From a3e8ba3c40475e2102239a0cd8979e0c98845267 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 8 Mar 2021 18:27:26 +0000 Subject: [PATCH] Update README.md --- README.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c6392c0..5615169 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,15 @@ * `theo::malloc_t` - allocate executable memory * `theo::resolve_symbol_t` - resolve external symbol * Creating Instance + * Calling Entry + * MSREXEC - Call Entry Example + * VDM - Call Entry Example + * WinAPI - Call Entry Example +* RIP Relative Addressing + * JCC - RIP Relative +* Obfuscation + * Obfuscate - Base Class + * Mutation - Inherts Obfuscation # Theodosius - Jit linker, Mapper, Mutator, and Obfuscator @@ -275,7 +284,7 @@ const auto entry_result = reinterpret_cast(drv_entry)); ``` -#### WinAPI - CreateRemoteThread +#### WinAPI - Call Entry Example Another example, this one using WinAPI's, can be seen below. @@ -345,6 +354,8 @@ As you can see from the code above, (sorry for the terrible syntax highlighting) Each of these instructions can be anywhere in virtual memory and it would not effect code execution one bit. However this is not the case with routines which have conditional branches. Take the following c++ code for example. +## JCC - RIP Relative + ```cpp ObfuscateRoutine void LoopDemo()