You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
1.5 KiB
51 lines
1.5 KiB
#ifndef __RIP_XOR_INST_H
|
|
#define __RIP_XOR_INST_H
|
|
|
|
#include "Windas.h"
|
|
#include "XedWrap.h"
|
|
#include "NativeCode.h"
|
|
|
|
#define DWORD_XOR_INST_LENGTH 10
|
|
#define DWORD_XOR_INST_RIP_OFFSET 2
|
|
#define DWORD_XOR_INST_XOR_OFFSET 6
|
|
|
|
#define WORD_XOR_INST_LENGTH 9
|
|
#define WORD_XOR_INST_RIP_OFFSET 3
|
|
#define WORD_XOR_INST_XOR_OFFSET 7
|
|
|
|
#define BYTE_XOR_INST_LENGTH 7
|
|
#define BYTE_XOR_INST_RIP_OFFSET 2
|
|
#define BYTE_XOR_INST_XOR_OFFSET 6
|
|
|
|
|
|
typedef struct _XOR_INST_DATA
|
|
{
|
|
ULONG Data[5];
|
|
}XOR_INST_DATA, *PXOR_INST_DATA;
|
|
|
|
BOOL ObfEmitPushfqInst(PNATIVE_CODE_BLOCK Block);
|
|
|
|
BOOL ObfEmitPopfqInst(PNATIVE_CODE_BLOCK Block);
|
|
|
|
BOOL ObfEmitRipRelativeXorD(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
|
|
|
BOOL ObfEmitRipRelativeXorW(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
|
|
|
BOOL ObfEmitRipRelativeXorB(PNATIVE_CODE_BLOCK Block, INT32 RipDelta, ULONG Value);
|
|
|
|
VOID ObfXorInstBytes(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData);
|
|
|
|
//Used to see if the PreXor needs to save the flags.
|
|
//If all flags are written to by the XORs are also written to by the target inst theres no point in saving flags
|
|
BOOL ObfDoesInstWriteToAllXorFlags(PNATIVE_CODE_LINK Link);
|
|
|
|
BOOL ObfAreXorFlagsClobberedBeforeUse(PNATIVE_CODE_LINK Link);
|
|
|
|
PNATIVE_CODE_BLOCK ObfEmitPreXorForInst(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData, BOOL SaveFlags, INT32 DeltaToInst = 0);
|
|
|
|
PNATIVE_CODE_BLOCK ObfEmitPostXorForInst(PNATIVE_CODE_LINK Link, PXOR_INST_DATA XorData, BOOL SaveFlags, INT32 DeltaToInst = 0);
|
|
|
|
|
|
|
|
#endif
|