Enhanced API resolution with caching for improved performance:

// Name-based resolution with caching
decltype(MessageBoxA) * msgbox = RESOLVE_API(user32.handle, MessageBoxA);

// Ordinal-based resolution for performance
decltype(LoadLibraryA) * loadlib = RESOLVE_API_ORDINAL(kernel32.handle, 624);

// Direct cached access
uintptr_t cached_addr = resolve::EnhancedResolver::GetCachedAddress(module_hash, symbol_hash);

Building

Prerequisites

• Clang compiler with MinGW-w64 targets
• NASM assembler
• objcopy utility

Building Release Versions

make

Building Debug Versions

make debug

Building Specific Architectures

make x64      # bin/stardust.x64.exe + .bin
make x86      # bin/stardust.x86.exe + .bin

Building Plugins

make plugin-sample

Cleaning Build Artifacts

make clean

Testing

Building Test Harness

make stomper

Running Tests

# For 64-bit shellcode
./test/stomper.x64.exe ./bin/stardust.x64.bin

# For 32-bit shellcode
./test/stomper.x86.exe ./bin/stardust.x86.bin

Artifact Names

• Release:
  • bin/stardust.x64.exe, bin/stardust.x64.bin
  • bin/stardust.x86.exe, bin/stardust.x86.bin
• Debug (coexists with release):
  • bin/stardust.x64.debug.exe, bin/stardust.x64.debug.bin
  • bin/stardust.x86.debug.exe, bin/stardust.x86.debug.bin
• Plugins:
• bin/plugins/sample_plugin.x64.dll, bin/plugins/sample_plugin.x86.dll

GUI Configuration

The simple GUI writes config/config.h which is compiled first (Makefile/CMake include config/). It sets macros used by the code:

• Feature toggles: ENABLE_ANTI_STATIC, ENABLE_RUNTIME_METAMORPHOSIS, ENABLE_ENVIRONMENT_KEYING, ENABLE_TIME_BASED_ACTIVATION, ENABLE_ETW_PATCHING, ENABLE_AMSI_BYPASS
• Groups: INCLUDE_STRINGS, INCLUDE_API_RESOLUTION, INCLUDE_INJECTION, INCLUDE_PERSISTENCE, INCLUDE_CREDENTIAL_ACCESS
• Communication: C2_PROTOCOL (string), C2_INTERVAL, C2_JITTER
• Execution/persistence: INJECTION_METHOD, PERSISTENCE_METHOD (strings)

Debug builds are still controlled by -D DEBUG in make debug.

Plugins

At runtime, the core will enumerate and invoke plugins from bin\plugins\*.dll (and plugins\*.dll fallback), calling CreatePlugin/DestroyPlugin and executing Initialize → Execute → Cleanup for each plugin instance.

Configuration

Stardust supports modular configuration through compile-time flags:

// Enable specific features
#define FEATURE_INJECTION 1
#define FEATURE_PERSISTENCE 1
#define FEATURE_CREDENTIAL_ACCESS 1

// Configure security features
#define ENABLE_ANTI_STATIC 1
#define ENABLE_ETW_PATCHING 1
#define ENABLE_AMSI_BYPASS 1

// Set communication protocol
#define C2_PROTOCOL "https"
#define C2_INTERVAL 60

Advanced Features

Memory Management

Custom heap management with encryption and scrambling:

void* secure_mem = stardust::memory::SecureAllocate(size);
stardust::memory::SecureFree(secure_mem);

String Encryption

Runtime string encryption/decryption:

const char* encrypted = stardust::crypto::EncryptString("sensitive_data");
const char* decrypted = stardust::crypto::DecryptString(encrypted);

Process Injection

Multiple injection techniques:

stardust::inject::CreateRemoteThread(target, shellcode, size);
stardust::inject::NtCreateThreadEx(target, shellcode, size);

Security Considerations

The framework implements various security features to avoid detection:

1. Anti-Analysis: Multiple anti-debugging and virtualization detection techniques
2. Obfuscation: Control flow obfuscation and junk code insertion
3. Encryption: Runtime encryption for sensitive strings and data
4. Evasion: ETW patching, AMSI bypass, and syscall obfuscation

Contributing

1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Push to the branch
5. Create a new Pull Request

License

This project is licensed under the MIT License - see the LICENSE file for details.

Disclaimer

This tool is intended for security research and educational purposes only. Any misuse of this tool is not the responsibility of the author.

stardustprop

stardustprop