< Back to projects

Educational Ransomware-Style Encryption Tool (Rust)

Bachelor 3 - ESGI Group annual project + solo module 2024-2025 Completed

Strictly educational and defensive scope: these two projects aim to understand, hands-on, how a ransomware works internally (mass encryption, signature evasion techniques) in order to detect and counter it more effectively. The code was never deployed outside a controlled test environment and includes no propagation, persistence, or command-and-control networking functionality.

Encryption CLI and metamorphic evasion module Encryption CLI (clap) AES 128/192/256, random mode recursive walk via walkdir Metamorphic module (metamorphic.rs) 1. Rename variables and functions 2. Insert random NOP instructions 3. Recompile the modified source Result: same behavior, different hash and static signature on every build
The encryption CLI is the group annual project; the metamorphic module, added solo in a later Rust course, rewrites the source before every compilation to illustrate signature evasion.

Context

Two distinct deliverables around the same theme, produced at different points in the Bachelor 3 curriculum. The first is the group annual project: a Rust CLI for encrypting and decrypting files, built through successive iterations (pre_prod/encrypt_file, devil_encryption_folder, final_enc_dec_cli, up to rendu_final). The second, done solo as part of a dedicated Rust course, extends the same theme with HKDF/HMAC/SHA2 key derivation and, most notably, a metamorphic source rewriting module that the group project does not have.

What was built

  • Command-line interface built with clap, encrypting/decrypting individual files or entire directories walked recursively via walkdir.
  • Three supported AES key sizes (128/192/256 bits), random key and IV generation.
  • In the solo version: sound key derivation (HKDF/HMAC/SHA2 rather than a raw key) and timestamping of operations.
  • The metamorphic.rs module: automatic rewriting of the source code (variable renaming, random NOP insertion) followed by recompilation, producing a functionally identical binary whose static signature (hash, byte patterns) changes on every build - the same logic real malware uses to evade signature-based detection.

Stack

Rust AES 128/192/256 clap walkdir HKDF/HMAC/SHA2 Signature evasion techniques

Status

Both parts are complete and were submitted as part of their respective courses.

< All projects