You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
380 lines
9.7 KiB
380 lines
9.7 KiB
#include "Obfuscator.h"
|
|
|
|
//snake case is honestly so disgusting
|
|
void obf_one_time_please()
|
|
{
|
|
xed_tables_init();
|
|
}
|
|
|
|
bool obf_init_from_buffer(pobfuscator_t obf, void* buffer, int buffer_size)
|
|
{
|
|
obf->current_label_id = 0;
|
|
obf->machine_mode = XED_MACHINE_MODE_LONG_64;
|
|
obf->addr_width = XED_ADDRESS_WIDTH_64b;
|
|
|
|
unsigned long long off = 0;
|
|
|
|
obf->code_start = new code_link_t;
|
|
obf->code_end = obf->code_start;
|
|
obf->code_start->flags = 0;
|
|
obf->code_start->group = 0;
|
|
obf->code_start->label_name = "omegalawl";
|
|
obf->code_start->prev = obf->code_start->next = nullptr;
|
|
|
|
while (off < buffer_size)
|
|
{
|
|
pcode_link_t link = new code_link_t;
|
|
link->flags = 0;
|
|
link->group = 0;
|
|
|
|
xed_decoded_inst_zero(&link->instruction);
|
|
xed_decoded_inst_set_mode(&link->instruction, obf->machine_mode, obf->addr_width);
|
|
xed_error_enum_t err = xed_decode(&link->instruction, (unsigned char*)((unsigned char*)buffer + off), 15);
|
|
if (err != XED_ERROR_NONE)
|
|
{
|
|
printf("Failed decoding instruction at %llu with error \"%s\"(%d)", off, xed_error_enum_t2str(err), err);
|
|
return false;
|
|
}
|
|
|
|
unsigned int inst_len = xed_decoded_inst_get_length(&link->instruction);
|
|
link->raw_data_size = inst_len;
|
|
|
|
link->raw_data = (unsigned char*)malloc(inst_len);
|
|
if (!link->raw_data)
|
|
{
|
|
printf("outta memory son.\n");
|
|
return false;
|
|
}
|
|
|
|
memcpy(link->raw_data, ((unsigned char*)buffer + off), inst_len);
|
|
|
|
//filter out 8 byte wide jumps cuz they aint relative dawg and wont be showin up in my shellcod
|
|
xed_category_enum_t cat = xed_decoded_inst_get_category(&link->instruction);
|
|
if (cat == XED_CATEGORY_COND_BR || cat == XED_CATEGORY_UNCOND_BR)
|
|
{
|
|
unsigned int disp_width = xed_decoded_inst_get_branch_displacement_width(&link->instruction);
|
|
if (disp_width != 8)
|
|
{
|
|
link->flags |= CLFLAG_IS_REL_JUMP;
|
|
|
|
//int jump_delta = xed_decoded_inst_get_branch_displacement(&link->instruction);
|
|
//printf("Jump delta is %d\n", jump_delta);
|
|
}
|
|
}
|
|
|
|
link->prev = obf->code_end;
|
|
link->next = nullptr;
|
|
obf->code_end->next = link;
|
|
obf->code_end = link;
|
|
|
|
off += inst_len;
|
|
}
|
|
}
|
|
|
|
bool obf_create_groups(pobfuscator_t obf, int group_size)
|
|
{
|
|
//remake cuz this shit broke as fuck
|
|
|
|
|
|
//obf->groups.clear();
|
|
|
|
///*if (group_size < 24)
|
|
// return false;*/
|
|
|
|
//int cur_group_id = 0, cur_size_in_bytes = 0;
|
|
//pcode_link_t start = obf->code_start->next;
|
|
//for (pcode_link_t t = obf->code_start->next; t;)
|
|
//{
|
|
// pcode_link_t real_next = t->next;
|
|
// if (!(t->flags & CLFLAG_IS_GAGET) && !(t->flags & CLFLAG_IS_LABEL))
|
|
// {
|
|
// if (cur_size_in_bytes + t->raw_data_size /*+ END_OF_GROUP_GAGT_SIZE*/ > group_size)
|
|
// {
|
|
// std::string group_label_name = "Group";
|
|
// group_label_name.append(std::to_string(cur_group_id + 1));
|
|
// pcode_link_t lab = new code_link_t;
|
|
// lab->flags = CLFLAG_IS_LABEL;
|
|
// lab->label_name = group_label_name;
|
|
// lab->group = cur_group_id;
|
|
|
|
// pcode_link_t gadget = new code_link_t;
|
|
// gadget->flags = 0;
|
|
// gadget->label_name = "";
|
|
// gadget->raw_data = new unsigned char[6];
|
|
// gadget->raw_data_size = 6;
|
|
// gadget->group = cur_group_id;
|
|
// unsigned char gadget_data[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
|
|
// memcpy(gadget->raw_data, gadget_data, 6);
|
|
|
|
// pcode_link_t abs_addr = new code_link_t;
|
|
// abs_addr->flags = CLFLAG_IS_ABS_ADDR;
|
|
// abs_addr->label_name = group_label_name;
|
|
// abs_addr->raw_data = new unsigned char[8];
|
|
// abs_addr->raw_data_size = 8;
|
|
// abs_addr->group = cur_group_id;
|
|
|
|
// t->prev->next = gadget;
|
|
// gadget->next = abs_addr;
|
|
// abs_addr->next = lab;
|
|
// lab->next = t;// real_next;
|
|
|
|
// gadget->prev = t->prev;
|
|
// abs_addr->prev = gadget;
|
|
// lab->prev = abs_addr;
|
|
// t->prev = lab;
|
|
|
|
//
|
|
|
|
// printf("creating group %d\n", cur_group_id);
|
|
// obf->groups.emplace_back();
|
|
// obf->groups.back().size_in_bytes = cur_size_in_bytes + END_OF_GROUP_GAGT_SIZE;
|
|
// obf->groups.back().start = start;
|
|
// obf->groups.back().base_address = cur_group_id;
|
|
// cur_size_in_bytes = 0;
|
|
// cur_group_id++;
|
|
// start = t;
|
|
// }
|
|
// }
|
|
|
|
// cur_size_in_bytes += t->raw_data_size;
|
|
// t->group = cur_group_id;
|
|
// t = real_next;
|
|
//}
|
|
|
|
//obf->groups.emplace_back();
|
|
//obf->groups.back().size_in_bytes = cur_size_in_bytes + 16;
|
|
//obf->groups.back().start = start;
|
|
//obf->groups.back().base_address = cur_group_id;
|
|
|
|
//return true;
|
|
}
|
|
|
|
void obf_replace_rel_jmps(pobfuscator_t obf)
|
|
|
|
{ // original_jump -------------------------.
|
|
// jmp 0x10(0xEB, 0x10) ------------------ | -----.
|
|
// jmp qword ptr[rip] <----------------' |
|
|
// address here(8 bytes) |
|
|
// not taken branch code <-----------------------'
|
|
|
|
for (pcode_link_t t = obf->code_start->next; t;)
|
|
{
|
|
pcode_link_t real_next = t->next;
|
|
if (t->flags & CLFLAG_IS_REL_JUMP)
|
|
{
|
|
unsigned int jmp_delta_width = xed_decoded_inst_get_branch_displacement_width(&t->instruction);
|
|
unsigned int opcode_size = t->raw_data_size - jmp_delta_width;
|
|
|
|
switch (jmp_delta_width)
|
|
{
|
|
case 1:
|
|
*(char*)((unsigned char*)t->raw_data + opcode_size) = (char)2; break;
|
|
case 2:
|
|
*(short*)((unsigned char*)t->raw_data + opcode_size) = (short)2; break;
|
|
case 4:
|
|
*(int*)((unsigned char*)t->raw_data + opcode_size) = (int)2; break;
|
|
}
|
|
t->flags = CLFLAG_IS_GAGET;
|
|
|
|
pcode_link_t gadget = new code_link_t;
|
|
gadget->flags = CLFLAG_IS_GAGET;
|
|
gadget->label_name = "";
|
|
gadget->raw_data = new unsigned char[8];
|
|
gadget->raw_data_size = 8;
|
|
unsigned char gadget_data[] = { 0xEB, 0x0E, 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
|
|
memcpy(gadget->raw_data, gadget_data, 8);
|
|
|
|
pcode_link_t abs_addr = new code_link_t;
|
|
abs_addr->flags = (CLFLAG_IS_GAGET | CLFLAG_IS_ABS_ADDR);
|
|
abs_addr->label_name = t->label_name;
|
|
t->label_name = "";
|
|
abs_addr->raw_data = new unsigned char[8];
|
|
abs_addr->raw_data_size = 8;
|
|
|
|
t->next = gadget;
|
|
gadget->next = abs_addr;
|
|
abs_addr->next = real_next;
|
|
|
|
if (real_next) real_next->prev = abs_addr;
|
|
abs_addr->prev = gadget;
|
|
gadget->prev = t;
|
|
|
|
}
|
|
t = real_next;
|
|
}
|
|
}
|
|
|
|
bool obf_replace_abs_jmps(pobfuscator_t obf)
|
|
{
|
|
for (pcode_link_t t = obf->code_start->next; t; t = t->next)
|
|
{
|
|
if (t->flags & CLFLAG_IS_ABS_ADDR)
|
|
{
|
|
pcode_link_t temp;
|
|
for (temp = t; temp && temp->prev; temp = temp->prev)
|
|
{
|
|
if (temp->flags & CLFLAG_IS_LABEL && temp->label_name == t->label_name)
|
|
{
|
|
goto have_label_found;
|
|
}
|
|
}
|
|
for (temp = t; temp && temp->next; temp = temp->next)
|
|
{
|
|
if (temp->flags & CLFLAG_IS_LABEL && temp->label_name == t->label_name)
|
|
{
|
|
goto have_label_found;
|
|
}
|
|
}
|
|
return false;
|
|
|
|
have_label_found:
|
|
uint64_t addr = obf->groups[temp->group].base_address;
|
|
for (pcode_link_t temp2 = obf->groups[temp->group].start; temp2 && temp2->group == temp->group; temp2 = temp2->next)
|
|
{
|
|
if (temp2 == temp)
|
|
{
|
|
break;
|
|
}
|
|
if (!(temp2->flags & CLFLAG_IS_LABEL))
|
|
{
|
|
addr += temp2->raw_data_size;
|
|
}
|
|
}
|
|
*(uint64_t*)((unsigned char*)t->raw_data) = addr;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
size_t obf_get_group_size(pobfuscator_t obf, int group_id)
|
|
{
|
|
if (group_id < obf->groups.size())
|
|
return obf->groups[group_id].size_in_bytes;
|
|
}
|
|
|
|
void obf_copy_group_to_buffer(pobfuscator_t obf, void* buffer, int group_id)
|
|
{
|
|
|
|
}
|
|
|
|
bool obf_gen_all_labels(pobfuscator_t obf)
|
|
{
|
|
for (pcode_link_t t = obf->code_start->next; t; t = t->next)
|
|
{
|
|
if (t->flags & CLFLAG_IS_REL_JUMP)
|
|
{
|
|
int jump_delta = xed_decoded_inst_get_branch_displacement(&t->instruction);
|
|
if (!obf_gen_label(obf, t, jump_delta))
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool obf_gen_label(pobfuscator_t obf, pcode_link_t jmp, int32_t delta)
|
|
{
|
|
obf->current_label_id++;
|
|
pcode_link_t temp;
|
|
//when going positive, counting starts at NEXT instruction(excluding size of jmp)
|
|
//when negative, counting INCLUDES the size of the jmp instructrion
|
|
if (delta > 0)
|
|
{
|
|
temp = jmp->next;
|
|
while (delta && temp)
|
|
{
|
|
delta -= temp->instruction._decoded_length;
|
|
//if (delta == 0) break;
|
|
temp = temp->next;
|
|
}
|
|
if (temp && temp->flags & CLFLAG_IS_LABEL)
|
|
{
|
|
jmp->label_name = temp->label_name;
|
|
return true;
|
|
}
|
|
}
|
|
else if (delta < 0)
|
|
{
|
|
temp = jmp;
|
|
while (temp)
|
|
{
|
|
delta += temp->instruction._decoded_length;
|
|
if (delta == 0) break;
|
|
temp = temp->prev;
|
|
}
|
|
|
|
if (temp && temp->prev && (temp->prev->flags & CLFLAG_IS_LABEL))
|
|
{
|
|
jmp->label_name = temp->prev->label_name;
|
|
return true;
|
|
}
|
|
}
|
|
else return false;
|
|
|
|
if (!temp)
|
|
return false;
|
|
|
|
//couldnt find label, adding new one
|
|
pcode_link_t new_label = new code_link_t;
|
|
new_label->flags = CLFLAG_IS_LABEL;
|
|
new_label->label_name = std::to_string(obf->current_label_id);
|
|
jmp->label_name = new_label->label_name;
|
|
|
|
new_label->next = temp;
|
|
new_label->prev = temp->prev;
|
|
if (temp->prev)
|
|
temp->prev->next = new_label;
|
|
temp->prev = new_label;
|
|
|
|
return true;
|
|
}
|
|
|
|
void obf_dbg_print_code(pobfuscator_t obf)
|
|
{
|
|
for (pcode_link_t t = obf->code_start->next; t; t = t->next)
|
|
{
|
|
if (t->flags & CLFLAG_IS_REL_JUMP)
|
|
{
|
|
printf("\tJump to: %s ", t->label_name.data());
|
|
}
|
|
else if (t->flags & CLFLAG_IS_LABEL)
|
|
{
|
|
printf("Label: %s ", t->label_name.data());
|
|
}
|
|
else
|
|
{
|
|
printf("\tRegular Instruction. ");
|
|
}
|
|
if (!(t->flags & CLFLAG_IS_LABEL))
|
|
{
|
|
obf_print_byte_array(t->raw_data, t->raw_data_size);
|
|
}
|
|
}
|
|
}
|
|
|
|
void obf_dbg_print_group(pobfuscator_t obf, int group_id)
|
|
{
|
|
if (group_id >= obf->groups.size())
|
|
return;
|
|
|
|
for (pcode_link_t t = obf->groups[group_id].start; t && t->group == group_id; t = t->next)
|
|
{
|
|
if (!(t->flags & CLFLAG_IS_LABEL))
|
|
{
|
|
obf_print_byte_array(t->raw_data, t->raw_data_size);
|
|
}
|
|
}
|
|
}
|
|
|
|
#include <iostream>
|
|
#include <iomanip>
|
|
void obf_print_byte_array(void* arr, unsigned int size)
|
|
{
|
|
unsigned char* b = (unsigned char*)arr;
|
|
for (int i = 0; i < size; i++)
|
|
{
|
|
std::cout << std::hex << std::setw(2) << std::setfill('0') << (int)b[i] << ' ';
|
|
}
|
|
std::cout << '\n';
|
|
return;
|
|
}
|