You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
#ifndef __VIRTUALIZER_H
|
|
|
|
|
#define __VIRTUALIZER_H
|
|
|
|
|
|
|
|
|
|
#include "Code.h"
|
|
|
|
|
#include "VmCode.h"
|
|
|
|
|
#include "NativeCode.h"
|
|
|
|
|
#include "VMDefs.h"
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Structure:
|
|
|
|
|
*
|
|
|
|
|
* Instructions:
|
|
|
|
|
* - Two byte opcode
|
|
|
|
|
* -
|
|
|
|
|
*
|
|
|
|
|
* Replace the code of the original code with random bytes and somewhere within it put the entry into the vm
|
|
|
|
|
* Put the address of the virtual function code into rax, then jmp to vmenter.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
typedef struct _VIRTUALIZER
|
|
|
|
|
{
|
|
|
|
|
UCHAR DefaultInstructions[VM_ICLASS_COUNT];
|
|
|
|
|
PNATIVE_CODE_BLOCK Block;
|
|
|
|
|
}VIRTUALIZER, *PVIRTUALIZER;
|
|
|
|
|
|
|
|
|
|
BOOL ViCanHandleInst(PNATIVE_CODE_LINK Link);
|
|
|
|
|
BOOL ViValidateNativeCodeBlock(PVIRTUALIZER Vm, PNATIVE_CODE_BLOCK Block);
|
|
|
|
|
|
|
|
|
|
#endif
|
