You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
142 lines
16 KiB
142 lines
16 KiB
3 years ago
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
||
|
|
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
|
||
|
|
<meta name="generator" content="Doxygen 1.9.1"/>
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
||
|
|
<title>Theodosius: include/obf/passes/next_inst_pass.hpp Source File</title>
|
||
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
||
|
|
<script type="text/javascript" src="jquery.js"></script>
|
||
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
||
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
||
|
|
<script type="text/javascript" src="search/searchdata.js"></script>
|
||
|
|
<script type="text/javascript" src="search/search.js"></script>
|
||
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
||
|
|
<div id="titlearea">
|
||
|
|
<table cellspacing="0" cellpadding="0">
|
||
|
|
<tbody>
|
||
|
|
<tr style="height: 56px;">
|
||
|
|
<td id="projectalign" style="padding-left: 0.5em;">
|
||
|
|
<div id="projectname">Theodosius
|
||
|
|
 <span id="projectnumber">v3.0</span>
|
||
|
|
</div>
|
||
|
|
<div id="projectbrief">Jit linker, mapper, obfuscator, and mutator</div>
|
||
|
|
</td>
|
||
|
|
</tr>
|
||
|
|
</tbody>
|
||
|
|
</table>
|
||
|
|
</div>
|
||
|
|
<!-- end header part -->
|
||
|
|
<!-- Generated by Doxygen 1.9.1 -->
|
||
|
|
<script type="text/javascript">
|
||
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
||
|
|
var searchBox = new SearchBox("searchBox", "search",false,'Search','.html');
|
||
|
|
/* @license-end */
|
||
|
|
</script>
|
||
|
|
<script type="text/javascript" src="menudata.js"></script>
|
||
|
|
<script type="text/javascript" src="menu.js"></script>
|
||
|
|
<script type="text/javascript">
|
||
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
||
|
|
$(function() {
|
||
|
|
initMenu('',true,false,'search.php','Search');
|
||
|
|
$(document).ready(function() { init_search(); });
|
||
|
|
});
|
||
|
|
/* @license-end */</script>
|
||
|
|
<div id="main-nav"></div>
|
||
|
|
<!-- window showing the filter options -->
|
||
|
|
<div id="MSearchSelectWindow"
|
||
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
||
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
||
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<!-- iframe showing the search results (closed by default) -->
|
||
|
|
<div id="MSearchResultsWindow">
|
||
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
||
|
|
name="MSearchResults" id="MSearchResults">
|
||
|
|
</iframe>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div id="nav-path" class="navpath">
|
||
|
|
<ul>
|
||
|
|
<li class="navelem"><a class="el" href="dir_d44c64559bbebec7f509842c48db8b23.html">include</a></li><li class="navelem"><a class="el" href="dir_ef99456410776b930b88f5850437ce61.html">obf</a></li><li class="navelem"><a class="el" href="dir_13fb3109ea9f625158dab961edf6214d.html">passes</a></li> </ul>
|
||
|
|
</div>
|
||
|
|
</div><!-- top -->
|
||
|
|
<div class="header">
|
||
|
|
<div class="headertitle">
|
||
|
|
<div class="title">next_inst_pass.hpp</div> </div>
|
||
|
|
</div><!--header-->
|
||
|
|
<div class="contents">
|
||
|
|
<a href="next__inst__pass_8hpp.html">Go to the documentation of this file.</a><div class="fragment"><div class="line"><a name="l00001"></a><span class="lineno"> 1</span> <span class="comment">// Copyright (c) 2022, _xeroxz</span></div>
|
||
|
|
<div class="line"><a name="l00002"></a><span class="lineno"> 2</span> <span class="comment">// All rights reserved.</span></div>
|
||
|
|
<div class="line"><a name="l00003"></a><span class="lineno"> 3</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00004"></a><span class="lineno"> 4</span> <span class="comment">// Redistribution and use in source and binary forms, with or without</span></div>
|
||
|
|
<div class="line"><a name="l00005"></a><span class="lineno"> 5</span> <span class="comment">// modification, are permitted provided that the following conditions are met:</span></div>
|
||
|
|
<div class="line"><a name="l00006"></a><span class="lineno"> 6</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00007"></a><span class="lineno"> 7</span> <span class="comment">// 1. Redistributions of source code must retain the above copyright notice,</span></div>
|
||
|
|
<div class="line"><a name="l00008"></a><span class="lineno"> 8</span> <span class="comment">// this list of conditions and the following disclaimer.</span></div>
|
||
|
|
<div class="line"><a name="l00009"></a><span class="lineno"> 9</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00010"></a><span class="lineno"> 10</span> <span class="comment">// 2. Redistributions in binary form must reproduce the above copyright notice,</span></div>
|
||
|
|
<div class="line"><a name="l00011"></a><span class="lineno"> 11</span> <span class="comment">// this list of conditions and the following disclaimer in the documentation</span></div>
|
||
|
|
<div class="line"><a name="l00012"></a><span class="lineno"> 12</span> <span class="comment">// and/or other materials provided with the distribution.</span></div>
|
||
|
|
<div class="line"><a name="l00013"></a><span class="lineno"> 13</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00014"></a><span class="lineno"> 14</span> <span class="comment">// 3. Neither the name of the copyright holder nor the names of its</span></div>
|
||
|
|
<div class="line"><a name="l00015"></a><span class="lineno"> 15</span> <span class="comment">// contributors may be used to endorse or promote products derived from</span></div>
|
||
|
|
<div class="line"><a name="l00016"></a><span class="lineno"> 16</span> <span class="comment">// this software without specific prior written permission.</span></div>
|
||
|
|
<div class="line"><a name="l00017"></a><span class="lineno"> 17</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00018"></a><span class="lineno"> 18</span> <span class="comment">// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"</span></div>
|
||
|
|
<div class="line"><a name="l00019"></a><span class="lineno"> 19</span> <span class="comment">// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE</span></div>
|
||
|
|
<div class="line"><a name="l00020"></a><span class="lineno"> 20</span> <span class="comment">// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE</span></div>
|
||
|
|
<div class="line"><a name="l00021"></a><span class="lineno"> 21</span> <span class="comment">// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE</span></div>
|
||
|
|
<div class="line"><a name="l00022"></a><span class="lineno"> 22</span> <span class="comment">// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR</span></div>
|
||
|
|
<div class="line"><a name="l00023"></a><span class="lineno"> 23</span> <span class="comment">// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF</span></div>
|
||
|
|
<div class="line"><a name="l00024"></a><span class="lineno"> 24</span> <span class="comment">// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS</span></div>
|
||
|
|
<div class="line"><a name="l00025"></a><span class="lineno"> 25</span> <span class="comment">// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN</span></div>
|
||
|
|
<div class="line"><a name="l00026"></a><span class="lineno"> 26</span> <span class="comment">// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)</span></div>
|
||
|
|
<div class="line"><a name="l00027"></a><span class="lineno"> 27</span> <span class="comment">// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE</span></div>
|
||
|
|
<div class="line"><a name="l00028"></a><span class="lineno"> 28</span> <span class="comment">// POSSIBILITY OF SUCH DAMAGE.</span></div>
|
||
|
|
<div class="line"><a name="l00029"></a><span class="lineno"> 29</span> <span class="comment">//</span></div>
|
||
|
|
<div class="line"><a name="l00030"></a><span class="lineno"> 30</span>  </div>
|
||
|
|
<div class="line"><a name="l00031"></a><span class="lineno"> 31</span> <span class="preprocessor">#pragma once</span></div>
|
||
|
|
<div class="line"><a name="l00032"></a><span class="lineno"> 32</span> <span class="preprocessor">#include <<a class="code" href="pass_8hpp.html">obf/pass.hpp</a>></span></div>
|
||
|
|
<div class="line"><a name="l00033"></a><span class="lineno"> 33</span>  </div>
|
||
|
|
<div class="line"><a name="l00034"></a><span class="lineno"> 34</span> <span class="keyword">namespace </span><a class="code" href="namespacetheo_1_1obf.html">theo::obf</a> {</div>
|
||
|
|
<div class="line"><a name="l00085"></a><span class="lineno"><a class="line" href="classtheo_1_1obf_1_1next__inst__pass__t.html"> 85</a></span> <span class="keyword">class </span><a class="code" href="classtheo_1_1obf_1_1next__inst__pass__t.html">next_inst_pass_t</a> : <span class="keyword">public</span> <a class="code" href="classtheo_1_1obf_1_1pass__t.html">pass_t</a> {</div>
|
||
|
|
<div class="line"><a name="l00086"></a><span class="lineno"> 86</span>  <span class="keyword">explicit</span> <a class="code" href="classtheo_1_1obf_1_1next__inst__pass__t.html">next_inst_pass_t</a>() : <a class="code" href="classtheo_1_1obf_1_1pass__t.html#abd4ab22cc2822b968267be7f8397d611">pass_t</a>(<a class="code" href="namespacetheo_1_1decomp.html#af96177687d0ad683c5897d8fa01135f9a4842f4c175b1ec87fc82ef3757d3a0e9">decomp::sym_type_t::instruction</a>) {</div>
|
||
|
|
<div class="line"><a name="l00087"></a><span class="lineno"> 87</span>  xed_state_t istate{XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b};</div>
|
||
|
|
<div class="line"><a name="l00088"></a><span class="lineno"> 88</span>  xed_decoded_inst_zero_set_mode(&m_tmp_inst, &istate);</div>
|
||
|
|
<div class="line"><a name="l00089"></a><span class="lineno"> 89</span>  xed_decode(&m_tmp_inst, m_type_inst_bytes, <span class="keyword">sizeof</span>(m_type_inst_bytes));</div>
|
||
|
|
<div class="line"><a name="l00090"></a><span class="lineno"> 90</span>  };</div>
|
||
|
|
<div class="line"><a name="l00091"></a><span class="lineno"> 91</span>  </div>
|
||
|
|
<div class="line"><a name="l00092"></a><span class="lineno"> 92</span>  <span class="keyword">public</span>:</div>
|
||
|
|
<div class="line"><a name="l00093"></a><span class="lineno"><a class="line" href="classtheo_1_1obf_1_1next__inst__pass__t.html#a267f1fee5cbe3d7bc6d173af499a6f9d"> 93</a></span>  <span class="keyword">static</span> <a class="code" href="classtheo_1_1obf_1_1next__inst__pass__t.html">next_inst_pass_t</a>* <a class="code" href="classtheo_1_1obf_1_1next__inst__pass__t.html#a267f1fee5cbe3d7bc6d173af499a6f9d">get</a>();</div>
|
||
|
|
<div class="line"><a name="l00094"></a><span class="lineno"><a class="line" href="classtheo_1_1obf_1_1next__inst__pass__t.html#ae4cbba78b14c2b9da794386e4d92f40f"> 94</a></span>  <span class="keywordtype">void</span> <a class="code" href="classtheo_1_1obf_1_1next__inst__pass__t.html#ae4cbba78b14c2b9da794386e4d92f40f">run</a>(<a class="code" href="classtheo_1_1decomp_1_1symbol__t.html">decomp::symbol_t</a>* sym);</div>
|
||
|
|
<div class="line"><a name="l00095"></a><span class="lineno"> 95</span>  </div>
|
||
|
|
<div class="line"><a name="l00096"></a><span class="lineno"> 96</span>  <span class="keyword">private</span>:</div>
|
||
|
|
<div class="line"><a name="l00097"></a><span class="lineno"> 97</span>  std::optional<recomp::reloc_t*> has_next_inst_reloc(<a class="code" href="classtheo_1_1decomp_1_1symbol__t.html">decomp::symbol_t</a>*);</div>
|
||
|
|
<div class="line"><a name="l00098"></a><span class="lineno"> 98</span>  xed_decoded_inst_t m_tmp_inst;</div>
|
||
|
|
<div class="line"><a name="l00099"></a><span class="lineno"> 99</span>  std::uint8_t m_type_inst_bytes[9] = {0x48, 0xC7, 0x44, 0x24, 0x08,</div>
|
||
|
|
<div class="line"><a name="l00100"></a><span class="lineno"> 100</span>  0x44, 0x33, 0x22, 0x11};</div>
|
||
|
|
<div class="line"><a name="l00101"></a><span class="lineno"> 101</span> };</div>
|
||
|
|
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span> } <span class="comment">// namespace theo::obf</span></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1decomp_1_1symbol__t_html"><div class="ttname"><a href="classtheo_1_1decomp_1_1symbol__t.html">theo::decomp::symbol_t</a></div><div class="ttdoc">symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....</div><div class="ttdef"><b>Definition:</b> <a href="symbol_8hpp_source.html#l00053">symbol.hpp:53</a></div></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1obf_1_1next__inst__pass__t_html"><div class="ttname"><a href="classtheo_1_1obf_1_1next__inst__pass__t.html">theo::obf::next_inst_pass_t</a></div><div class="ttdoc">This pass is used to generate transformations and jmp code to change RIP to the next instruction.</div><div class="ttdef"><b>Definition:</b> <a href="next__inst__pass_8hpp_source.html#l00085">next_inst_pass.hpp:85</a></div></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1obf_1_1next__inst__pass__t_html_a267f1fee5cbe3d7bc6d173af499a6f9d"><div class="ttname"><a href="classtheo_1_1obf_1_1next__inst__pass__t.html#a267f1fee5cbe3d7bc6d173af499a6f9d">theo::obf::next_inst_pass_t::get</a></div><div class="ttdeci">static next_inst_pass_t * get()</div></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1obf_1_1next__inst__pass__t_html_ae4cbba78b14c2b9da794386e4d92f40f"><div class="ttname"><a href="classtheo_1_1obf_1_1next__inst__pass__t.html#ae4cbba78b14c2b9da794386e4d92f40f">theo::obf::next_inst_pass_t::run</a></div><div class="ttdeci">void run(decomp::symbol_t *sym)</div><div class="ttdoc">virtual method which must be implimented by the pass that inherits this class.</div></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1obf_1_1pass__t_html"><div class="ttname"><a href="classtheo_1_1obf_1_1pass__t.html">theo::obf::pass_t</a></div><div class="ttdoc">the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...</div><div class="ttdef"><b>Definition:</b> <a href="pass_8hpp_source.html#l00055">pass.hpp:55</a></div></div>
|
||
|
|
<div class="ttc" id="aclasstheo_1_1obf_1_1pass__t_html_abd4ab22cc2822b968267be7f8397d611"><div class="ttname"><a href="classtheo_1_1obf_1_1pass__t.html#abd4ab22cc2822b968267be7f8397d611">theo::obf::pass_t::pass_t</a></div><div class="ttdeci">pass_t(decomp::sym_type_t sym_type)</div><div class="ttdoc">the explicit constructor of the pass_t base class.</div><div class="ttdef"><b>Definition:</b> <a href="pass_8hpp_source.html#l00063">pass.hpp:63</a></div></div>
|
||
|
|
<div class="ttc" id="anamespacetheo_1_1decomp_html_af96177687d0ad683c5897d8fa01135f9a4842f4c175b1ec87fc82ef3757d3a0e9"><div class="ttname"><a href="namespacetheo_1_1decomp.html#af96177687d0ad683c5897d8fa01135f9a4842f4c175b1ec87fc82ef3757d3a0e9">theo::decomp::instruction</a></div><div class="ttdeci">@ instruction</div><div class="ttdef"><b>Definition:</b> <a href="symbol_8hpp_source.html#l00043">symbol.hpp:43</a></div></div>
|
||
|
|
<div class="ttc" id="anamespacetheo_1_1obf_html"><div class="ttname"><a href="namespacetheo_1_1obf.html">theo::obf</a></div><div class="ttdoc">this is the main namespace for obfuscation related things.</div><div class="ttdef"><b>Definition:</b> <a href="engine_8hpp_source.html#l00036">engine.hpp:36</a></div></div>
|
||
|
|
<div class="ttc" id="apass_8hpp_html"><div class="ttname"><a href="pass_8hpp.html">pass.hpp</a></div></div>
|
||
|
|
</div><!-- fragment --></div><!-- contents -->
|
||
|
|
<!-- start footer part -->
|
||
|
|
<hr class="footer"/><address class="footer"><small>
|
||
|
|
Generated by <a href="https://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.9.1
|
||
|
|
</small></address>
|
||
|
|
</body>
|
||
|
|
</html>
|