blew the tires off vmctx for now... fixed a bug in vmlocate... working now...

.clang-format

@@ -2,3 +2,4 @@
 BasedOnStyle: Chromium
 
 ...
+ 

CMakeLists.txt

@@ -78,7 +78,6 @@ list(APPEND vmprofiler_SOURCES
 	"dependencies/vmprofiler/include/vmprofiles.hpp"
 	"dependencies/vmprofiler/include/vmutils.hpp"
 	"dependencies/vmprofiler/include/scn.hpp"
-	"src/vmctx.cpp"
 	"src/vmlocate.cpp"
 	"include/vmctx.hpp"
 	"include/vmlocate.hpp"

include/vmctx.hpp

@@ -3,40 +3,7 @@
 #include <vmp2.hpp>
 
 namespace vm {
-/// <summary>
+struct ctx_t {
-/// vm::ctx_t class is used to auto generate vm_entry, calc_jmp, and other
-/// per-vm entry information... creating a vm::ctx_t object can make it easier
-/// to pass around information pertaining to a given vm entry...
-/// </summary>
-class ctx_t {
- public:
-  /// <summary>
-  /// default constructor for vm::ctx_t... all information for a given vm entry
-  /// must be provided...
-  /// </summary>
-  /// <param name="module_base">the linear virtual address of the module
-  /// base...</param> <param name="image_base">image base from optional nt
-  /// header... <a
-  /// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
-  /// <param name="image_size">image size from optional nt header... <a
-  /// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
-  /// <param name="vm_entry_rva">relative virtual address from the module base
-  /// address to the first push prior to a vm entry...</param>
-  explicit ctx_t(std::uintptr_t module_base, std::uintptr_t image_base,
-                 std::uintptr_t image_size, std::uintptr_t vm_entry_rva);
-
-  /// <summary>
-  /// init all per-vm entry data such as vm_entry, calc_jmp, and vm handlers...
-  /// </summary>
-  /// <returns>returns true if no errors...</returns>
-  bool init();
-
   const std::uintptr_t module_base, image_base, vm_entry_rva, image_size;
-
-  /// <summary>
-  /// the order in which VIP advances...
-  /// </summary>
-  vmp2::exec_type_t exec_type;
-  zydis_routine_t vm_entry;
 };
 }  // namespace vm

include/vmlocate.hpp

@@ -5,20 +5,23 @@
 #define PUSH_4B_IMM "\x68\x00\x00\x00\x00"
 #define PUSH_4B_MASK "x????"
 
-namespace vm::locate
+namespace vm::locate {
-{
+inline bool find(const zydis_routine_t& rtn,
-    inline bool find( const zydis_routine_t &rtn, std::function< bool( const zydis_instr_t & ) > callback )
+                 std::function<bool(const zydis_instr_t&)> callback) {
-    {
   auto res = std::find_if(rtn.begin(), rtn.end(), callback);
   return res != rtn.end();
 }
 
-    struct vm_enter_t
+struct vm_enter_t {
-    {
   std::uint32_t rva;
   std::uint32_t encrypted_rva;
 };
 
-    std::uintptr_t sigscan( void *base, std::uint32_t size, const char *pattern, const char *mask );
+std::uintptr_t sigscan(void* base,
-    std::vector< vm_enter_t > get_vm_entries( std::uintptr_t module_base, std::uint32_t module_size );
+                       std::uint32_t size,
+                       const char* pattern,
+                       const char* mask);
+
+std::vector<vm_enter_t> get_vm_entries(std::uintptr_t module_base,
+                                       std::uint32_t module_size);
 }  // namespace vm::locate

src/vmctx.cpp

@@ -1,19 +0,0 @@
-#include <vmctx.hpp>
-
-namespace vm
-{
-    ctx_t::ctx_t( std::uintptr_t module_base, std::uintptr_t image_base, std::uintptr_t image_size,
-                  std::uintptr_t vm_entry_rva )
-        : module_base( module_base ), image_base( image_base ), image_size( image_size ), vm_entry_rva( vm_entry_rva )
-    {
-    }
-
-    bool ctx_t::init()
-    {
-        if ( !vm::util::flatten( vm_entry, vm_entry_rva + module_base ) )
-            return false;
-
-        vm::util::deobfuscate( vm_entry );
-        return true;
-    }
-} // namespace vm

src/vmlocate.cpp

@@ -1,10 +1,12 @@
 #include <vmlocate.hpp>
 
-namespace vm::locate
+namespace vm::locate {
-{
+std::uintptr_t sigscan(void* base,
-    std::uintptr_t sigscan( void *base, std::uint32_t size, const char *pattern, const char *mask )
+                       std::uint32_t size,
-    {
+                       const char* pattern,
-        static const auto check_mask = [ & ]( const char *base, const char *pattern, const char *mask ) -> bool {
+                       const char* mask) {
+  static const auto check_mask = [&](const char* base, const char* pattern,
+                                     const char* mask) -> bool {
     for (; *mask; ++base, ++pattern, ++mask)
       if (*mask == 'x' && *base != *pattern)
         return false;
@@ -12,8 +14,7 @@ namespace vm::locate
   };
 
   size -= std::strlen(mask);
-        for ( auto i = 0; i <= size; ++i )
+  for (auto i = 0; i <= size; ++i) {
-        {
     void* addr = (void*)&(((char*)base)[i]);
     if (check_mask((char*)addr, pattern, mask))
       return reinterpret_cast<std::uintptr_t>(addr);
@@ -22,17 +23,18 @@ namespace vm::locate
   return {};
 }
 
-    std::vector< vm_enter_t > get_vm_entries( std::uintptr_t module_base, std::uint32_t module_size )
+std::vector<vm_enter_t> get_vm_entries(std::uintptr_t module_base,
-    {
+                                       std::uint32_t module_size) {
   std::uintptr_t result = module_base;
   std::vector<vm_enter_t> entries;
 
   static const auto push_regs = [&](const zydis_routine_t& rtn) -> bool {
-            for ( unsigned reg = ZYDIS_REGISTER_RAX; reg < ZYDIS_REGISTER_R15; ++reg )
+    for (unsigned reg = ZYDIS_REGISTER_RAX; reg < ZYDIS_REGISTER_R15; ++reg) {
-            {
+      auto res = std::find_if(
-                auto res = std::find_if( rtn.begin(), rtn.end(), [ & ]( const zydis_instr_t &instr ) -> bool {
+          rtn.begin(), rtn.end(), [&](const zydis_instr_t& instr) -> bool {
             return instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSH &&
-                           instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                   instr.instr.operands[0].type ==
+                       ZYDIS_OPERAND_TYPE_REGISTER &&
                    instr.instr.operands[0].reg.value == reg;
           });
 
@@ -43,9 +45,9 @@ namespace vm::locate
     return true;
   };
 
-        do
+  do {
-        {
+    result = sigscan((void*)++result, module_size - (result - module_base),
-            result = sigscan( ( void * )++result, module_size - ( result - module_base ), PUSH_4B_IMM, PUSH_4B_MASK );
+                     PUSH_4B_IMM, PUSH_4B_MASK);
 
     zydis_routine_t rtn;
     if (!scn::executable(module_base, result))
@@ -54,7 +56,8 @@ namespace vm::locate
     if (!vm::util::flatten(rtn, result, false, 500, module_base))
       continue;
 
-            // the last instruction in the stream should be a JMP to a register or a return instruction...
+    // the last instruction in the stream should be a JMP to a register or a
+    // return instruction...
     const auto& last_instr = rtn[rtn.size() - 1];
     if (!((last_instr.instr.mnemonic == ZYDIS_MNEMONIC_JMP &&
            last_instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER) ||
@@ -123,16 +126,6 @@ namespace vm::locate
     if (!push_regs(rtn))
       continue;
 
-            // check for a mov r13, rax...
-            if ( !vm::locate::find( rtn, [ & ]( const zydis_instr_t &instr ) -> bool {
-                     return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-                            instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_R13 &&
-                            instr.instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
-                 } ) )
-                continue;
-
     // check for a mov reg, rsp
     if (!vm::locate::find(rtn, [&](const zydis_instr_t& instr) -> bool {
           return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
@@ -157,7 +150,8 @@ namespace vm::locate
     // existing entry already exits...
 
     auto push_val = (std::uint32_t)rtn[0].instr.operands[0].imm.value.u;
-            if ( std::find_if( entries.begin(), entries.end(), [ & ]( const vm_enter_t &vm_enter ) -> bool {
+    if (std::find_if(entries.begin(), entries.end(),
+                     [&](const vm_enter_t& vm_enter) -> bool {
                        return vm_enter.encrypted_rva == push_val;
                      }) != entries.end())
       continue;