Theodosius  v3.0
Jit linker, mapper, obfuscator, and mutator
Functions
main.cpp File Reference
#include <Windows.h>
#include <psapi.h>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <spdlog/spdlog.h>
#include <theo.hpp>
#include <obf/engine.hpp>
#include <obf/passes/jcc_rewrite_pass.hpp>
#include <obf/passes/next_inst_pass.hpp>
#include <obf/passes/reloc_transform_pass.hpp>
#include "hello_world_pass.hpp"

Go to the source code of this file.

Functions

int main (int argc, char *argv[])
 example usage of how to interface with theo. please refer to the source code of this function for details. More...
 

Function Documentation

◆ main()

int main ( int  argc,
char *  argv[] 
)

example usage of how to interface with theo. please refer to the source code of this function for details.

Parameters
argc
argv
Returns
57  {
58  if (argc < 2)
59  return -1;
60 
61  // read in lib file...
62  std::ifstream f(argv[1], std::ios::binary);
63  auto fsize = fs::file_size(fs::path(argv[1]));
64  std::vector<std::uint8_t> fdata;
65  fdata.resize(fsize);
66  f.read((char*)fdata.data(), fsize);
67 
68  LoadLibraryA("user32.dll");
69  LoadLibraryA("win32u.dll");
70 
71  // declare your allocator, resolver, and copier lambda functions.
72  //
73 
74  theo::recomp::allocator_t allocator =
75  [&](std::uint32_t size,
76  coff::section_characteristics_t section_type) -> std::uintptr_t {
77  return reinterpret_cast<std::uintptr_t>(VirtualAlloc(
78  NULL, size, MEM_COMMIT | MEM_RESERVE,
79  section_type.mem_execute ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE));
80  };
81 
82  theo::recomp::copier_t copier = [&](std::uintptr_t ptr, void* buff,
83  std::uint32_t size) {
84  std::memcpy((void*)ptr, buff, size);
85  };
86 
87  theo::recomp::resolver_t resolver = [&](std::string sym) -> std::uintptr_t {
88  auto loaded_modules = std::make_unique<HMODULE[]>(64);
89  std::uintptr_t result = 0u, loaded_module_sz = 0u;
90  if (!EnumProcessModules(GetCurrentProcess(), loaded_modules.get(), 512,
91  (PDWORD)&loaded_module_sz))
92  return {};
93 
94  for (auto i = 0u; i < loaded_module_sz / 8u; i++) {
95  wchar_t file_name[MAX_PATH] = L"";
96  if (!GetModuleFileNameExW(GetCurrentProcess(), loaded_modules.get()[i],
97  file_name, _countof(file_name)))
98  continue;
99 
100  if ((result = reinterpret_cast<std::uintptr_t>(
101  GetProcAddress(LoadLibraryW(file_name), sym.c_str()))))
102  break;
103  }
104  return result;
105  };
106 
107  // init enc/dec tables only once... important that this is done before adding
108  // obfuscation passes to the engine...
109  //
110  xed_tables_init();
111 
112  // order matters, the order in which the pass is added is the order they
113  // will be executed!
114  //
115  auto engine = theo::obf::engine_t::get();
116 
117  // add in our hello world pass here
118  //
119  engine->add_pass(theo::obf::hello_world_pass_t::get());
120 
121  // add the rest of the passes in this order. this order is important.
122  //
123  engine->add_pass(theo::obf::reloc_transform_pass_t::get());
124  engine->add_pass(theo::obf::next_inst_pass_t::get());
125  engine->add_pass(theo::obf::jcc_rewrite_pass_t::get());
126 
127  std::string entry_name;
128  std::cout << "enter the name of the entry point: ";
129  std::cin >> entry_name;
130 
131  // create a theo object and pass in the lib, your allocator, copier, and
132  // resolver functions, as well as the entry point symbol name.
133  //
134  theo::theo_t t(fdata, {allocator, copier, resolver}, entry_name.data());
135 
136  // call the decompose method to decompose the lib into coff files and extract
137  // the symbols that are used. the result of this call will be an optional
138  // value containing the number of symbols extracted.
139  //
140  auto res = t.decompose();
141 
142  if (!res.has_value()) {
143  spdlog::error("decomposition failed...\n");
144  return -1;
145  }
146 
147  spdlog::info("decomposed {} symbols...", res.value());
148  auto entry_pnt = t.compose();
149  spdlog::info("entry point address: {:X}", entry_pnt);
150  reinterpret_cast<void (*)()>(entry_pnt)();
151 }
static engine_t * get()
get the singleton object of this class.
Definition: engine.cpp:34
static hello_world_pass_t * get()
Definition: hello_world_pass.hpp:45
static jcc_rewrite_pass_t * get()
Definition: jcc_rewrite_pass.cpp:35
static next_inst_pass_t * get()
Definition: next_inst_pass.cpp:34
static reloc_transform_pass_t * get()
Definition: reloc_transform_pass.cpp:34
the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge ...
Definition: theo.hpp:70
std::function< void(std::uintptr_t, void *, std::uint32_t)> copier_t
a function which is called by recomp_t to copy symbols into memory.
Definition: recomp.hpp:49
std::function< std::uintptr_t(std::string)> resolver_t
a function which is called by recomp_t to resolve external symbols
Definition: recomp.hpp:44
std::function< std::uintptr_t(std::uint32_t, coff::section_characteristics_t)> allocator_t
a function which is called to allocate space for a symbol.
Definition: recomp.hpp:59