From 68fc208612347e1ee8a0a5e5fcef09e46141b7e9 Mon Sep 17 00:00:00 2001 From: Iizerd Date: Thu, 30 Sep 2021 02:32:20 -0700 Subject: [PATCH] started native disassembler native disassembler started and project layout --- .gitignore | 42 +++++ CodeVirtualizer.sln | 31 ++++ CodeVirtualizer/Code.h | 6 + CodeVirtualizer/CodeVirtualizer.vcxproj | 167 +++++++++++++++++ .../CodeVirtualizer.vcxproj.filters | 38 ++++ CodeVirtualizer/CodeVirtualizer.vcxproj.user | 4 + CodeVirtualizer/Main.cpp | 14 ++ CodeVirtualizer/NativeCode.cpp | 174 ++++++++++++++++++ CodeVirtualizer/NativeCode.h | 49 +++++ CodeVirtualizer/VmCode.cpp | 1 + CodeVirtualizer/VmCode.h | 8 + CodeVirtualizer/Windas.h | 13 ++ CodeVirtualizer/XedWrap.cpp | 6 + CodeVirtualizer/XedWrap.h | 39 ++++ .../x64/Release/CodeVirtualizer.exe.recipe | 7 + 15 files changed, 599 insertions(+) create mode 100644 .gitignore create mode 100644 CodeVirtualizer.sln create mode 100644 CodeVirtualizer/Code.h create mode 100644 CodeVirtualizer/CodeVirtualizer.vcxproj create mode 100644 CodeVirtualizer/CodeVirtualizer.vcxproj.filters create mode 100644 CodeVirtualizer/CodeVirtualizer.vcxproj.user create mode 100644 CodeVirtualizer/Main.cpp create mode 100644 CodeVirtualizer/NativeCode.cpp create mode 100644 CodeVirtualizer/NativeCode.h create mode 100644 CodeVirtualizer/VmCode.cpp create mode 100644 CodeVirtualizer/VmCode.h create mode 100644 CodeVirtualizer/Windas.h create mode 100644 CodeVirtualizer/XedWrap.cpp create mode 100644 CodeVirtualizer/XedWrap.h create mode 100644 CodeVirtualizer/x64/Release/CodeVirtualizer.exe.recipe diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7f4b568 --- /dev/null +++ b/.gitignore @@ -0,0 +1,42 @@ +# Prerequisites +*.d + +# Compiled Object files +*.slo +*.lo +*.o +*.obj + +# Precompiled Headers +*.gch +*.pch + +# Compiled Dynamic libraries +*.so +*.dylib +*.dll + +# Fortran module files +*.mod +*.smod + +# Compiled Static libraries +*.lai +*.la +*.a +*.lib + +# Executables +*.exe +*.out +*.app +*.pdb +*.ipch +*.db + +.vs/ +*.log +*.tlog +*.ipdb +*.iobj +*.idb diff --git a/CodeVirtualizer.sln b/CodeVirtualizer.sln new file mode 100644 index 0000000..8075d6f --- /dev/null +++ b/CodeVirtualizer.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30413.136 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CodeVirtualizer", "CodeVirtualizer\CodeVirtualizer.vcxproj", "{BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Debug|x64.ActiveCfg = Debug|x64 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Debug|x64.Build.0 = Debug|x64 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Debug|x86.ActiveCfg = Debug|Win32 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Debug|x86.Build.0 = Debug|Win32 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Release|x64.ActiveCfg = Release|x64 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Release|x64.Build.0 = Release|x64 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Release|x86.ActiveCfg = Release|Win32 + {BC5C8C97-FCB6-41A5-BFA0-56CB98491CA9}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {011CDD99-ECDA-4736-8C7E-F74BB280B796} + EndGlobalSection +EndGlobal diff --git a/CodeVirtualizer/Code.h b/CodeVirtualizer/Code.h new file mode 100644 index 0000000..42789f6 --- /dev/null +++ b/CodeVirtualizer/Code.h @@ -0,0 +1,6 @@ +#ifndef __CODE_H +#define __CODE_H + +#define CODE_FLAG_IS_LABEL (1<<0) + +#endif \ No newline at end of file diff --git a/CodeVirtualizer/CodeVirtualizer.vcxproj b/CodeVirtualizer/CodeVirtualizer.vcxproj new file mode 100644 index 0000000..e04e9c7 --- /dev/null +++ b/CodeVirtualizer/CodeVirtualizer.vcxproj @@ -0,0 +1,167 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {bc5c8c97-fcb6-41a5-bfa0-56cb98491ca9} + CodeVirtualizer + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + false + + + Application + false + v142 + true + Unicode + false + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + C:\%24Fanta\IntelXED\build\obj\wkit\include;%(AdditionalIncludeDirectories) + + + Console + true + C:\%24Fanta\IntelXED\build\obj\wkit\lib;%(AdditionalLibraryDirectories) + xed.lib;%(AdditionalDependencies) + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + C:\%24Fanta\IntelXED\build\obj\wkit\include;%(AdditionalIncludeDirectories) + + + Console + true + true + true + C:\%24Fanta\IntelXED\build\obj\wkit\lib;%(AdditionalLibraryDirectories) + xed.lib;%(AdditionalDependencies) + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/CodeVirtualizer/CodeVirtualizer.vcxproj.filters b/CodeVirtualizer/CodeVirtualizer.vcxproj.filters new file mode 100644 index 0000000..b904f39 --- /dev/null +++ b/CodeVirtualizer/CodeVirtualizer.vcxproj.filters @@ -0,0 +1,38 @@ + + + + + Xed + + + + Code + + + Code + + + Code + + + + + + Xed + + + Code + + + Code + + + + + {955537e1-9169-4285-a7e9-1b388418e92f} + + + {d8c41b5b-3520-4266-a1bc-30bb628752d9} + + + \ No newline at end of file diff --git a/CodeVirtualizer/CodeVirtualizer.vcxproj.user b/CodeVirtualizer/CodeVirtualizer.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/CodeVirtualizer/CodeVirtualizer.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/CodeVirtualizer/Main.cpp b/CodeVirtualizer/Main.cpp new file mode 100644 index 0000000..6852f47 --- /dev/null +++ b/CodeVirtualizer/Main.cpp @@ -0,0 +1,14 @@ + +#include +#include + + +#include "NativeCode.h" + +int main() +{ + + //PNATIVE_CODE_LINK temp = new NATIVE_CODE_LINK("Hello"); + system("pause"); + +} \ No newline at end of file diff --git a/CodeVirtualizer/NativeCode.cpp b/CodeVirtualizer/NativeCode.cpp new file mode 100644 index 0000000..bfe5dbd --- /dev/null +++ b/CodeVirtualizer/NativeCode.cpp @@ -0,0 +1,174 @@ +#include "NativeCode.h" + +_NATIVE_CODE_LINK::_NATIVE_CODE_LINK() +{ + XedDecodedInstZero(&XedInst); + XedDecodedInstSetMode(&XedInst, XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b); + Flags = 0; + Next = Prev = NULL; + Label = 0; + RawData = NULL; + RawDataSize = 0UL; +} + +_NATIVE_CODE_LINK::_NATIVE_CODE_LINK(ULONG LabelId) + : _NATIVE_CODE_LINK() +{ + Label = LabelId; + Flags = CODE_FLAG_IS_LABEL; +} + +VOID NcInsertLinkAfter(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2) +{ + if (Link1) + { + Link2->Prev = Link1; + Link2->Next = Link1->Next; + Link1->Next = Link2; + if (Link2->Next) + Link2->Next->Prev = Link2; + } +} + +VOID NcInsertLinkBefore(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2) +{ + if (Link1) + { + Link2->Next = Link1; + Link2->Prev = Link1->Prev; + Link1->Prev = Link2; + if (Link2->Prev) + Link2->Prev->Next = Link2; + } +} + +VOID NcUnlink(PNATIVE_CODE_LINK Link) +{ + if (Link) + { + if (Link->Next) + Link->Next->Prev = Link->Prev; + if (Link->Prev) + Link->Prev->Next = Link->Next; + } +} + +VOID NcConcat(PNATIVE_CODE_BLOCK Block1, PNATIVE_CODE_BLOCK Block2) +{ + //Cant simply concatinate blocks here, need to go through the second block and + //update the label names so that there are no conflicts between the two blocks +} + +VOID NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block) +{ + +} + +VOID NcInsertBlockBfore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block) +{ + +} + +BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block) +{ + ULONG CurrentLabelId = 0; + for (PNATIVE_CODE_LINK T = Block->Start; T; T = T->Next) + { + XED_CATEGORY_ENUM Category = XedDecodedInstGetCategory(&T->XedInst); + + if (Category != XED_CATEGORY_COND_BR && Category != XED_CATEGORY_UNCOND_BR) + continue; + + ULONG OperandCount = XedDecodedInstNumOperands(&T->XedInst); + if (OperandCount < 1) + continue; + + CONST XED_INST* Inst = XedDecodedInstInst(&T->XedInst); + if (!Inst) + continue; + + CONST XED_OPERAND* Operand = XedInstOperand(Inst, 0); + if (!Operand) + continue; + + XED_OPERAND_TYPE_ENUM OperandType = XedOperandType(Operand); + if (OperandType != XED_OPERAND_TYPE_IMM && OperandType != XED_OPERAND_TYPE_IMM_CONST) + { + printf("Found jump to non immediate value. Cat: %s\n", XedCategoryEnumToString(Category)); + continue; + } + + INT32 BranchDisplacement = XedDecodedInstGetBranchDisplacement(&T->XedInst); + PNATIVE_CODE_LINK JmpPos = NcValidateJmp(T, BranchDisplacement); + if (!JmpPos) + { + printf("Failed to validate jump. Type: %s, Displacement: %d", XedCategoryEnumToString(Category), BranchDisplacement); + return FALSE; + } + + if (JmpPos->Prev && (JmpPos->Prev->Flags & CODE_FLAG_IS_LABEL)) + { + T->Label = JmpPos->Prev->Label; + } + else + { + NcInsertLinkBefore(JmpPos, new NATIVE_CODE_LINK(CurrentLabelId++)); + } + } +} + +PNATIVE_CODE_LINK NcValidateJmp(PNATIVE_CODE_LINK Jmp, INT32 Delta) +{ + if (Delta < 0) + { + + } + else if (Delta > 0) + { + + } +} + +BOOL NcFromBuffer(PNATIVE_CODE_BLOCK Block, PVOID Buffer, ULONG BufferSize) +{ + Block->Start = new NATIVE_CODE_LINK; + Block->End = Block->Start; + + PUCHAR Buf = (PUCHAR)Buffer; + ULONG Offset = 0; + + while (Offset < BufferSize) + { + PNATIVE_CODE_LINK Link = new NATIVE_CODE_LINK; + ULONG PossibleSize = min(15, BufferSize - Offset); + + XED_ERROR_ENUM DecodeError = XedDecode(&Link->XedInst, (Buf + Offset), PossibleSize); + if (DecodeError != XED_ERROR_NONE) + { + printf("XedDecode failed with error %s\n", XedErrorEnumToString(DecodeError)); + NcDelete(Block); + delete Link; + return FALSE; + } + + Link->Prev = Block->End; + Block->End->Next = Link; + Block->End = Link; + } + + PNATIVE_CODE_LINK StartLink = Block->Start; + Block->Start = Block->Start->Next; + delete StartLink; + + return TRUE; +} + +VOID NcDelete(PNATIVE_CODE_BLOCK Block) +{ + for (PNATIVE_CODE_LINK T = Block->Start; T;) + { + PNATIVE_CODE_LINK Next = T->Next; + delete T; + T = Next; + } +} diff --git a/CodeVirtualizer/NativeCode.h b/CodeVirtualizer/NativeCode.h new file mode 100644 index 0000000..de4f5d5 --- /dev/null +++ b/CodeVirtualizer/NativeCode.h @@ -0,0 +1,49 @@ +#ifndef __NATIVE_CODE_H +#define __NATIVE_CODE_H + +#include "Windas.h" +#include "XedWrap.h" +#include "Code.h" + +typedef struct _NATIVE_CODE_LINK +{ + _NATIVE_CODE_LINK* Next; + _NATIVE_CODE_LINK* Prev; + + ULONG Flags; + ULONG Label; + PUCHAR RawData; + ULONG RawDataSize; + XED_DECODED_INST XedInst; + _NATIVE_CODE_LINK(); + _NATIVE_CODE_LINK(ULONG LabelId); +}NATIVE_CODE_LINK, *PNATIVE_CODE_LINK; + +typedef struct _NATIVE_CODE_BLOCK +{ + PNATIVE_CODE_LINK Start; + PNATIVE_CODE_LINK End; +}NATIVE_CODE_BLOCK, * PNATIVE_CODE_BLOCK; + +VOID NcInsertLinkAfter(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2); + +VOID NcInsertLinkBefore(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2); + +VOID NcUnlink(PNATIVE_CODE_LINK Link); + +VOID NcConcat(PNATIVE_CODE_BLOCK Block1, PNATIVE_CODE_BLOCK Block2); + +VOID NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block); + +VOID NcInsertBlockBfore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block); + +BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block); + +PNATIVE_CODE_LINK NcValidateJmp(PNATIVE_CODE_LINK Link, INT32 Delta); + +BOOL NcFromBuffer(PNATIVE_CODE_BLOCK Block, PVOID Buffer, ULONG BufferSize); + +VOID NcDelete(PNATIVE_CODE_BLOCK Block); + + +#endif \ No newline at end of file diff --git a/CodeVirtualizer/VmCode.cpp b/CodeVirtualizer/VmCode.cpp new file mode 100644 index 0000000..d87d1a4 --- /dev/null +++ b/CodeVirtualizer/VmCode.cpp @@ -0,0 +1 @@ +#include "VmCode.h" \ No newline at end of file diff --git a/CodeVirtualizer/VmCode.h b/CodeVirtualizer/VmCode.h new file mode 100644 index 0000000..491b4a4 --- /dev/null +++ b/CodeVirtualizer/VmCode.h @@ -0,0 +1,8 @@ +#ifndef __VM_CODE_H +#define __VM_CODE_H + +#include "Windas.h" + + + +#endif \ No newline at end of file diff --git a/CodeVirtualizer/Windas.h b/CodeVirtualizer/Windas.h new file mode 100644 index 0000000..ce53263 --- /dev/null +++ b/CodeVirtualizer/Windas.h @@ -0,0 +1,13 @@ +#ifndef __WINDAS_H +#define __WINDAS_H + +#include +#include +#include + +#define INLINE inline +#define STDSTRING std::string +#define STDVECTOR std::vector + + +#endif \ No newline at end of file diff --git a/CodeVirtualizer/XedWrap.cpp b/CodeVirtualizer/XedWrap.cpp new file mode 100644 index 0000000..3f8fefc --- /dev/null +++ b/CodeVirtualizer/XedWrap.cpp @@ -0,0 +1,6 @@ +#include "XedWrap.h" + +VOID InitXed() +{ + xed_tables_init(); +} diff --git a/CodeVirtualizer/XedWrap.h b/CodeVirtualizer/XedWrap.h new file mode 100644 index 0000000..c5f5eef --- /dev/null +++ b/CodeVirtualizer/XedWrap.h @@ -0,0 +1,39 @@ +#ifndef __XED_WRAPPER_H +#define __XED_WRAPPER_H + +#include "Windas.h" + +extern "C" +{ +#include +} + + +VOID InitXed(); + +#define XED_DECODED_INST xed_decoded_inst_t +#define XED_INST xed_inst_t +#define XED_OPERAND xed_operand_t + +#define XED_OPERAND_TYPE_ENUM xed_operand_type_enum_t +#define XED_ERROR_ENUM xed_error_enum_t +#define XED_CATEGORY_ENUM xed_category_enum_t + +#define XedDecodedInstZero xed_decoded_inst_zero +#define XedDecodedInstSetMode xed_decoded_inst_set_mode +#define XedDecode xed_decode +#define XedDecodedInstGetLength xed_decoded_inst_get_length +#define XedDecodedInstGetCategory xed_decoded_inst_get_category +#define XedDecodedInstGetBranchDisplacementWidth xed_decoded_inst_get_branch_displacement_width +#define XedDecodedInstGetBranchDisplacement xed_decoded_inst_get_branch_displacement +#define XedDecodedInstInst xed_decoded_inst_inst +#define XedDecodedInstNumOperands xed_decoded_inst_noperands + +#define XedInstOperand xed_inst_operand + +#define XedOperandType xed_operand_type + +#define XedErrorEnumToString xed_error_enum_t2str +#define XedCategoryEnumToString xed_category_enum_t2str + +#endif \ No newline at end of file diff --git a/CodeVirtualizer/x64/Release/CodeVirtualizer.exe.recipe b/CodeVirtualizer/x64/Release/CodeVirtualizer.exe.recipe new file mode 100644 index 0000000..e78f14d --- /dev/null +++ b/CodeVirtualizer/x64/Release/CodeVirtualizer.exe.recipe @@ -0,0 +1,7 @@ + + + C:\$Fanta\code-virtualizer\x64\Release\CodeVirtualizer.exe + + + + \ No newline at end of file