You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
183 lines
21 KiB
183 lines
21 KiB
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=11"/>
|
|
<meta name="generator" content="Doxygen 1.9.3"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<title>Theodosius: include/obf/passes/next_inst_pass.hpp Source File</title>
|
|
<link href="../../tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="../../jquery.js"></script>
|
|
<script type="text/javascript" src="../../dynsections.js"></script>
|
|
<link href="../../search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="../../search/searchdata.js"></script>
|
|
<script type="text/javascript" src="../../search/search.js"></script>
|
|
<link href="../../doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr id="projectrow">
|
|
<td id="projectlogo"><img alt="Logo" src="../../icon.png"/></td>
|
|
<td id="projectalign">
|
|
<div id="projectname">Theodosius<span id="projectnumber"> v3.0</span>
|
|
</div>
|
|
<div id="projectbrief">Jit linker, symbol mapper, and obfuscator</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.9.3 -->
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&dn=expat.txt MIT */
|
|
var searchBox = new SearchBox("searchBox", "../../search",'Search','.html');
|
|
/* @license-end */
|
|
</script>
|
|
<script type="text/javascript" src="../../menudata.js"></script>
|
|
<script type="text/javascript" src="../../menu.js"></script>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&dn=expat.txt MIT */
|
|
$(function() {
|
|
initMenu('../../',true,false,'search.php','Search');
|
|
$(document).ready(function() { init_search(); });
|
|
});
|
|
/* @license-end */
|
|
</script>
|
|
<div id="main-nav"></div>
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
</div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
|
name="MSearchResults" id="MSearchResults">
|
|
</iframe>
|
|
</div>
|
|
|
|
<div id="nav-path" class="navpath">
|
|
<ul>
|
|
<li class="navelem"><a class="el" href="../../dir_d44c64559bbebec7f509842c48db8b23.html">include</a></li><li class="navelem"><a class="el" href="../../dir_ef99456410776b930b88f5850437ce61.html">obf</a></li><li class="navelem"><a class="el" href="../../dir_13fb3109ea9f625158dab961edf6214d.html">passes</a></li> </ul>
|
|
</div>
|
|
</div><!-- top -->
|
|
<div class="header">
|
|
<div class="headertitle"><div class="title">next_inst_pass.hpp</div></div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
<a href="../../d5/d54/next__inst__pass_8hpp.html">Go to the documentation of this file.</a><div class="fragment"><div class="line"><a id="l00001" name="l00001"></a><span class="lineno"> 1</span><span class="comment">// Copyright (c) 2022, _xeroxz</span></div>
|
|
<div class="line"><a id="l00002" name="l00002"></a><span class="lineno"> 2</span><span class="comment">// All rights reserved.</span></div>
|
|
<div class="line"><a id="l00003" name="l00003"></a><span class="lineno"> 3</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00004" name="l00004"></a><span class="lineno"> 4</span><span class="comment">// Redistribution and use in source and binary forms, with or without</span></div>
|
|
<div class="line"><a id="l00005" name="l00005"></a><span class="lineno"> 5</span><span class="comment">// modification, are permitted provided that the following conditions are met:</span></div>
|
|
<div class="line"><a id="l00006" name="l00006"></a><span class="lineno"> 6</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00007" name="l00007"></a><span class="lineno"> 7</span><span class="comment">// 1. Redistributions of source code must retain the above copyright notice,</span></div>
|
|
<div class="line"><a id="l00008" name="l00008"></a><span class="lineno"> 8</span><span class="comment">// this list of conditions and the following disclaimer.</span></div>
|
|
<div class="line"><a id="l00009" name="l00009"></a><span class="lineno"> 9</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00010" name="l00010"></a><span class="lineno"> 10</span><span class="comment">// 2. Redistributions in binary form must reproduce the above copyright notice,</span></div>
|
|
<div class="line"><a id="l00011" name="l00011"></a><span class="lineno"> 11</span><span class="comment">// this list of conditions and the following disclaimer in the documentation</span></div>
|
|
<div class="line"><a id="l00012" name="l00012"></a><span class="lineno"> 12</span><span class="comment">// and/or other materials provided with the distribution.</span></div>
|
|
<div class="line"><a id="l00013" name="l00013"></a><span class="lineno"> 13</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00014" name="l00014"></a><span class="lineno"> 14</span><span class="comment">// 3. Neither the name of the copyright holder nor the names of its</span></div>
|
|
<div class="line"><a id="l00015" name="l00015"></a><span class="lineno"> 15</span><span class="comment">// contributors may be used to endorse or promote products derived from</span></div>
|
|
<div class="line"><a id="l00016" name="l00016"></a><span class="lineno"> 16</span><span class="comment">// this software without specific prior written permission.</span></div>
|
|
<div class="line"><a id="l00017" name="l00017"></a><span class="lineno"> 17</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00018" name="l00018"></a><span class="lineno"> 18</span><span class="comment">// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"</span></div>
|
|
<div class="line"><a id="l00019" name="l00019"></a><span class="lineno"> 19</span><span class="comment">// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE</span></div>
|
|
<div class="line"><a id="l00020" name="l00020"></a><span class="lineno"> 20</span><span class="comment">// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE</span></div>
|
|
<div class="line"><a id="l00021" name="l00021"></a><span class="lineno"> 21</span><span class="comment">// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE</span></div>
|
|
<div class="line"><a id="l00022" name="l00022"></a><span class="lineno"> 22</span><span class="comment">// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR</span></div>
|
|
<div class="line"><a id="l00023" name="l00023"></a><span class="lineno"> 23</span><span class="comment">// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF</span></div>
|
|
<div class="line"><a id="l00024" name="l00024"></a><span class="lineno"> 24</span><span class="comment">// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS</span></div>
|
|
<div class="line"><a id="l00025" name="l00025"></a><span class="lineno"> 25</span><span class="comment">// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN</span></div>
|
|
<div class="line"><a id="l00026" name="l00026"></a><span class="lineno"> 26</span><span class="comment">// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)</span></div>
|
|
<div class="line"><a id="l00027" name="l00027"></a><span class="lineno"> 27</span><span class="comment">// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE</span></div>
|
|
<div class="line"><a id="l00028" name="l00028"></a><span class="lineno"> 28</span><span class="comment">// POSSIBILITY OF SUCH DAMAGE.</span></div>
|
|
<div class="line"><a id="l00029" name="l00029"></a><span class="lineno"> 29</span><span class="comment">//</span></div>
|
|
<div class="line"><a id="l00030" name="l00030"></a><span class="lineno"> 30</span> </div>
|
|
<div class="line"><a id="l00031" name="l00031"></a><span class="lineno"> 31</span><span class="preprocessor">#pragma once</span></div>
|
|
<div class="line"><a id="l00032" name="l00032"></a><span class="lineno"> 32</span><span class="preprocessor">#include <<a class="code" href="../../d8/d5a/pass_8hpp.html">obf/pass.hpp</a>></span></div>
|
|
<div class="line"><a id="l00033" name="l00033"></a><span class="lineno"> 33</span> </div>
|
|
<div class="line"><a id="l00034" name="l00034"></a><span class="lineno"> 34</span><span class="keyword">namespace </span><a class="code hl_namespace" href="../../d5/da8/namespacetheo_1_1obf.html" title="this is the main namespace for obfuscation related things.">theo::obf</a> {<span class="comment"></span></div>
|
|
<div class="line"><a id="l00035" name="l00035"></a><span class="lineno"> 35</span><span class="comment">/// <summary></span></div>
|
|
<div class="line"><a id="l00036" name="l00036"></a><span class="lineno"> 36</span><span class="comment">/// This pass is used to generate transformations and jmp code to change RIP to</span></div>
|
|
<div class="line"><a id="l00037" name="l00037"></a><span class="lineno"> 37</span><span class="comment">/// the next instruction.</span></div>
|
|
<div class="line"><a id="l00038" name="l00038"></a><span class="lineno"> 38</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00039" name="l00039"></a><span class="lineno"> 39</span><span class="comment">/// given the following code (get pml4 address from cr3):</span></div>
|
|
<div class="line"><a id="l00040" name="l00040"></a><span class="lineno"> 40</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00041" name="l00041"></a><span class="lineno"> 41</span><span class="comment">/// get_pml4:</span></div>
|
|
<div class="line"><a id="l00042" name="l00042"></a><span class="lineno"> 42</span><span class="comment">/// 0: 48 c7 c0 ff 0f 00 00 mov rax,0xfff</span></div>
|
|
<div class="line"><a id="l00043" name="l00043"></a><span class="lineno"> 43</span><span class="comment">/// 7: 48 f7 d0 not rax</span></div>
|
|
<div class="line"><a id="l00044" name="l00044"></a><span class="lineno"> 44</span><span class="comment">/// a: 0f 20 da mov rdx,cr3</span></div>
|
|
<div class="line"><a id="l00045" name="l00045"></a><span class="lineno"> 45</span><span class="comment">/// d: 48 21 c2 and rdx,rax</span></div>
|
|
<div class="line"><a id="l00046" name="l00046"></a><span class="lineno"> 46</span><span class="comment">/// 10: b1 00 mov cl,0x0</span></div>
|
|
<div class="line"><a id="l00047" name="l00047"></a><span class="lineno"> 47</span><span class="comment">/// 12: 48 d3 e2 shl rdx,cl</span></div>
|
|
<div class="line"><a id="l00048" name="l00048"></a><span class="lineno"> 48</span><span class="comment">/// 15: 48 89 d0 mov rax,rdx</span></div>
|
|
<div class="line"><a id="l00049" name="l00049"></a><span class="lineno"> 49</span><span class="comment">/// 18: c3 ret</span></div>
|
|
<div class="line"><a id="l00050" name="l00050"></a><span class="lineno"> 50</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00051" name="l00051"></a><span class="lineno"> 51</span><span class="comment">/// this pass will break up each instruction so that it can be anywhere in a</span></div>
|
|
<div class="line"><a id="l00052" name="l00052"></a><span class="lineno"> 52</span><span class="comment">/// linear virtual address space. this pass will not work on rip relative code,</span></div>
|
|
<div class="line"><a id="l00053" name="l00053"></a><span class="lineno"> 53</span><span class="comment">/// however clang will not generate such code when compiled with</span></div>
|
|
<div class="line"><a id="l00054" name="l00054"></a><span class="lineno"> 54</span><span class="comment">/// "-mcmodel=large"</span></div>
|
|
<div class="line"><a id="l00055" name="l00055"></a><span class="lineno"> 55</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00056" name="l00056"></a><span class="lineno"> 56</span><span class="comment">/// get_pml4@0:</span></div>
|
|
<div class="line"><a id="l00057" name="l00057"></a><span class="lineno"> 57</span><span class="comment">/// mov rax, 0xFFF</span></div>
|
|
<div class="line"><a id="l00058" name="l00058"></a><span class="lineno"> 58</span><span class="comment">/// push [next_inst_addr_enc]</span></div>
|
|
<div class="line"><a id="l00059" name="l00059"></a><span class="lineno"> 59</span><span class="comment">/// xor [rsp], 0x3243342</span></div>
|
|
<div class="line"><a id="l00060" name="l00060"></a><span class="lineno"> 60</span><span class="comment">/// ; a random number of transformations here...</span></div>
|
|
<div class="line"><a id="l00061" name="l00061"></a><span class="lineno"> 61</span><span class="comment">/// ret</span></div>
|
|
<div class="line"><a id="l00062" name="l00062"></a><span class="lineno"> 62</span><span class="comment">/// next_inst_addr_enc:</span></div>
|
|
<div class="line"><a id="l00063" name="l00063"></a><span class="lineno"> 63</span><span class="comment">/// ; encrypted address of the next instruction goes here.</span></div>
|
|
<div class="line"><a id="l00064" name="l00064"></a><span class="lineno"> 64</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00065" name="l00065"></a><span class="lineno"> 65</span><span class="comment">/// get_pml4@7:</span></div>
|
|
<div class="line"><a id="l00066" name="l00066"></a><span class="lineno"> 66</span><span class="comment">/// not rax</span></div>
|
|
<div class="line"><a id="l00067" name="l00067"></a><span class="lineno"> 67</span><span class="comment">/// push [next_inst_addr_enc]</span></div>
|
|
<div class="line"><a id="l00068" name="l00068"></a><span class="lineno"> 68</span><span class="comment">/// xor [rsp], 0x93983498</span></div>
|
|
<div class="line"><a id="l00069" name="l00069"></a><span class="lineno"> 69</span><span class="comment">/// ; a random number of transformations here...</span></div>
|
|
<div class="line"><a id="l00070" name="l00070"></a><span class="lineno"> 70</span><span class="comment">/// ret</span></div>
|
|
<div class="line"><a id="l00071" name="l00071"></a><span class="lineno"> 71</span><span class="comment">/// next_inst_addr_enc:</span></div>
|
|
<div class="line"><a id="l00072" name="l00072"></a><span class="lineno"> 72</span><span class="comment">/// ; encrypted address of the next instruction goes here.</span></div>
|
|
<div class="line"><a id="l00073" name="l00073"></a><span class="lineno"> 73</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00074" name="l00074"></a><span class="lineno"> 74</span><span class="comment">/// this process is continued for each instruction in the function. the last</span></div>
|
|
<div class="line"><a id="l00075" name="l00075"></a><span class="lineno"> 75</span><span class="comment">/// instruction "ret" will have no code generated for it as there is no next</span></div>
|
|
<div class="line"><a id="l00076" name="l00076"></a><span class="lineno"> 76</span><span class="comment">/// instruction.</span></div>
|
|
<div class="line"><a id="l00077" name="l00077"></a><span class="lineno"> 77</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00078" name="l00078"></a><span class="lineno"> 78</span><span class="comment">///</span></div>
|
|
<div class="line"><a id="l00079" name="l00079"></a><span class="lineno"> 79</span><span class="comment">/// this pass also only runs at the instruction level, theodosius internally</span></div>
|
|
<div class="line"><a id="l00080" name="l00080"></a><span class="lineno"> 80</span><span class="comment">/// breaks up functions inside of the ".split" section into individual</span></div>
|
|
<div class="line"><a id="l00081" name="l00081"></a><span class="lineno"> 81</span><span class="comment">/// instruction symbols. this process also creates a psuedo relocation which</span></div>
|
|
<div class="line"><a id="l00082" name="l00082"></a><span class="lineno"> 82</span><span class="comment">/// simply tells this pass that there needs to be a relocation to the next</span></div>
|
|
<div class="line"><a id="l00083" name="l00083"></a><span class="lineno"> 83</span><span class="comment">/// symbol. the offset for these psuedo relocations is zero.</span></div>
|
|
<div class="line"><a id="l00084" name="l00084"></a><span class="lineno"> 84</span><span class="comment">/// </summary></span></div>
|
|
<div class="line"><a id="l00085" name="l00085"></a><span class="lineno"><a class="line" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html"> 85</a></span><span class="comment"></span><span class="keyword">class </span><a class="code hl_class" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html" title="This pass is used to generate transformations and jmp code to change RIP to the next instruction.">next_inst_pass_t</a> : <span class="keyword">public</span> <a class="code hl_class" href="../../d4/dad/classtheo_1_1obf_1_1pass__t.html" title="the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual funct...">pass_t</a> {</div>
|
|
<div class="line"><a id="l00086" name="l00086"></a><span class="lineno"> 86</span> <span class="keyword">explicit</span> <a class="code hl_class" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html" title="This pass is used to generate transformations and jmp code to change RIP to the next instruction.">next_inst_pass_t</a>() : <a class="code hl_function" href="../../d4/dad/classtheo_1_1obf_1_1pass__t.html#abd4ab22cc2822b968267be7f8397d611" title="the explicit constructor of the pass_t base class.">pass_t</a>(<a class="code hl_enumvalue" href="../../d9/dbd/namespacetheo_1_1decomp.html#af96177687d0ad683c5897d8fa01135f9a4842f4c175b1ec87fc82ef3757d3a0e9">decomp::sym_type_t::instruction</a>) {</div>
|
|
<div class="line"><a id="l00087" name="l00087"></a><span class="lineno"> 87</span> xed_state_t istate{XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b};</div>
|
|
<div class="line"><a id="l00088" name="l00088"></a><span class="lineno"> 88</span> xed_decoded_inst_zero_set_mode(&m_tmp_inst, &istate);</div>
|
|
<div class="line"><a id="l00089" name="l00089"></a><span class="lineno"> 89</span> xed_decode(&m_tmp_inst, m_type_inst_bytes, <span class="keyword">sizeof</span>(m_type_inst_bytes));</div>
|
|
<div class="line"><a id="l00090" name="l00090"></a><span class="lineno"> 90</span> }</div>
|
|
<div class="line"><a id="l00091" name="l00091"></a><span class="lineno"> 91</span> </div>
|
|
<div class="line"><a id="l00092" name="l00092"></a><span class="lineno"> 92</span> <span class="keyword">public</span>:</div>
|
|
<div class="line"><a id="l00093" name="l00093"></a><span class="lineno"> 93</span> <span class="keyword">static</span> <a class="code hl_class" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html" title="This pass is used to generate transformations and jmp code to change RIP to the next instruction.">next_inst_pass_t</a>* <a class="code hl_function" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html#a964e6f5291ccba0442519f2563b3a2e9">get</a>();</div>
|
|
<div class="line"><a id="l00094" name="l00094"></a><span class="lineno"> 94</span> <span class="keywordtype">void</span> <a class="code hl_function" href="../../d5/d08/classtheo_1_1obf_1_1next__inst__pass__t.html#ae4cbba78b14c2b9da794386e4d92f40f" title="virtual method which must be implimented by the pass that inherits this class.">run</a>(<a class="code hl_class" href="../../d9/dd5/classtheo_1_1decomp_1_1symbol__t.html" title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">decomp::symbol_t</a>* sym);</div>
|
|
<div class="line"><a id="l00095" name="l00095"></a><span class="lineno"> 95</span> </div>
|
|
<div class="line"><a id="l00096" name="l00096"></a><span class="lineno"> 96</span> <span class="keyword">private</span>:</div>
|
|
<div class="line"><a id="l00097" name="l00097"></a><span class="lineno"> 97</span> std::optional<recomp::reloc_t*> has_next_inst_reloc(<a class="code hl_class" href="../../d9/dd5/classtheo_1_1decomp_1_1symbol__t.html" title="symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol....">decomp::symbol_t</a>*);</div>
|
|
<div class="line"><a id="l00098" name="l00098"></a><span class="lineno"> 98</span> xed_decoded_inst_t m_tmp_inst;</div>
|
|
<div class="line"><a id="l00099" name="l00099"></a><span class="lineno"> 99</span> std::uint8_t m_type_inst_bytes[9] = {0x48, 0xC7, 0x44, 0x24, 0x08,</div>
|
|
<div class="line"><a id="l00100" name="l00100"></a><span class="lineno"> 100</span> 0x44, 0x33, 0x22, 0x11};</div>
|
|
<div class="line"><a id="l00101" name="l00101"></a><span class="lineno"> 101</span>};</div>
|
|
<div class="line"><a id="l00102" name="l00102"></a><span class="lineno"> 102</span>} <span class="comment">// namespace theo::obf</span></div>
|
|
</div><!-- fragment --></div><!-- contents -->
|
|
<!-- start footer part -->
|
|
<hr class="footer"/><address class="footer"><small>
|
|
Generated by <a href="https://www.doxygen.org/index.html"><img class="footer" src="../../doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.9.3
|
|
</small></address>
|
|
</body>
|
|
</html>
|