You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 lines
1.1 KiB
45 lines
1.1 KiB
3 years ago
|
#ifndef __RIP_XOR_INST_H
|
||
|
#define __RIP_XOR_INST_H
|
||
3 years ago
|
|
||
|
#include "Windas.h"
|
||
|
#include "XedWrap.h"
|
||
|
#include "NativeCode.h"
|
||
|
|
||
|
#define DWORD_XOR_INST_LENGTH 10
|
||
|
#define DWORD_XOR_INST_RIP_OFFSET 2
|
||
|
#define DWORD_XOR_INST_XOR_OFFSET 6
|
||
|
|
||
|
#define WORD_XOR_INST_LENGTH 9
|
||
|
#define WORD_XOR_INST_RIP_OFFSET 3
|
||
|
#define WORD_XOR_INST_XOR_OFFSET 7
|
||
|
|
||
|
#define BYTE_XOR_INST_LENGTH 7
|
||
|
#define BYTE_XOR_INST_RIP_OFFSET 2
|
||
|
#define BYTE_XOR_INST_XOR_OFFSET 6
|
||
|
|
||
|
|
||
|
typedef struct _XOR_INST_DATA
|
||
|
{
|
||
|
ULONG Data[5];
|
||
|
}XOR_INST_DATA, *PXOR_INST_DATA;
|
||
|
|
||
|
BOOL ObfEmitPushfqInst(PNATIVE_CODE_BLOCK Block);
|
||
3 years ago
|
|
||
3 years ago
|
BOOL ObfEmitPopfqInst(PNATIVE_CODE_BLOCK Block);
|
||
3 years ago
|
|
||
3 years ago
|
BOOL ObfEmitRipRelativeXorD(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
||
3 years ago
|
|
||
3 years ago
|
BOOL ObfEmitRipRelativeXorW(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
||
3 years ago
|
|
||
3 years ago
|
BOOL ObfEmitRipRelativeXorB(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
||
3 years ago
|
|
||
|
VOID ObfXorInstBytes(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData);
|
||
|
|
||
3 years ago
|
PNATIVE_CODE_BLOCK ObfEmitPreXorForInst(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData, BOOL SaveFlags);
|
||
3 years ago
|
|
||
3 years ago
|
PNATIVE_CODE_BLOCK ObfEmitPostXorForInst(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData, BOOL SaveFlags);
|
||
|
|
||
3 years ago
|
|
||
|
|
||
3 years ago
|
#endif
|