From a15346f2b42ae763eac6f45089158cf5ae3348ce Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 8 Mar 2021 08:07:05 +0000 Subject: [PATCH] Update README.md --- README.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 69a4e93..c369239 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ The linker is able to get the address of the branching code by taking the rip re The usage of the word obfuscation in this project is use to define any changes made to code, this includes code flow. `obfuscation::obfuscate`, a base class, which is inherited and expanded upon by `obfuscation::mutation`, obfuscates code flow by inserting `JMP [RIP+0x0]` instructions after every single instruction. This allows for a routine to be broken up into unique allocations of memory and thus provides more canvas room for creative ideas. -### Obfuscation - Base Class +### Obfuscate - Base Class The base class, as described in the above section, contains a handful of util routines and a single explicit constructor which is the corner stone of the class. The constructor fixes JCC relative virtual addresses so that if the condition is met, instead of jumping instruction pointer relativitly, it will jump to an addition jmp (`JMP [RIP+0x0]`). @@ -145,6 +145,19 @@ The base class, as described in the above section, contains a handful of util ro LEA's, nor CALL's are rip relative, even for symbols defined inside of the routine in which the instruction is compiled into. In other words JCC instructions are the only instruction pointer relative instructions that are generated. +``` +instruction +jmp next instruction + + +instruction +jmp next instruction + + +instruction +jmp next instruction +``` + ### Mutation - Inherts Obfuscation This class inherits from `obfuscate` and adds additional code, or "mutation". This class is a small example of how to use inheritance with `obfuscate` base class. It generates a stack push/pop palindrome. The state of the stack is restored before the routines actual instruction is executed. The assembly will now look like this in memory: