|
|
|
|
#ifndef __OBFUSCATOR_H
|
|
|
|
|
#define __OBFUSCATOR_H
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#include "Windas.h"
|
|
|
|
|
#include "XedWrap.h"
|
|
|
|
|
#include "NativeCode.h"
|
|
|
|
|
#include "Random.h"
|
|
|
|
|
|
|
|
|
|
//Jit
|
|
|
|
|
#define DWORD_MOV_INST_LENGTH 10
|
|
|
|
|
#define WORD_MOV_INST_LENGTH 9
|
|
|
|
|
#define BYTE_MOV_INST_LENGTH 7
|
|
|
|
|
|
|
|
|
|
BOOL JitEmitRipRelativeMovD(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, PUCHAR Data);
|
|
|
|
|
|
|
|
|
|
BOOL JitEmitRipRelativeMovW(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, PUCHAR Data);
|
|
|
|
|
|
|
|
|
|
BOOL JitEmitRipRelativeMovB(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, PUCHAR Data);
|
|
|
|
|
|
|
|
|
|
PNATIVE_CODE_BLOCK JitEmitPreRipMov(PNATIVE_CODE_LINK Link, INT32 Delta = 0);
|
|
|
|
|
|
|
|
|
|
PNATIVE_CODE_BLOCK JitEmitPostRipMov(PNATIVE_CODE_LINK Link, INT32 Delta = 0);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
VOID ObfGenOpaqueBranch(PNATIVE_CODE_BLOCK Block, FLOAT BranchSizePercentage);
|
|
|
|
|
|
|
|
|
|
UINT ObfMutateInstructions(PNATIVE_CODE_BLOCK Block, UINT MutateChance, BOOL MutateFirst, BOOL MutateOnlyFirst);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
XED_ICLASS_ENUM ObfGetRandomJccClass();
|
|
|
|
|
|
|
|
|
|
PNATIVE_CODE_LINK ObfGenRandomJcc(UINT LabelId, UINT DisplacementSize = 32);
|
|
|
|
|
|
|
|
|
|
PNATIVE_CODE_LINK ObfGenJmpToLabel(UINT LabelId, UINT DisplacementSize = 32);
|
|
|
|
|
|
|
|
|
|
BOOL ObfCreateOpaqueBranches(PNATIVE_CODE_LINK Start, PNATIVE_CODE_LINK End, PNATIVE_CODE_BLOCK NotTaken, PNATIVE_CODE_BLOCK Taken);
|
|
|
|
|
|
|
|
|
|
//Combines the two branches into one block that can easily be patched into the code
|
|
|
|
|
//Resulting block is put into NotTaken
|
|
|
|
|
BOOL ObfCombineOpaqueBranches(PNATIVE_CODE_BLOCK NotTaken, PNATIVE_CODE_BLOCK Taken, UINT JccLabel, UINT JmpLabel);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#endif
|
