the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp. More...

#include <theo.hpp>

Public Member Functions
	theo_t (std::vector< std::uint8_t > &lib, lnk_fns_t lnkr_fns, const std::string &&entry_sym)
	explicit constructor for theo class. More...

std::optional< std::uint32_t >	decompose ()
	decomposes the lib file and return the number of symbols that are used. More...

std::uintptr_t	compose ()
	compose the decomposed module. This will run obfuscation passes, the map and resolve symbols to each other. More...

std::uintptr_t	resolve (const std::string &&sym)
	given the name of a symbol, it returns the address of where its mapped. More...

Detailed Description

the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp.

You will create an object of this type when using theo.

Constructor & Destructor Documentation

◆ theo_t()

theo::theo_t::theo_t	(	std::vector< std::uint8_t > &	lib,
		lnk_fns_t	lnkr_fns,
		const std::string &&	entry_sym
	)

explicit

explicit constructor for theo class.

Parameters

lib	a vector of bytes consisting of a lib
lnkr_fns
entry_sym	the name of the function which will be used as the entry point

     : m_dcmp(lib, &m_sym_tbl),
       m_recmp(&m_dcmp, {}, {}, {}),
       m_entry_sym(entry_sym) {
   m_recmp.allocator(std::get<0>(lnkr_fns));
   m_recmp.copier(std::get<1>(lnkr_fns));
   m_recmp.resolver(std::get<2>(lnkr_fns));
 }

Member Function Documentation

◆ compose()

std::uintptr_t theo::theo_t::compose ( )

compose the decomposed module. This will run obfuscation passes, the map and resolve symbols to each other.

Returns: returns the address of the entry point symbol

                              {
   // run obfuscation engine on all symbols...
   //
   auto engine = obf::engine_t::get();
   m_sym_tbl.for_each([&](decomp::symbol_t& sym) { engine->run(&sym); });
  
   m_recmp.allocate();
   m_recmp.resolve();
   m_recmp.copy_syms();
   return m_recmp.resolve(m_entry_sym.data());
 }

◆ decompose()

std::optional< std::uint32_t > theo::theo_t::decompose ( )

decomposes the lib file and return the number of symbols that are used.

Returns: optional amount of symbols that are used. no value if decomposition fails.

                                            {
   auto res = m_dcmp.decompose(m_entry_sym);
   if (!res.has_value()) {
     spdlog::error("failed to decompose...\n");
     return {};
   }
  
   spdlog::info("decompose successful... {} symbols", res.value()->size());
   return res.value()->size();
 }

◆ resolve()

std::uintptr_t theo::theo_t::resolve ( const std::string && sym )

given the name of a symbol, it returns the address of where its mapped.