blew the tires off vmctx for now... fixed a bug in vmlocate... working now...

.clang-format

@@ -2,3 +2,4 @@
 BasedOnStyle: Chromium
 
 ...
+ 

CMakeLists.txt

@@ -78,7 +78,6 @@ list(APPEND vmprofiler_SOURCES
 	"dependencies/vmprofiler/include/vmprofiles.hpp"
 	"dependencies/vmprofiler/include/vmutils.hpp"
 	"dependencies/vmprofiler/include/scn.hpp"
-	"src/vmctx.cpp"
 	"src/vmlocate.cpp"
 	"include/vmctx.hpp"
 	"include/vmlocate.hpp"

include/vmctx.hpp

@@ -3,40 +3,7 @@
 #include <vmp2.hpp>
 
 namespace vm {
-/// <summary>
+struct ctx_t {
-/// vm::ctx_t class is used to auto generate vm_entry, calc_jmp, and other
-/// per-vm entry information... creating a vm::ctx_t object can make it easier
-/// to pass around information pertaining to a given vm entry...
-/// </summary>
-class ctx_t {
- public:
-  /// <summary>
-  /// default constructor for vm::ctx_t... all information for a given vm entry
-  /// must be provided...
-  /// </summary>
-  /// <param name="module_base">the linear virtual address of the module
-  /// base...</param> <param name="image_base">image base from optional nt
-  /// header... <a
-  /// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
-  /// <param name="image_size">image size from optional nt header... <a
-  /// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
-  /// <param name="vm_entry_rva">relative virtual address from the module base
-  /// address to the first push prior to a vm entry...</param>
-  explicit ctx_t(std::uintptr_t module_base, std::uintptr_t image_base,
-                 std::uintptr_t image_size, std::uintptr_t vm_entry_rva);
-
-  /// <summary>
-  /// init all per-vm entry data such as vm_entry, calc_jmp, and vm handlers...
-  /// </summary>
-  /// <returns>returns true if no errors...</returns>
-  bool init();
-
   const std::uintptr_t module_base, image_base, vm_entry_rva, image_size;
-
-  /// <summary>
-  /// the order in which VIP advances...
-  /// </summary>
-  vmp2::exec_type_t exec_type;
-  zydis_routine_t vm_entry;
 };
 }  // namespace vm

include/vmlocate.hpp

@@ -5,20 +5,23 @@
 #define PUSH_4B_IMM "\x68\x00\x00\x00\x00"
 #define PUSH_4B_MASK "x????"
 
-namespace vm::locate
+namespace vm::locate {
-{
+inline bool find(const zydis_routine_t& rtn,
-    inline bool find( const zydis_routine_t &rtn, std::function< bool( const zydis_instr_t & ) > callback )
+                 std::function<bool(const zydis_instr_t&)> callback) {
-    {
+  auto res = std::find_if(rtn.begin(), rtn.end(), callback);
-        auto res = std::find_if( rtn.begin(), rtn.end(), callback );
   return res != rtn.end();
-    }
+}
 
-    struct vm_enter_t
+struct vm_enter_t {
-    {
   std::uint32_t rva;
   std::uint32_t encrypted_rva;
-    };
+};
 
-    std::uintptr_t sigscan( void *base, std::uint32_t size, const char *pattern, const char *mask );
+std::uintptr_t sigscan(void* base,
-    std::vector< vm_enter_t > get_vm_entries( std::uintptr_t module_base, std::uint32_t module_size );
+                       std::uint32_t size,
+                       const char* pattern,
+                       const char* mask);
+
+std::vector<vm_enter_t> get_vm_entries(std::uintptr_t module_base,
+                                       std::uint32_t module_size);
 }  // namespace vm::locate

src/vmctx.cpp

@@ -1,19 +0,0 @@
-#include <vmctx.hpp>
-
-namespace vm
-{
-    ctx_t::ctx_t( std::uintptr_t module_base, std::uintptr_t image_base, std::uintptr_t image_size,
-                  std::uintptr_t vm_entry_rva )
-        : module_base( module_base ), image_base( image_base ), image_size( image_size ), vm_entry_rva( vm_entry_rva )
-    {
-    }
-
-    bool ctx_t::init()
-    {
-        if ( !vm::util::flatten( vm_entry, vm_entry_rva + module_base ) )
-            return false;
-
-        vm::util::deobfuscate( vm_entry );
-        return true;
-    }
-} // namespace vm

src/vmlocate.cpp

@@ -1,72 +1,75 @@
 #include <vmlocate.hpp>
 
-namespace vm::locate
+namespace vm::locate {
-{
+std::uintptr_t sigscan(void* base,
-    std::uintptr_t sigscan( void *base, std::uint32_t size, const char *pattern, const char *mask )
+                       std::uint32_t size,
-    {
+                       const char* pattern,
-        static const auto check_mask = [ & ]( const char *base, const char *pattern, const char *mask ) -> bool {
+                       const char* mask) {
-            for ( ; *mask; ++base, ++pattern, ++mask )
+  static const auto check_mask = [&](const char* base, const char* pattern,
-                if ( *mask == 'x' && *base != *pattern )
+                                     const char* mask) -> bool {
+    for (; *mask; ++base, ++pattern, ++mask)
+      if (*mask == 'x' && *base != *pattern)
         return false;
     return true;
   };
 
-        size -= std::strlen( mask );
+  size -= std::strlen(mask);
-        for ( auto i = 0; i <= size; ++i )
+  for (auto i = 0; i <= size; ++i) {
-        {
+    void* addr = (void*)&(((char*)base)[i]);
-            void *addr = ( void * )&( ( ( char * )base )[ i ] );
+    if (check_mask((char*)addr, pattern, mask))
-            if ( check_mask( ( char * )addr, pattern, mask ) )
+      return reinterpret_cast<std::uintptr_t>(addr);
-                return reinterpret_cast< std::uintptr_t >( addr );
   }
 
   return {};
-    }
+}
 
-    std::vector< vm_enter_t > get_vm_entries( std::uintptr_t module_base, std::uint32_t module_size )
+std::vector<vm_enter_t> get_vm_entries(std::uintptr_t module_base,
-    {
+                                       std::uint32_t module_size) {
   std::uintptr_t result = module_base;
-        std::vector< vm_enter_t > entries;
+  std::vector<vm_enter_t> entries;
 
-        static const auto push_regs = [ & ]( const zydis_routine_t &rtn ) -> bool {
+  static const auto push_regs = [&](const zydis_routine_t& rtn) -> bool {
-            for ( unsigned reg = ZYDIS_REGISTER_RAX; reg < ZYDIS_REGISTER_R15; ++reg )
+    for (unsigned reg = ZYDIS_REGISTER_RAX; reg < ZYDIS_REGISTER_R15; ++reg) {
-            {
+      auto res = std::find_if(
-                auto res = std::find_if( rtn.begin(), rtn.end(), [ & ]( const zydis_instr_t &instr ) -> bool {
+          rtn.begin(), rtn.end(), [&](const zydis_instr_t& instr) -> bool {
             return instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSH &&
-                           instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                   instr.instr.operands[0].type ==
-                           instr.instr.operands[ 0 ].reg.value == reg;
+                       ZYDIS_OPERAND_TYPE_REGISTER &&
-                } );
+                   instr.instr.operands[0].reg.value == reg;
+          });
 
       // skip RSP push...
-                if ( res == rtn.end() && reg != ZYDIS_REGISTER_RSP )
+      if (res == rtn.end() && reg != ZYDIS_REGISTER_RSP)
         return false;
     }
     return true;
   };
 
-        do
+  do {
-        {
+    result = sigscan((void*)++result, module_size - (result - module_base),
-            result = sigscan( ( void * )++result, module_size - ( result - module_base ), PUSH_4B_IMM, PUSH_4B_MASK );
+                     PUSH_4B_IMM, PUSH_4B_MASK);
 
     zydis_routine_t rtn;
-            if ( !scn::executable( module_base, result ) )
+    if (!scn::executable(module_base, result))
       continue;
 
-            if ( !vm::util::flatten( rtn, result, false, 500, module_base ) )
+    if (!vm::util::flatten(rtn, result, false, 500, module_base))
       continue;
 
-            // the last instruction in the stream should be a JMP to a register or a return instruction...
+    // the last instruction in the stream should be a JMP to a register or a
-            const auto &last_instr = rtn[ rtn.size() - 1 ];
+    // return instruction...
-            if ( !( ( last_instr.instr.mnemonic == ZYDIS_MNEMONIC_JMP &&
+    const auto& last_instr = rtn[rtn.size() - 1];
-                      last_instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER ) ||
+    if (!((last_instr.instr.mnemonic == ZYDIS_MNEMONIC_JMP &&
-                    last_instr.instr.mnemonic == ZYDIS_MNEMONIC_RET ) )
+           last_instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER) ||
+          last_instr.instr.mnemonic == ZYDIS_MNEMONIC_RET))
       continue;
 
     std::uint8_t num_pushs = 0u;
-            std::for_each( rtn.begin(), rtn.end(), [ & ]( const zydis_instr_t &instr ) {
+    std::for_each(rtn.begin(), rtn.end(), [&](const zydis_instr_t& instr) {
-                if ( instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSH &&
+      if (instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSH &&
-                     instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE )
+          instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_IMMEDIATE)
         ++num_pushs;
-            } );
+    });
 
     /*
     only one legit imm pushes for every vm entry...
@@ -90,14 +93,14 @@ namespace vm::locate
     > 0x7a53 :                                    push rbx
     > 0x500d :                                    push r15
     */
-            if ( num_pushs != 1 )
+    if (num_pushs != 1)
       continue;
 
     // check for a pushfq...
     // > 0x4926 :                                    pushfq <---
-            if ( !vm::locate::find( rtn, [ & ]( const zydis_instr_t &instr ) -> bool {
+    if (!vm::locate::find(rtn, [&](const zydis_instr_t& instr) -> bool {
           return instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
-                 } ) )
+        }))
       continue;
 
     /*
@@ -120,51 +123,42 @@ namespace vm::locate
     > 0x7a53 :                                    push rbx
     > 0x500d :                                    push r15
     */
-            if ( !push_regs( rtn ) )
+    if (!push_regs(rtn))
-                continue;
-
-            // check for a mov r13, rax...
-            if ( !vm::locate::find( rtn, [ & ]( const zydis_instr_t &instr ) -> bool {
-                     return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-                            instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_R13 &&
-                            instr.instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
-                 } ) )
       continue;
 
     // check for a mov reg, rsp
-            if ( !vm::locate::find( rtn, [ & ]( const zydis_instr_t &instr ) -> bool {
+    if (!vm::locate::find(rtn, [&](const zydis_instr_t& instr) -> bool {
           return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-                            instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                 instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                 instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RSP;
+                 instr.instr.operands[1].reg.value == ZYDIS_REGISTER_RSP;
-                 } ) )
+        }))
       continue;
 
     // check for a mov reg, [rsp+0x90]
-            if ( !vm::locate::find( rtn, [ & ]( const zydis_instr_t &instr ) -> bool {
+    if (!vm::locate::find(rtn, [&](const zydis_instr_t& instr) -> bool {
           return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-                            instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                 instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-                            instr.instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                 instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-                            instr.instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RSP &&
+                 instr.instr.operands[1].mem.base == ZYDIS_REGISTER_RSP &&
-                            instr.instr.operands[ 1 ].mem.disp.value == 0x90;
+                 instr.instr.operands[1].mem.disp.value == 0x90;
-                 } ) )
+        }))
       continue;
 
     // if code execution gets to here then we can assume this is a legit vm
     // entry... its time to build a vm_enter_t... first we check to see if an
     // existing entry already exits...
 
-            auto push_val = ( std::uint32_t )rtn[ 0 ].instr.operands[ 0 ].imm.value.u;
+    auto push_val = (std::uint32_t)rtn[0].instr.operands[0].imm.value.u;
-            if ( std::find_if( entries.begin(), entries.end(), [ & ]( const vm_enter_t &vm_enter ) -> bool {
+    if (std::find_if(entries.begin(), entries.end(),
+                     [&](const vm_enter_t& vm_enter) -> bool {
                        return vm_enter.encrypted_rva == push_val;
-                 } ) != entries.end() )
+                     }) != entries.end())
       continue;
 
-            vm_enter_t entry{ ( std::uint32_t )( result - module_base ), push_val };
+    vm_enter_t entry{(std::uint32_t)(result - module_base), push_val};
-            entries.push_back( entry );
+    entries.push_back(entry);
-        } while ( result );
+  } while (result);
   return entries;
-    }
+}
 }  // namespace vm::locate