# Theodosius - Jit linker, Mapper, Mutator, and Obfuscator
Theodosius (Theo for short) is a jit linker created for obfuscation. The project is extremely modular in design and supports both kernel and usermode projects.
Theo works with static libraries rather than completely compiled binaries. This allows it to easily position, obfuscate, and scatter symbols anywhere as the project takes the place of the linker.
<trid="row_0_"class="even"><tdclass="entry"><spanstyle="width:0px;display:inline-block;"> </span><spanid="arr_0_"class="arrow"onclick="toggleFolder('0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="da/de6/namespacetheo.html"target="_self">theo</a></td><tdclass="desc">The outer most encompassing namespace of this project </td></tr>
<trid="row_0_0_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_0_"class="arrow"onclick="toggleFolder('0_0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d9/dbd/namespacetheo_1_1decomp.html"target="_self">decomp</a></td><tdclass="desc">the namespace that contains all of the decomposition related code </td></tr>
<trid="row_0_0_0_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d6/d0e/classtheo_1_1decomp_1_1decomp__t.html"target="_self">decomp_t</a></td><tdclass="desc">the main decomposition class which is responsible for breaking down lib file into coff files, and extracted used symbols from the coff files </td></tr>
<trid="row_0_0_1_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="df/db4/classtheo_1_1decomp_1_1routine__t.html"target="_self">routine_t</a></td><tdclass="desc">the routine class which is responsible for creating symbols for routines. if the routine is located inside a section with the name ".split" it will break functions into instruction symbols </td></tr>
<trid="row_0_"class="even"><tdclass="entry"><spanstyle="width:0px;display:inline-block;"> </span><spanid="arr_0_"class="arrow"onclick="toggleFolder('0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="da/de6/namespacetheo.html"target="_self">theo</a></td><tdclass="desc">The outer most encompassing namespace of this project.</td></tr>
<trid="row_0_0_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_0_"class="arrow"onclick="toggleFolder('0_0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d9/dbd/namespacetheo_1_1decomp.html"target="_self">decomp</a></td><tdclass="desc">the namespace that contains all of the decomposition related code.</td></tr>
<trid="row_0_0_0_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d6/d0e/classtheo_1_1decomp_1_1decomp__t.html"target="_self">decomp_t</a></td><tdclass="desc">the main decomposition class which is responsible for breaking down lib file into coff files, and extracted used symbols from the coff files.</td></tr>
<trid="row_0_0_1_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="df/db4/classtheo_1_1decomp_1_1routine__t.html"target="_self">routine_t</a></td><tdclass="desc">the routine class which is responsible for creating symbols for routines. if the routine is located inside a section with the name ".split" it will break functions into instruction symbols.</td></tr>
<trid="row_0_0_2_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d9/dd5/classtheo_1_1decomp_1_1symbol__t.html"target="_self">symbol_t</a></td><tdclass="desc"><aclass="el"href="d9/dd5/classtheo_1_1decomp_1_1symbol__t.html"title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">symbol_t</a> is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol. symbols can be different things, sections, functions, and even instructions (when functions are broken down) </td></tr>
<trid="row_0_1_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_1_"class="arrow"onclick="toggleFolder('0_1_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d5/da8/namespacetheo_1_1obf.html"target="_self">obf</a></td><tdclass="desc">this is the main namespace for obfuscation related things </td></tr>
<trid="row_0_1_0_"class="even"><tdclass="entry"><spanstyle="width:32px;display:inline-block;"> </span><spanid="arr_0_1_0_"class="arrow"onclick="toggleFolder('0_1_0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d8/d82/namespacetheo_1_1obf_1_1transform.html"target="_self">transform</a></td><tdclass="desc">this namespace encompasses the code for transforming relocations </td></tr>
<trid="row_0_1_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_1_"class="arrow"onclick="toggleFolder('0_1_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d5/da8/namespacetheo_1_1obf.html"target="_self">obf</a></td><tdclass="desc">this is the main namespace for obfuscation related things.</td></tr>
<trid="row_0_1_0_"class="even"><tdclass="entry"><spanstyle="width:32px;display:inline-block;"> </span><spanid="arr_0_1_0_"class="arrow"onclick="toggleFolder('0_1_0_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="d8/d82/namespacetheo_1_1obf_1_1transform.html"target="_self">transform</a></td><tdclass="desc">this namespace encompasses the code for transforming relocations.</td></tr>
<trid="row_0_1_0_1_"class="even"><tdclass="entry"><spanstyle="width:64px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html"target="_self">operation_t</a></td><tdclass="desc"><aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html"title="operation_t is the base class for all types of transformations. classes that inherit this class are s...">operation_t</a> is the base class for all types of transformations. classes that inherit this class are singleton and simply call the super constructor (<aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html#a3876ca1c7904aed54940e1519fc9fdf4"title="explicit constructor for operation_t">operation_t::operation_t</a>) </td></tr>
<trid="row_0_1_0_1_"class="even"><tdclass="entry"><spanstyle="width:64px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html"target="_self">operation_t</a></td><tdclass="desc"><aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html"title="operation_t is the base class for all types of transformations. classes that inherit this class are s...">operation_t</a> is the base class for all types of transformations. classes that inherit this class are singleton and simply call the super constructor (<aclass="el"href="d7/de2/classtheo_1_1obf_1_1transform_1_1operation__t.html#a3876ca1c7904aed54940e1519fc9fdf4"title="explicit constructor for operation_t">operation_t::operation_t</a>).</td></tr>
<trid="row_0_1_1_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d9/d18/classtheo_1_1obf_1_1engine__t.html"target="_self">engine_t</a></td><tdclass="desc">singleton obfuscation engine class. this class is responsible for keeping track of the registered passes and the order in which to execute them </td></tr>
<trid="row_0_1_2_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html" target="_self">pass_t</a></td><tdclass="desc">the <aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html"title="the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...">pass_t</a> class is a base clase for all passes made. you must override the <aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html#acfadc013ff0754d66a18baffdb1a61d1"title="virtual method which must be implimented by the pass that inherits this class.">pass_t::run</a> virtual function and declare the logic of your pass there</td></tr>
<trid="row_0_1_1_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d9/d18/classtheo_1_1obf_1_1engine__t.html"target="_self">engine_t</a></td><tdclass="desc">singleton obfuscation engine class. this class is responsible for keeping track of the registered passes and the order in which to execute them.</td></tr>
<trid="row_0_1_2_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d5/d6a/classtheo_1_1obf_1_1hello__world__pass__t.html" target="_self">hello_world_pass_t</a></td><tdclass="desc">hello world pass example of how to inherit<aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html"title="the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...">pass_t</a>. </td></tr>
<trid="row_0_1_3_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d6/dc1/classtheo_1_1obf_1_1jcc__rewrite__pass__t.html"target="_self">jcc_rewrite_pass_t</a></td><tdclass="desc">jcc rewrite pass which rewrites rip relative jcc's so that they are position independent </td></tr>
<trid="row_0_1_4_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html"target="_self">next_inst_pass_t</a></td><tdclass="desc">This pass is used to generate transformations and jmp code to change RIP to the next instruction </td></tr>
<trid="row_0_1_5_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="dc/d39/classtheo_1_1obf_1_1reloc__transform__pass__t.html" target="_self">reloc_transform_pass_t</a></td><tdclass="desc">this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol</td></tr>
<trid="row_0_1_6_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d5/d6a/classtheo_1_1obf_1_1hello__world__pass__t.html" target="_self">hello_world_pass_t</a></td><tdclass="desc">hello world pass example of how to inherit <aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html"title="the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...">pass_t</a></td></tr>
<trid="row_0_2_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_2_"class="arrow"onclick="toggleFolder('0_2_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="da/dbd/namespacetheo_1_1recomp.html"target="_self">recomp</a></td><tdclass="desc">this namespace encompasses all recomposition related code </td></tr>
<trid="row_0_1_5_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html" target="_self">pass_t</a></td><tdclass="desc">the <aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html"title="the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...">pass_t</a> class is a base clase for all passes made. you must override the <aclass="el"href="d4/dad/classtheo_1_1obf_1_1pass__t.html#acfadc013ff0754d66a18baffdb1a61d1"title="virtual method which must be implimented by the pass that inherits this class.">pass_t::run</a> virtual function and declare the logic of your pass there</td></tr>
<trid="row_0_1_6_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="dc/d39/classtheo_1_1obf_1_1reloc__transform__pass__t.html" target="_self">reloc_transform_pass_t</a></td><tdclass="desc">this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol</td></tr>
<trid="row_0_2_"><tdclass="entry"><spanstyle="width:16px;display:inline-block;"> </span><spanid="arr_0_2_"class="arrow"onclick="toggleFolder('0_2_')">▼</span><spanclass="icona"><spanclass="icon">N</span></span><aclass="el"href="da/dbd/namespacetheo_1_1recomp.html"target="_self">recomp</a></td><tdclass="desc">this namespace encompasses all recomposition related code.</td></tr>
<trid="row_0_2_0_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d5/d05/classtheo_1_1recomp_1_1recomp__t.html"target="_self">recomp_t</a></td><tdclass="desc">the main class responsible for recomposition </td></tr>
<trid="row_0_2_1_"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="dd/d37/classtheo_1_1recomp_1_1reloc__t.html"target="_self">reloc_t</a></td><tdclass="desc">meta data about a relocation for a symbol </td></tr>
<trid="row_0_2_2_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="db/d77/classtheo_1_1recomp_1_1symbol__table__t.html"target="_self">symbol_table_t</a></td><tdclass="desc">this class is a high level wrapper for a hashmap that contains <aclass="el"href="d9/dd5/classtheo_1_1decomp_1_1symbol__t.html"title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">decomp::symbol_t</a> values. the symbol values are references by a hashcode </td></tr>
<trid="row_0_2_2_"class="even"><tdclass="entry"><spanstyle="width:48px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="db/d77/classtheo_1_1recomp_1_1symbol__table__t.html"target="_self">symbol_table_t</a></td><tdclass="desc">this class is a high level wrapper for a hashmap that contains <aclass="el"href="d9/dd5/classtheo_1_1decomp_1_1symbol__t.html"title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">decomp::symbol_t</a> values. the symbol values are references by a hashcode.</td></tr>
<trid="row_0_3_"><tdclass="entry"><spanstyle="width:32px;display:inline-block;"> </span><spanclass="icona"><spanclass="icon">C</span></span><aclass="el"href="d9/dbc/classtheo_1_1theo__t.html"target="_self">theo_t</a></td><tdclass="desc">the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp </td></tr>
<divclass="title">theo::obf::pass_t Member List</div></div>
<divclass="headertitle"><divclass="title">theo::obf::pass_t Member List</div></div>
</div><!--header-->
<divclass="contents">
<p>This is the complete list of members for <aclass="el"href="../../d4/dad/classtheo_1_1obf_1_1pass__t.html">theo::obf::pass_t</a>, including all inherited members.</p>
<trclass="memdesc:"><tdclass="mdescLeft"> </td><tdclass="mdescRight">this class is a high level wrapper for a hashmap that contains <aclass="el"href="../../d9/dd5/classtheo_1_1decomp_1_1symbol__t.html"title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">decomp::symbol_t</a> values. the symbol values are references by a hashcode. <ahref="../../db/d77/classtheo_1_1recomp_1_1symbol__table__t.html#details">More...</a><br/></td></tr>
<trclass="memdesc:da/de6/namespacetheo"><tdclass="mdescLeft"> </td><tdclass="mdescRight">The outer most encompassing namespace of this project. <br/></td></tr>
<trclass="memdesc:da/dbd/namespacetheo_1_1recomp"><tdclass="mdescLeft"> </td><tdclass="mdescRight">this namespace encompasses all recomposition related code. <br/></td></tr>