diff --git a/README.md b/README.md index c6392c0..5615169 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,15 @@ * `theo::malloc_t` - allocate executable memory * `theo::resolve_symbol_t` - resolve external symbol * Creating Instance + * Calling Entry + * MSREXEC - Call Entry Example + * VDM - Call Entry Example + * WinAPI - Call Entry Example +* RIP Relative Addressing + * JCC - RIP Relative +* Obfuscation + * Obfuscate - Base Class + * Mutation - Inherts Obfuscation # Theodosius - Jit linker, Mapper, Mutator, and Obfuscator @@ -275,7 +284,7 @@ const auto entry_result = reinterpret_cast(drv_entry)); ``` -#### WinAPI - CreateRemoteThread +#### WinAPI - Call Entry Example Another example, this one using WinAPI's, can be seen below. @@ -345,6 +354,8 @@ As you can see from the code above, (sorry for the terrible syntax highlighting) Each of these instructions can be anywhere in virtual memory and it would not effect code execution one bit. However this is not the case with routines which have conditional branches. Take the following c++ code for example. +## JCC - RIP Relative + ```cpp ObfuscateRoutine void LoopDemo()