Theodosius v3.0
Jit linker, symbol mapper, and obfuscator
Class Hierarchy
This inheritance list is sorted roughly, but not completely, alphabetically:
[detail level 12]
 Ctheo::decomp::decomp_tthe main decomposition class which is responsible for breaking down lib file into coff files, and extracted used symbols from the coff files.
 Ctheo::obf::engine_tsingleton obfuscation engine class. this class is responsible for keeping track of the registered passes and the order in which to execute them.
 Ctheo::obf::transform::operation_toperation_t is the base class for all types of transformations. classes that inherit this class are singleton and simply call the super constructor (operation_t::operation_t).
 Ctheo::obf::transform::add_op_t
 Ctheo::obf::transform::rol_op_t
 Ctheo::obf::transform::ror_op_t
 Ctheo::obf::transform::sub_op_t
 Ctheo::obf::transform::xor_op_t
 Ctheo::obf::pass_tthe pass_t class is a base clase for all passes made. you must override the pass_t::run virtual function and declare the logic of your pass there
 Ctheo::obf::hello_world_pass_thello world pass example of how to inherit pass_t.
 Ctheo::obf::jcc_rewrite_pass_tjcc rewrite pass which rewrites rip relative jcc's so that they are position independent
 Ctheo::obf::next_inst_pass_tThis pass is used to generate transformations and jmp code to change RIP to the next instruction
 Ctheo::obf::reloc_transform_pass_tthis pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol
 Ctheo::recomp::recomp_tthe main class responsible for recomposition
 Ctheo::recomp::reloc_tmeta data about a relocation for a symbol
 Ctheo::decomp::routine_tthe routine class which is responsible for creating symbols for routines. if the routine is located inside a section with the name ".split" it will break functions into instruction symbols.
 Ctheo::decomp::symbol_tsymbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol. symbols can be different things, sections, functions, and even instructions (when functions are broken down)
 Ctheo::recomp::symbol_table_tthis class is a high level wrapper for a hashmap that contains decomp::symbol_t values. the symbol values are references by a hashcode.
 Ctheo::theo_tthe main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp