Theodosius v3.0
Jit linker, symbol mapper, and obfuscator
|
this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol. More...
#include "reloc_transform_pass.hpp"
Public Member Functions | |
void | run (decomp::symbol_t *sym) |
virtual method which must be implimented by the pass that inherits this class. More... | |
Public Member Functions inherited from theo::obf::pass_t | |
pass_t (decomp::sym_type_t sym_type) | |
the explicit constructor of the pass_t base class. More... | |
virtual void | run (decomp::symbol_t *sym)=0 |
virtual method which must be implimented by the pass that inherits this class. More... | |
decomp::sym_type_t | sym_type () |
gets the passes symbol type. More... | |
Static Public Member Functions | |
static reloc_transform_pass_t * | get () |
this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol.
given the following code:
mov rax, &MessageBoxA
this pass will generate a random number of transformations to encrypt the address of "MessageBoxA". These transformations will then be applied by theodosius internally when resolving relocations.
mov rax, enc_MessageBoxA xor rax, 0x389284324 add rax, 0x345332567 ror rax, 0x5353
Definition at line 56 of file reloc_transform_pass.hpp.
|
static |
Definition at line 34 of file reloc_transform_pass.cpp.
Referenced by main().
|
virtual |
virtual method which must be implimented by the pass that inherits this class.
sym | a symbol of the same type of m_sym_type. |
Implements theo::obf::pass_t.
Definition at line 39 of file reloc_transform_pass.cpp.
References theo::decomp::symbol_t::data(), theo::obf::transform::generate(), and theo::decomp::symbol_t::name().