maybe something simpler before full virtualization

main
James 3 years ago
parent 8122a76182
commit dcea33c072

@ -151,14 +151,18 @@
<ItemGroup> <ItemGroup>
<ClCompile Include="NativeCode.cpp" /> <ClCompile Include="NativeCode.cpp" />
<ClCompile Include="Main.cpp" /> <ClCompile Include="Main.cpp" />
<ClCompile Include="CryptedCode.cpp" />
<ClCompile Include="Virtualizer.cpp" /> <ClCompile Include="Virtualizer.cpp" />
<ClCompile Include="VirtualMachine.cpp" />
<ClCompile Include="VmCode.cpp" /> <ClCompile Include="VmCode.cpp" />
<ClCompile Include="XedWrap.cpp" /> <ClCompile Include="XedWrap.cpp" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ClInclude Include="Code.h" /> <ClInclude Include="Code.h" />
<ClInclude Include="NativeCode.h" /> <ClInclude Include="NativeCode.h" />
<ClInclude Include="CryptedCode.h" />
<ClInclude Include="Virtualizer.h" /> <ClInclude Include="Virtualizer.h" />
<ClInclude Include="VirtualMachine.h" />
<ClInclude Include="VmCode.h" /> <ClInclude Include="VmCode.h" />
<ClInclude Include="Windas.h" /> <ClInclude Include="Windas.h" />
<ClInclude Include="XedWrap.h" /> <ClInclude Include="XedWrap.h" />

@ -17,6 +17,12 @@
<ClInclude Include="Virtualizer.h"> <ClInclude Include="Virtualizer.h">
<Filter>Virtualizer</Filter> <Filter>Virtualizer</Filter>
</ClInclude> </ClInclude>
<ClInclude Include="VirtualMachine.h">
<Filter>VirtualMachine</Filter>
</ClInclude>
<ClInclude Include="CryptedCode.h">
<Filter>Obfuscator</Filter>
</ClInclude>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ClCompile Include="Main.cpp" /> <ClCompile Include="Main.cpp" />
@ -32,6 +38,12 @@
<ClCompile Include="Virtualizer.cpp"> <ClCompile Include="Virtualizer.cpp">
<Filter>Virtualizer</Filter> <Filter>Virtualizer</Filter>
</ClCompile> </ClCompile>
<ClCompile Include="VirtualMachine.cpp">
<Filter>VirtualMachine</Filter>
</ClCompile>
<ClCompile Include="CryptedCode.cpp">
<Filter>Obfuscator</Filter>
</ClCompile>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<Filter Include="Xed"> <Filter Include="Xed">
@ -43,5 +55,14 @@
<Filter Include="Virtualizer"> <Filter Include="Virtualizer">
<UniqueIdentifier>{f74192e7-2064-44d2-983c-fac92f468c0a}</UniqueIdentifier> <UniqueIdentifier>{f74192e7-2064-44d2-983c-fac92f468c0a}</UniqueIdentifier>
</Filter> </Filter>
<Filter Include="Virtualizer\NewFilter1">
<UniqueIdentifier>{65f3fdd3-b851-4e50-8a48-d1ecb4af2f91}</UniqueIdentifier>
</Filter>
<Filter Include="VirtualMachine">
<UniqueIdentifier>{d784ddc8-2452-41ff-bc20-582ec03b3eb5}</UniqueIdentifier>
</Filter>
<Filter Include="Obfuscator">
<UniqueIdentifier>{cc5b78db-cdf7-4b83-9652-2722cbdec89e}</UniqueIdentifier>
</Filter>
</ItemGroup> </ItemGroup>
</Project> </Project>

@ -0,0 +1,3 @@
#include "CryptedCode.h"
PNATIVE_CODE_BLOCK RxEmitXorForInstruction(PNATIVE_CODE_LINK Link);

@ -0,0 +1,11 @@
#ifndef __CRYPTED_CODE_H
#define __CRYPTED_CODE_H
#include "Windas.h"
#include "XedWrap.h"
#include "NativeCode.h"
PNATIVE_CODE_BLOCK RxEmitXorForInstruction(PNATIVE_CODE_LINK Link);
#endif

@ -4,16 +4,18 @@ _NATIVE_CODE_LINK::_NATIVE_CODE_LINK()
{ {
XedDecodedInstZero(&XedInst); XedDecodedInstZero(&XedInst);
XedDecodedInstSetMode(&XedInst, XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b); XedDecodedInstSetMode(&XedInst, XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b);
Flags = 0; Flags = 0UL;
Next = Prev = NULL; Next = Prev = NULL;
Label = 0; Block = NULL;
Label = 0UL;
RawData = NULL; RawData = NULL;
RawDataSize = 0UL; RawDataSize = 0UL;
} }
_NATIVE_CODE_LINK::_NATIVE_CODE_LINK(ULONG LabelId) _NATIVE_CODE_LINK::_NATIVE_CODE_LINK(ULONG LabelId, _NATIVE_CODE_BLOCK* B)
: _NATIVE_CODE_LINK() : _NATIVE_CODE_LINK()
{ {
Block = B;
Label = LabelId; Label = LabelId;
Flags = CODE_FLAG_IS_LABEL; Flags = CODE_FLAG_IS_LABEL;
} }
@ -59,14 +61,33 @@ VOID NcConcat(PNATIVE_CODE_BLOCK Block1, PNATIVE_CODE_BLOCK Block2)
//update the label names so that there are no conflicts between the two blocks //update the label names so that there are no conflicts between the two blocks
} }
VOID NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block) BOOL NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block)
{ {
} }
VOID NcInsertBlockBfore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block) BOOL NcInsertBlockBefore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block)
{ {
if (!Link || !Link->Block || !Block || !Block->Start || !Block->End)
return FALSE;
if (Block->HasRelativeJumps && Link->Block->HasRelativeJumps)
{
//TODO: increment all labels inside of the block being added
return FALSE;
}
else
{
if (Link->Prev)
Link->Prev->Next = Block->Start;
Block->Start->Prev = Link->Prev;
Block->End->Next = Link;
Link->Prev = Block->End;
return TRUE;
}
return FALSE;
} }
BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block) BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block)
@ -111,10 +132,11 @@ BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block)
} }
else else
{ {
NcInsertLinkBefore(JmpPos, new NATIVE_CODE_LINK(CurrentLabelId)); NcInsertLinkBefore(JmpPos, new NATIVE_CODE_LINK(CurrentLabelId, Block));
T->Label = CurrentLabelId; T->Label = CurrentLabelId;
++CurrentLabelId; ++CurrentLabelId;
} }
Block->HasRelativeJumps = TRUE;
T->Flags |= CODE_FLAG_IS_REL_JMP; T->Flags |= CODE_FLAG_IS_REL_JMP;
} }
return TRUE; return TRUE;
@ -181,7 +203,7 @@ BOOL NcFromBuffer(PNATIVE_CODE_BLOCK Block, PVOID Buffer, ULONG BufferSize)
delete Link; delete Link;
return FALSE; return FALSE;
} }
Link->Block = Block;
Link->Prev = Block->End; Link->Prev = Block->End;
Block->End->Next = Link; Block->End->Next = Link;
Block->End = Link; Block->End = Link;
@ -236,4 +258,5 @@ VOID NcDebugPrint(PNATIVE_CODE_BLOCK Block)
} }
} }
} }
} }

@ -5,24 +5,27 @@
#include "XedWrap.h" #include "XedWrap.h"
#include "Code.h" #include "Code.h"
struct _NATIVE_CODE_BLOCK;
typedef struct _NATIVE_CODE_LINK typedef struct _NATIVE_CODE_LINK
{ {
_NATIVE_CODE_LINK* Next; _NATIVE_CODE_LINK* Next;
_NATIVE_CODE_LINK* Prev; _NATIVE_CODE_LINK* Prev;
_NATIVE_CODE_BLOCK* Block;
ULONG Flags; ULONG Flags;
ULONG Label; ULONG Label;
PUCHAR RawData; PUCHAR RawData;
ULONG RawDataSize; ULONG RawDataSize;
XED_DECODED_INST XedInst; XED_DECODED_INST XedInst;
_NATIVE_CODE_LINK(); _NATIVE_CODE_LINK();
_NATIVE_CODE_LINK(ULONG LabelId); _NATIVE_CODE_LINK(ULONG LabelId, _NATIVE_CODE_BLOCK* B);
}NATIVE_CODE_LINK, *PNATIVE_CODE_LINK; }NATIVE_CODE_LINK, *PNATIVE_CODE_LINK;
typedef struct _NATIVE_CODE_BLOCK typedef struct _NATIVE_CODE_BLOCK
{ {
PNATIVE_CODE_LINK Start; PNATIVE_CODE_LINK Start;
PNATIVE_CODE_LINK End; PNATIVE_CODE_LINK End;
BOOL HasRelativeJumps;
}NATIVE_CODE_BLOCK, *PNATIVE_CODE_BLOCK; }NATIVE_CODE_BLOCK, *PNATIVE_CODE_BLOCK;
VOID NcInsertLinkAfter(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2); VOID NcInsertLinkAfter(PNATIVE_CODE_LINK Link1, PNATIVE_CODE_LINK Link2);
@ -33,9 +36,9 @@ VOID NcUnlink(PNATIVE_CODE_LINK Link);
VOID NcConcat(PNATIVE_CODE_BLOCK Block1, PNATIVE_CODE_BLOCK Block2); VOID NcConcat(PNATIVE_CODE_BLOCK Block1, PNATIVE_CODE_BLOCK Block2);
VOID NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block); BOOL NcInsertBlockAfter(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block);
VOID NcInsertBlockBfore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block); BOOL NcInsertBlockBefore(PNATIVE_CODE_LINK Link, PNATIVE_CODE_BLOCK Block);
BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block); BOOL NcCreateLabels(PNATIVE_CODE_BLOCK Block);
@ -48,4 +51,5 @@ VOID NcDelete(PNATIVE_CODE_BLOCK Block);
VOID NcDebugPrint(PNATIVE_CODE_BLOCK Block); VOID NcDebugPrint(PNATIVE_CODE_BLOCK Block);
#endif #endif

@ -0,0 +1,11 @@
#include "VirtualMachine.h"
PUCHAR VmEmitVmEnter(PULONG Size)
{
return NULL;
}
PUCHAR VmEmitVmExit(PULONG Size)
{
return NULL;
}

@ -0,0 +1,21 @@
#ifndef __VIRTUAL_MACHINE_H
#define __VIRTUAL_MACHINE_H
#include "Windas.h"
#include "XedWrap.h"
typedef struct _VM_DATA
{
PVOID RegisterFile[32];
}VM_DATA, *PVM_DATA;
/*
* VmEnter:
* Move all x86 8 byte registers into storage inside of VM_DATA structure.
* Move address of VM_DATA structure into rcx
* Move virtual instruction pointer into rdx
*/
PUCHAR VmEmitVmEnter(PULONG Size);
PUCHAR VmEmitVmExit(PULONG Size);
#endif

@ -1 +1,15 @@
#include "Virtualizer.h" #include "Virtualizer.h"
BOOL ViCanHandleInst(PNATIVE_CODE_LINK Link)
{
return TRUE;
}
BOOL ViValidateNativeCodeBlock(PNATIVE_CODE_BLOCK Block)
{
for (PNATIVE_CODE_LINK T = Block->Start; T; T = T->Next)
{
if (!ViCanHandleInst(T))
return FALSE;
}
return TRUE;
}

@ -6,6 +6,13 @@
#include "NativeCode.h" #include "NativeCode.h"
/*
*
*
*
*/
BOOL ViCanHandleInst(PNATIVE_CODE_LINK Link); BOOL ViCanHandleInst(PNATIVE_CODE_LINK Link);
BOOL ViValidateNativeCodeBlock(PNATIVE_CODE_BLOCK Block);
#endif #endif

Binary file not shown.
Loading…
Cancel
Save