diff --git a/CMakeLists.txt b/CMakeLists.txt index 1a4b385..87eabc5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -39,14 +39,14 @@ endif() add_subdirectory(dependencies) set(CMAKE_FOLDER ${CMKR_CMAKE_FOLDER}) -# tests +# examples set(CMKR_CMAKE_FOLDER ${CMAKE_FOLDER}) if(CMAKE_FOLDER) - set(CMAKE_FOLDER "${CMAKE_FOLDER}/tests") + set(CMAKE_FOLDER "${CMAKE_FOLDER}/examples") else() - set(CMAKE_FOLDER tests) + set(CMAKE_FOLDER examples) endif() -add_subdirectory(tests) +add_subdirectory(examples) set(CMAKE_FOLDER ${CMKR_CMAKE_FOLDER}) # Target Theodosius diff --git a/Doxyfile b/Doxyfile index 14236c3..a00888f 100644 --- a/Doxyfile +++ b/Doxyfile @@ -866,7 +866,9 @@ WARN_LOGFILE = INPUT = include \ src \ - README.md + README.md \ + examples/demo/ \ + "examples/demo/Demo Example Using Theo.md" # This tag can be used to specify the character encoding of the source files # that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses @@ -1063,7 +1065,7 @@ FILTER_SOURCE_PATTERNS = # (index.html). This can be useful if you have a project on for instance GitHub # and want to reuse the introduction page also for the doxygen output. -USE_MDFILE_AS_MAINPAGE = E:\Theodosius\README.md +USE_MDFILE_AS_MAINPAGE = README.md #--------------------------------------------------------------------------- # Configuration options related to source browsing @@ -1082,7 +1084,7 @@ SOURCE_BROWSER = YES # classes and enums directly into the documentation. # The default value is: NO. -INLINE_SOURCES = NO +INLINE_SOURCES = YES # Setting the STRIP_CODE_COMMENTS tag to YES will instruct doxygen to hide any # special comment blocks from generated source code fragments. Normal C, C++ and diff --git a/cmake.toml b/cmake.toml index 705d7d9..6c9ad37 100644 --- a/cmake.toml +++ b/cmake.toml @@ -2,7 +2,7 @@ name = "Theodosius" [subdir.dependencies] -[subdir.tests] +[subdir.examples] [target.Theodosius] type = "static" diff --git a/doxygen/html/add__op_8hpp.html b/doxygen/html/add__op_8hpp.html deleted file mode 100644 index 178be93..0000000 --- a/doxygen/html/add__op_8hpp.html +++ /dev/null @@ -1,114 +0,0 @@ - - -
- - - - -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <obf/transform/operation.hpp>
Go to the source code of this file.
--Classes | |
class | theo::obf::transform::add_op_t |
-Namespaces | |
theo | |
The outer most encompassing namespace of this project. | |
theo::obf | |
this is the main namespace for obfuscation related things. | |
theo::obf::transform | |
this namespace encompasses the code for transforming relocations. | |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::decomp::decomp_t, including all inherited members.
-decomp_t(std::vector< std::uint8_t > &lib, recomp::symbol_table_t *syms) | theo::decomp::decomp_t | explicit |
decompose(std::string &entry_sym) | theo::decomp::decomp_t | |
lib() | theo::decomp::decomp_t | |
objs() | theo::decomp::decomp_t | |
rtns() | theo::decomp::decomp_t | |
scn_hash_tbl() | theo::decomp::decomp_t | |
syms() | theo::decomp::decomp_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
the main decomposition class which is responsible for breaking down lib file into coff files, and extracted used symbols from the coff files. - More...
- -#include <decomp.hpp>
-Public Member Functions | |
decomp_t (std::vector< std::uint8_t > &lib, recomp::symbol_table_t *syms) | |
the explicit constructor for decomp_t More... | |
std::vector< routine_t > | rtns () |
gets all of the routine objects. More... | |
std::vector< std::uint8_t > | lib () |
gets a vector of bytes consisting of the lib file. More... | |
std::vector< std::vector< std::uint8_t > > | objs () |
gets all the obj files as a vector of a vector of bytes. More... | |
recomp::symbol_table_t * | syms () |
gets the symbol table. More... | |
std::map< coff::section_header_t *, std::size_t > & | scn_hash_tbl () |
gets the section hash table section header --> hash of the section header ptr. More... | |
std::optional< recomp::symbol_table_t * > | decompose (std::string &entry_sym) |
decomposes (extracts) the symbols used. this function determines all used symbols given the entry point. More... | |
the main decomposition class which is responsible for breaking down lib file into coff files, and extracted used symbols from the coff files.
- -Definition at line 61 of file decomp.hpp.
-
-
|
- -explicit | -
the explicit constructor for decomp_t
-lib | vector of bytes containing the lib file. |
syms | symbol table that gets populated and managed by this class. |
std::optional<recomp::symbol_table_t*> theo::decomp::decomp_t::decompose | -( | -std::string & | -entry_sym | ) | -- |
decomposes (extracts) the symbols used. this function determines all used symbols given the entry point.
-entry_sym | the entry point symbol name. |
std::vector<std::uint8_t> theo::decomp::decomp_t::lib | -( | -) | -- |
gets a vector of bytes consisting of the lib file.
-std::vector<std::vector<std::uint8_t> > theo::decomp::decomp_t::objs | -( | -) | -- |
gets all the obj files as a vector of a vector of bytes.
-std::vector<routine_t> theo::decomp::decomp_t::rtns | -( | -) | -- |
gets all of the routine objects.
-std::map<coff::section_header_t*, std::size_t>& theo::decomp::decomp_t::scn_hash_tbl | -( | -) | -- |
gets the section hash table section header --> hash of the section header ptr.
-recomp::symbol_table_t* theo::decomp::decomp_t::syms | -( | -) | -- |
gets the symbol table.
-
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::decomp::routine_t, including all inherited members.
-data() | theo::decomp::routine_t | |
decompose() | theo::decomp::routine_t | |
routine_t(coff::symbol_t *sym, coff::image_t *img, coff::section_header_t *scn, std::vector< std::uint8_t > &fn, sym_type_t dcmp_type) | theo::decomp::routine_t | explicit |
scn() | theo::decomp::routine_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
the routine class which is responsible for creating symbols for routines. if the routine is located inside a section with the name ".split" it will break functions into instruction symbols. - More...
- -#include <routine.hpp>
-Public Member Functions | |
routine_t (coff::symbol_t *sym, coff::image_t *img, coff::section_header_t *scn, std::vector< std::uint8_t > &fn, sym_type_t dcmp_type) | |
the explicit constructor for routine_t. More... | |
std::vector< decomp::symbol_t > | decompose () |
decompose the function into symbol(s). More... | |
coff::section_header_t * | scn () |
gets the section header of the section in which the symbol is located in. More... | |
std::vector< std::uint8_t > | data () |
gets the function bytes. More... | |
the routine class which is responsible for creating symbols for routines. if the routine is located inside a section with the name ".split" it will break functions into instruction symbols.
- -Definition at line 53 of file routine.hpp.
-
-
|
- -explicit | -
the explicit constructor for routine_t.
-sym | the coff symbol for the routine. |
img | the coff image which contains the symbol. |
scn | the section header of the section that contains the symbol. |
fn | the data (bytes) of the function. |
dcmp_type | the type of decomp to do. if this is sym_type_t::function then this class wont split the function up into individual instructions. |
std::vector<std::uint8_t> theo::decomp::routine_t::data | -( | -) | -- |
gets the function bytes.
-std::vector<decomp::symbol_t> theo::decomp::routine_t::decompose | -( | -) | -- |
decompose the function into symbol(s).
-coff::section_header_t* theo::decomp::routine_t::scn | -( | -) | -- |
gets the section header of the section in which the symbol is located in.
-
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::decomp::symbol_t, including all inherited members.
-allocated_at() const | theo::decomp::symbol_t | |
allocated_at(std::uintptr_t allocated_at) | theo::decomp::symbol_t | |
data() | theo::decomp::symbol_t | |
hash() | theo::decomp::symbol_t | |
hash(const std::string &sym) | theo::decomp::symbol_t | static |
img() const | theo::decomp::symbol_t | |
name() const | theo::decomp::symbol_t | |
name(const coff::image_t *img, coff::symbol_t *sym) | theo::decomp::symbol_t | static |
offset() const | theo::decomp::symbol_t | |
relocs() | theo::decomp::symbol_t | |
scn() const | theo::decomp::symbol_t | |
size() const | theo::decomp::symbol_t | |
sym() const | theo::decomp::symbol_t | |
symbol_t(coff::image_t *img, std::string name, std::uintptr_t offset, std::vector< std::uint8_t > data, coff::section_header_t *scn={}, coff::symbol_t *sym={}, std::vector< recomp::reloc_t > relocs={}, sym_type_t dcmp_type={}) | theo::decomp::symbol_t | explicit |
type() const | theo::decomp::symbol_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol. symbols can be different things, sections, functions, and even instructions (when functions are broken down). - More...
- -#include <symbol.hpp>
-Public Member Functions | |
symbol_t (coff::image_t *img, std::string name, std::uintptr_t offset, std::vector< std::uint8_t > data, coff::section_header_t *scn={}, coff::symbol_t *sym={}, std::vector< recomp::reloc_t > relocs={}, sym_type_t dcmp_type={}) | |
the explicit constructor of this symbol. More... | |
std::string | name () const |
gets the name of the symbol. More... | |
std::uintptr_t | offset () const |
gets the offset into the section where the symbol is located. More... | |
std::uintptr_t | allocated_at () const |
returns the address where the symbol is allocated. More... | |
std::uint32_t | size () const |
returns the size of the symbol. More... | |
coff::section_header_t * | scn () const |
gets the section header of the section in which the symbol is contained. More... | |
coff::image_t * | img () const |
gets the imagine in which the symbol is located inside of. More... | |
std::vector< std::uint8_t > & | data () |
returns a vector by reference of bytes containing the data of the symbol. More... | |
coff::symbol_t * | sym () const |
returns a pointer to the coff symbol object. More... | |
sym_type_t | type () const |
returns the type of the symbol. More... | |
std::vector< recomp::reloc_t > & | relocs () |
returns a vector of relocations. More... | |
void | allocated_at (std::uintptr_t allocated_at) |
set the address where the symbol is allocated at. More... | |
std::size_t | hash () |
gets the hash of the symbol name. More... | |
-Static Public Member Functions | |
static std::size_t | hash (const std::string &sym) |
generate a hash given the name of the symbol. More... | |
static std::string | name (const coff::image_t *img, coff::symbol_t *sym) |
get the name of a symbol. this function will create a symbol name if the symbol is opaquely named. More... | |
symbol_t is an abstraction upon the coff symbol. this allows for easier manipulation of the symbol. symbols can be different things, sections, functions, and even instructions (when functions are broken down).
-this class is used throughout theodosius and is a keystone of the project. ensure you understand how this class works and what it contains.
- -Definition at line 53 of file symbol.hpp.
-
-
|
- -explicit | -
the explicit constructor of this symbol.
-img | the image in which the symbol is located in. |
name | the name of the symbol. |
offset | offset into the section where this symbol is located. |
data | the data of the symbol. there can be no data. |
scn | the section header describing the section which contains the symbol. |
sym | the coff symbol itself. |
relocs | a vector of relocations this symbol has (if any). |
dcmp_type | the type of symbol |
std::uintptr_t theo::decomp::symbol_t::allocated_at | -( | -) | -const | -
returns the address where the symbol is allocated.
-void theo::decomp::symbol_t::allocated_at | -( | -std::uintptr_t | -allocated_at | ) | -- |
set the address where the symbol is allocated at.
-allocated_at | where the symbol is allocated at. |
std::vector<std::uint8_t>& theo::decomp::symbol_t::data | -( | -) | -- |
returns a vector by reference of bytes containing the data of the symbol.
-std::size_t theo::decomp::symbol_t::hash | -( | -) | -- |
gets the hash of the symbol name.
-
-
|
- -static | -
generate a hash given the name of the symbol.
-sym | the symbol name to create a hash from. |
coff::image_t* theo::decomp::symbol_t::img | -( | -) | -const | -
gets the imagine in which the symbol is located inside of.
-std::string theo::decomp::symbol_t::name | -( | -) | -const | -
gets the name of the symbol.
-
-
|
- -static | -
get the name of a symbol. this function will create a symbol name if the symbol is opaquely named.
-for example in c++ if you define something like this:
-some_struct_t val = { value_one, value_two };
-"val" will be stored in the .data section of the coff file. however the symbol name will be opaque (the name of the symbol will be ".data"). this causes issues with theo since each symbol needs its own unqiue name to generate a unique symbol name hash. for symbols like this, theo will create a name for it with the following format:
-.data::section_index!coff_file_timestamp+offset_into_section
-img | the coff file containing the symbol. |
sym | the coff symbol itself. |
std::uintptr_t theo::decomp::symbol_t::offset | -( | -) | -const | -
gets the offset into the section where the symbol is located.
-std::vector<recomp::reloc_t>& theo::decomp::symbol_t::relocs | -( | -) | -- |
returns a vector of relocations.
-coff::section_header_t* theo::decomp::symbol_t::scn | -( | -) | -const | -
gets the section header of the section in which the symbol is contained.
-std::uint32_t theo::decomp::symbol_t::size | -( | -) | -const | -
returns the size of the symbol.
-coff::symbol_t* theo::decomp::symbol_t::sym | -( | -) | -const | -
returns a pointer to the coff symbol object.
-sym_type_t theo::decomp::symbol_t::type | -( | -) | -const | -
returns the type of the symbol.
-
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::engine_t, including all inherited members.
-add_pass(pass_t *pass) | theo::obf::engine_t | |
get() | theo::obf::engine_t | static |
run(decomp::symbol_t *sym) | theo::obf::engine_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
singleton obfuscation engine class. this class is responsible for keeping track of the registered passes and the order in which to execute them. - More...
- -#include <engine.hpp>
-Public Member Functions | |
void | add_pass (pass_t *pass) |
add a pass to the engine. the order in which you call this function matters as the underlying data structure that contains the passes is a vector. More... | |
void | run (decomp::symbol_t *sym) |
run all the passes on the symbol. this function will only run a pass if the symbol is the same type as the pass requires. More... | |
-Static Public Member Functions | |
static engine_t * | get () |
get the singleton object of this class. More... | |
singleton obfuscation engine class. this class is responsible for keeping track of the registered passes and the order in which to execute them.
- -Definition at line 42 of file engine.hpp.
-void theo::obf::engine_t::add_pass | -( | -pass_t * | -pass | ) | -- |
add a pass to the engine. the order in which you call this function matters as the underlying data structure that contains the passes is a vector.
-pass | a pointer to the pass in which to add to the engine. |
-
|
- -static | -
get the singleton object of this class.
-void theo::obf::engine_t::run | -( | -decomp::symbol_t * | -sym | ) | -- |
run all the passes on the symbol. this function will only run a pass if the symbol is the same type as the pass requires.
-sym | symbol to run all passes on. |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::jcc_rewrite_pass_t, including all inherited members.
-get() | theo::obf::jcc_rewrite_pass_t | static |
pass_t(decomp::sym_type_t sym_type) | theo::obf::pass_t | inlineexplicit |
run(decomp::symbol_t *sym) | theo::obf::jcc_rewrite_pass_t | virtual |
sym_type() | theo::obf::pass_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
jcc rewrite pass which rewrites rip relative jcc's so that they are position independent. - More...
- -#include <jcc_rewrite_pass.hpp>
-Public Member Functions | |
void | run (decomp::symbol_t *sym) |
virtual method which must be implimented by the pass that inherits this class. More... | |
Public Member Functions inherited from theo::obf::pass_t | |
pass_t (decomp::sym_type_t sym_type) | |
the explicit constructor of the pass_t base class. More... | |
decomp::sym_type_t | sym_type () |
gets the passes symbol type. More... | |
-Static Public Member Functions | |
static jcc_rewrite_pass_t * | get () |
jcc rewrite pass which rewrites rip relative jcc's so that they are position independent.
-given the following code:
jnz label1 -; other code goes here -
label1: ; more code here
-the jnz instruction will be rewritten so that the following code is generated:
jnz br2 -
br1: jmp [rip] ; address after this instruction contains the address ; of the instruction after the jcc. br2: jmp [rip] ; address after this instruction contains the address of where ; branch 2 is located.
-its important to note that other passes will encrypt (transform) the address of the next instruction. There is actually no jmp [rip] either, push/ret is used.
- -Definition at line 61 of file jcc_rewrite_pass.hpp.
-
-
|
- -static | -
-
|
- -virtual | -
virtual method which must be implimented by the pass that inherits this class.
-sym | a symbol of the same type of m_sym_type. |
Implements theo::obf::pass_t.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::next_inst_pass_t, including all inherited members.
-get() | theo::obf::next_inst_pass_t | static |
pass_t(decomp::sym_type_t sym_type) | theo::obf::pass_t | inlineexplicit |
run(decomp::symbol_t *sym) | theo::obf::next_inst_pass_t | virtual |
sym_type() | theo::obf::pass_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This pass is used to generate transformations and jmp code to change RIP to the next instruction. - More...
- -#include <next_inst_pass.hpp>
-Public Member Functions | |
void | run (decomp::symbol_t *sym) |
virtual method which must be implimented by the pass that inherits this class. More... | |
Public Member Functions inherited from theo::obf::pass_t | |
pass_t (decomp::sym_type_t sym_type) | |
the explicit constructor of the pass_t base class. More... | |
decomp::sym_type_t | sym_type () |
gets the passes symbol type. More... | |
-Static Public Member Functions | |
static next_inst_pass_t * | get () |
This pass is used to generate transformations and jmp code to change RIP to the next instruction.
-given the following code (get pml4 address from cr3):
-get_pml4: 0: 48 c7 c0 ff 0f 00 00 mov rax,0xfff 7: 48 f7 d0 not rax a: 0f 20 da mov rdx,cr3 d: 48 21 c2 and rdx,rax 10: b1 00 mov cl,0x0 12: 48 d3 e2 shl rdx,cl 15: 48 89 d0 mov rax,rdx 18: c3 ret
-this pass will break up each instruction so that it can be anywhere in a linear virtual address space. this pass will not work on rip relative code, however clang will not generate such code when compiled with "-mcmodel=large"
-get_pml4@0: mov rax, 0xFFF push [next_inst_addr_enc] xor [rsp], 0x3243342 ; a random number of transformations here... ret next_inst_addr_enc: ; encrypted address of the next instruction goes here.
-get_pml4@7: not rax push [next_inst_addr_enc] xor [rsp], 0x93983498 ; a random number of transformations here... ret next_inst_addr_enc: ; encrypted address of the next instruction goes here.
-this process is continued for each instruction in the function. the last instruction "ret" will have no code generated for it as there is no next instruction.
-this pass also only runs at the instruction level, theodosius internally breaks up functions inside of the ".split" section into individual instruction symbols. this process also creates a psuedo relocation which simply tells this pass that there needs to be a relocation to the next symbol. the offset for these psuedo relocations is zero.
- -Definition at line 85 of file next_inst_pass.hpp.
-
-
|
- -static | -
-
|
- -virtual | -
virtual method which must be implimented by the pass that inherits this class.
-sym | a symbol of the same type of m_sym_type. |
Implements theo::obf::pass_t.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::pass_t, including all inherited members.
-pass_t(decomp::sym_type_t sym_type) | theo::obf::pass_t | inlineexplicit |
run(decomp::symbol_t *sym)=0 | theo::obf::pass_t | pure virtual |
sym_type() | theo::obf::pass_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual function and declare the logic of your pass there. - More...
- -#include <pass.hpp>
-Public Member Functions | |
pass_t (decomp::sym_type_t sym_type) | |
the explicit constructor of the pass_t base class. More... | |
virtual void | run (decomp::symbol_t *sym)=0 |
virtual method which must be implimented by the pass that inherits this class. More... | |
decomp::sym_type_t | sym_type () |
gets the passes symbol type. More... | |
the pass_t class is a base clase for all passes made. you must override the pass_t::run virtual function and declare the logic of your pass there.
-in the constructor of your pass you must call the super constructor (the pass_t constructor) and pass it the type of symbol which you are interesting in receiving.
- - -
-
|
- -inlineexplicit | -
-
|
- -pure virtual | -
virtual method which must be implimented by the pass that inherits this class.
-sym | a symbol of the same type of m_sym_type. |
Implemented in theo::obf::reloc_transform_pass_t, theo::obf::next_inst_pass_t, and theo::obf::jcc_rewrite_pass_t.
- -
-
|
- -inline | -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::reloc_transform_pass_t, including all inherited members.
-get() | theo::obf::reloc_transform_pass_t | static |
pass_t(decomp::sym_type_t sym_type) | theo::obf::pass_t | inlineexplicit |
run(decomp::symbol_t *sym) | theo::obf::reloc_transform_pass_t | virtual |
sym_type() | theo::obf::pass_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol. - More...
- -#include <reloc_transform_pass.hpp>
-Public Member Functions | |
void | run (decomp::symbol_t *sym) |
virtual method which must be implimented by the pass that inherits this class. More... | |
Public Member Functions inherited from theo::obf::pass_t | |
pass_t (decomp::sym_type_t sym_type) | |
the explicit constructor of the pass_t base class. More... | |
decomp::sym_type_t | sym_type () |
gets the passes symbol type. More... | |
-Static Public Member Functions | |
static reloc_transform_pass_t * | get () |
this pass is like the next_inst_pass, however, relocations are encrypted with transformations instead of the address of the next instruction. this pass only runs at the instruction level and appends transformations into the reloc_t object of the instruction symbol.
-given the following code:
mov rax, &MessageBoxA -
this pass will generate a random number of transformations to encrypt the address of "MessageBoxA". These transformations will then be applied by theodosius internally when resolving relocations.
mov rax, enc_MessageBoxA -xor rax, 0x389284324 -add rax, 0x345332567 -ror rax, 0x5353 --
Definition at line 56 of file reloc_transform_pass.hpp.
-
-
|
- -static | -
-
|
- -virtual | -
virtual method which must be implimented by the pass that inherits this class.
-sym | a symbol of the same type of m_sym_type. |
Implements theo::obf::pass_t.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::add_op_t, including all inherited members.
-get() | theo::obf::transform::add_op_t | inlinestatic |
get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <add_op.hpp>
-Static Public Member Functions | |
static add_op_t * | get () |
Static Public Member Functions inherited from theo::obf::transform::operation_t | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
-Additional Inherited Members | |
Public Member Functions inherited from theo::obf::transform::operation_t | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
Definition at line 35 of file add_op.hpp.
-
-
|
- -inlinestatic | -
Definition at line 42 of file add_op.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::operation_t, including all inherited members.
-get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
operation_t is the base class for all types of transformations. classes that inherit this class are singleton and simply call the super constructor (operation_t::operation_t). - More...
- -#include <operation.hpp>
-Public Member Functions | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
-Static Public Member Functions | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
operation_t is the base class for all types of transformations. classes that inherit this class are singleton and simply call the super constructor (operation_t::operation_t).
- -Definition at line 61 of file operation.hpp.
-
-
|
- -inlineexplicit | -
explicit constructor for operation_t
-op | lambda function when executed applies transformations. |
type | type of transformation, such as XOR, ADD, SUB, etc... |
Definition at line 69 of file operation.hpp.
- -
-
|
- -inline | -
gets a pointer to the lambda function which contains the transform logic.
-Definition at line 133 of file operation.hpp.
- -
-
|
- -inline | -
gets the inverse operation of the current operation.
-Definition at line 126 of file operation.hpp.
- -
-
|
- -inline | -
generates a native transform instruction given an existing instruction. it works like so:
-mov rax, &MessageBoxA ; original instruction with relocation
-; this function takes the first operand and out of the original ; instruction and uses it to generate a transformation.
-xor rax, 0x39280928 ; this would be an example output for the xor ;operation.
-inst | instruction with a relocation to generate a transformation for. |
imm | random 32bit number used in the generate transform. |
Definition at line 89 of file operation.hpp.
- -
-
|
- -inlinestatic | -
generate a random number in a range.
-lowest | lowest value of the range. |
largest | highest value of the range. |
Definition at line 148 of file operation.hpp.
-
-
|
- -inline | -
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc...
-Definition at line 140 of file operation.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::rol_op_t, including all inherited members.
-get() | theo::obf::transform::rol_op_t | inlinestatic |
get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <rol_op.hpp>
-Static Public Member Functions | |
static rol_op_t * | get () |
Static Public Member Functions inherited from theo::obf::transform::operation_t | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
-Additional Inherited Members | |
Public Member Functions inherited from theo::obf::transform::operation_t | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
Definition at line 35 of file rol_op.hpp.
-
-
|
- -inlinestatic | -
Definition at line 44 of file rol_op.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::ror_op_t, including all inherited members.
-get() | theo::obf::transform::ror_op_t | inlinestatic |
get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <ror_op.hpp>
-Static Public Member Functions | |
static ror_op_t * | get () |
Static Public Member Functions inherited from theo::obf::transform::operation_t | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
-Additional Inherited Members | |
Public Member Functions inherited from theo::obf::transform::operation_t | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
Definition at line 35 of file ror_op.hpp.
-
-
|
- -inlinestatic | -
Definition at line 44 of file ror_op.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::sub_op_t, including all inherited members.
-get() | theo::obf::transform::sub_op_t | inlinestatic |
get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <sub_op.hpp>
-Static Public Member Functions | |
static sub_op_t * | get () |
Static Public Member Functions inherited from theo::obf::transform::operation_t | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
-Additional Inherited Members | |
Public Member Functions inherited from theo::obf::transform::operation_t | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
Definition at line 35 of file sub_op.hpp.
-
-
|
- -inlinestatic | -
Definition at line 42 of file sub_op.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::obf::transform::xor_op_t, including all inherited members.
-get() | theo::obf::transform::xor_op_t | inlinestatic |
get_transform() | theo::obf::transform::operation_t | inline |
inverse() | theo::obf::transform::operation_t | inline |
native(const xed_decoded_inst_t *inst, std::uint32_t imm) | theo::obf::transform::operation_t | inline |
operation_t(transform_t op, xed_iclass_enum_t type) | theo::obf::transform::operation_t | inlineexplicit |
random(std::size_t lowest, std::size_t largest) | theo::obf::transform::operation_t | inlinestatic |
type() | theo::obf::transform::operation_t | inline |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
#include <xor_op.hpp>
-Static Public Member Functions | |
static xor_op_t * | get () |
Static Public Member Functions inherited from theo::obf::transform::operation_t | |
static std::size_t | random (std::size_t lowest, std::size_t largest) |
generate a random number in a range. More... | |
-Additional Inherited Members | |
Public Member Functions inherited from theo::obf::transform::operation_t | |
operation_t (transform_t op, xed_iclass_enum_t type) | |
explicit constructor for operation_t More... | |
std::vector< std::uint8_t > | native (const xed_decoded_inst_t *inst, std::uint32_t imm) |
generates a native transform instruction given an existing instruction. it works like so: More... | |
xed_iclass_enum_t | inverse () |
gets the inverse operation of the current operation. More... | |
transform_t * | get_transform () |
gets a pointer to the lambda function which contains the transform logic. More... | |
xed_iclass_enum_t | type () |
gets the operation type. such as XED_ICLASS_ADD, XED_ICLASS_SUB, etc... More... | |
Definition at line 35 of file xor_op.hpp.
-
-
|
- -inlinestatic | -
Definition at line 42 of file xor_op.hpp.
- -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::recomp::recomp_t, including all inherited members.
-allocate() | theo::recomp::recomp_t | |
allocator(allocator_t alloc) | theo::recomp::recomp_t | |
copier(copier_t copy) | theo::recomp::recomp_t | |
copy_syms() | theo::recomp::recomp_t | |
recomp_t(decomp::decomp_t *dcmp, allocator_t alloc, copier_t copy, resolver_t resolve) | theo::recomp::recomp_t | explicit |
resolve() | theo::recomp::recomp_t | |
resolve(const std::string &&sym) | theo::recomp::recomp_t | |
resolver(resolver_t resolve) | theo::recomp::recomp_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
the main class responsible for recomposition - More...
- -#include <recomp.hpp>
-Public Member Functions | |
recomp_t (decomp::decomp_t *dcmp, allocator_t alloc, copier_t copy, resolver_t resolve) | |
the explicit constructor for the recomp_t class. More... | |
void | allocate () |
when called, this function allocates space for every symbol. More... | |
void | resolve () |
when called, this function resolves all relocations in every symbol. More... | |
void | copy_syms () |
when called, this function copies symbols into allocations. More... | |
void | allocator (allocator_t alloc) |
setter for the allocater lambda function. More... | |
void | copier (copier_t copy) |
setter for the copier lambda function. More... | |
void | resolver (resolver_t resolve) |
setter for the resolve lambda function. More... | |
std::uintptr_t | resolve (const std::string &&sym) |
resolves the address of a function given its name. More... | |
the main class responsible for recomposition
- -Definition at line 64 of file recomp.hpp.
-
-
|
- -explicit | -
the explicit constructor for the recomp_t class.
-dcmp | pointer to a decomp_t class. |
alloc | lambda function which is used to allocate memory for symbols. |
copy | lambda function used to copy bytes into allocations. |
resolve | lambda function used to resolve external symbols. |
void theo::recomp::recomp_t::allocate | -( | -) | -- |
when called, this function allocates space for every symbol.
- -void theo::recomp::recomp_t::allocator | -( | -allocator_t | -alloc | ) | -- |
setter for the allocater lambda function.
-alloc | lambda function which allocates memory for symbols. |
void theo::recomp::recomp_t::copier | -( | -copier_t | -copy | ) | -- |
setter for the copier lambda function.
-copy | copier lambda function used to copy bytes into allocations made by the allocator. |
void theo::recomp::recomp_t::copy_syms | -( | -) | -- |
when called, this function copies symbols into allocations.
- -void theo::recomp::recomp_t::resolve | -( | -) | -- |
when called, this function resolves all relocations in every symbol.
- -std::uintptr_t theo::recomp::recomp_t::resolve | -( | -const std::string && | -sym | ) | -- |
resolves the address of a function given its name.
-sym | the name of the symbol to resolve the location of. |
void theo::recomp::recomp_t::resolver | -( | -resolver_t | -resolve | ) | -- |
setter for the resolve lambda function.
-resolve | lambda function to resolve external symbols. |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::recomp::reloc_t, including all inherited members.
-add_transform(std::pair< obf::transform::transform_t *, std::uint32_t > entry) | theo::recomp::reloc_t | inline |
get_transforms() | theo::recomp::reloc_t | inline |
hash() | theo::recomp::reloc_t | inline |
name() | theo::recomp::reloc_t | inline |
offset() | theo::recomp::reloc_t | inline |
offset(std::uint32_t offset) | theo::recomp::reloc_t | inline |
reloc_t(std::uint32_t offset, std::size_t hash, const std::string &&sym_name) | theo::recomp::reloc_t | inlineexplicit |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
meta data about a relocation for a symbol - More...
- -#include <reloc.hpp>
-Public Member Functions | |
reloc_t (std::uint32_t offset, std::size_t hash, const std::string &&sym_name) | |
explicit constructor for this class. More... | |
std::size_t | hash () |
returns the hash of the relocation symbol. More... | |
std::string | name () |
returns the name of the relocation symbol. More... | |
std::uint32_t | offset () |
returns the offset into the symbol to which the relocation will be applied. the offset is in bytes. zero based. More... | |
void | offset (std::uint32_t offset) |
sets the offset to which the relocation gets applied too. More... | |
void | add_transform (std::pair< obf::transform::transform_t *, std::uint32_t > entry) |
adds a transformation to be applied to the relocation prior to writing it into the symbol. More... | |
std::vector< std::pair< obf::transform::transform_t *, std::uint32_t > > & | get_transforms () |
gets the vector of transformation. More... | |
-
|
- -inlineexplicit | -
explicit constructor for this class.
-offset | offset into the symbol data where the relocation is at. all relocations are assumed to be linear virtual addresses of the symbol. |
hash | hash of the symbol to which the relocation is of. |
sym_name | the name of the symbol to which the relocation is of. |
-
|
- -inline | -
adds a transformation to be applied to the relocation prior to writing it into the symbol.
-entry | a pair containing a lambda function that when executed transforms a relocation. the second value in the pair is a random value which is passed to the lambda. |
Definition at line 91 of file reloc.hpp.
-
-
|
- -inline | -
-
|
- -inline | -
-
|
- -inline | -
-
|
- -inline | -
-
|
- -inline | -
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::recomp::symbol_table_t, including all inherited members.
-for_each(std::function< void(decomp::symbol_t &sym)> fn) | theo::recomp::symbol_table_t | |
put_symbol(decomp::symbol_t &sym) | theo::recomp::symbol_table_t | |
put_symbols(std::vector< decomp::symbol_t > &syms) | theo::recomp::symbol_table_t | |
size() | theo::recomp::symbol_table_t | |
sym_from_alloc(std::uintptr_t allocated_at) | theo::recomp::symbol_table_t | |
sym_from_hash(std::size_t hash) | theo::recomp::symbol_table_t | |
symbol_table_t() | theo::recomp::symbol_table_t | inline |
symbol_table_t(const std::vector< decomp::symbol_t > &&syms) | theo::recomp::symbol_table_t |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
this class is a high level wrapper for a hashmap that contains decomp::symbol_t values. the symbol values are references by a hashcode. - More...
- -#include <symbol_table.hpp>
-Public Member Functions | |
symbol_table_t () | |
default constructor. does nothing. More... | |
symbol_table_t (const std::vector< decomp::symbol_t > &&syms) | |
this constructor will populate the m_table private field with symbols. More... | |
void | put_symbol (decomp::symbol_t &sym) |
add symbol to m_table More... | |
void | put_symbols (std::vector< decomp::symbol_t > &syms) |
add a vector of symbol to m_table More... | |
std::optional< decomp::symbol_t * > | sym_from_hash (std::size_t hash) |
returns an optional pointer to a symbol from the symbol table given the symbols hash (hash of its name) the hash is produced by theo::decomp::symbol_t::hash More... | |
std::optional< decomp::symbol_t * > | sym_from_alloc (std::uintptr_t allocated_at) |
returns an optional pointer to a symbol given its allocation location. More... | |
void | for_each (std::function< void(decomp::symbol_t &sym)> fn) |
this function is a wrapper function that allows you to get at each entry in the symbol table by reference. More... | |
std::uint32_t | size () |
returns the size of the symbol table. More... | |
this class is a high level wrapper for a hashmap that contains decomp::symbol_t values. the symbol values are references by a hashcode.
- -Definition at line 45 of file symbol_table.hpp.
-
-
|
- -inline | -
default constructor. does nothing.
- -Definition at line 50 of file symbol_table.hpp.
- -theo::recomp::symbol_table_t::symbol_table_t | -( | -const std::vector< decomp::symbol_t > && | -syms | ) | -- |
this constructor will populate the m_table private field with symbols.
-syms | vector of decomp::symbol_t |
void theo::recomp::symbol_table_t::for_each | -( | -std::function< void(decomp::symbol_t &sym)> | -fn | ) | -- |
this function is a wrapper function that allows you to get at each entry in the symbol table by reference.
-fn | a callback function that will be called for each symbol |
void theo::recomp::symbol_table_t::put_symbol | -( | -decomp::symbol_t & | -sym | ) | -- |
add symbol to m_table
-sym | symbol to be added. |
void theo::recomp::symbol_table_t::put_symbols | -( | -std::vector< decomp::symbol_t > & | -syms | ) | -- |
add a vector of symbol to m_table
-syms |
std::uint32_t theo::recomp::symbol_table_t::size | -( | -) | -- |
returns the size of the symbol table.
-std::optional<decomp::symbol_t*> theo::recomp::symbol_table_t::sym_from_alloc | -( | -std::uintptr_t | -allocated_at | ) | -- |
returns an optional pointer to a symbol given its allocation location.
-allocated_at | the address where the symbol is allocated at. |
std::optional<decomp::symbol_t*> theo::recomp::symbol_table_t::sym_from_hash | -( | -std::size_t | -hash | ) | -- |
returns an optional pointer to a symbol from the symbol table given the symbols hash (hash of its name) the hash is produced by theo::decomp::symbol_t::hash
-hash | hashcode of the symbol to get from the symbol table... |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
This is the complete list of members for theo::theo_t, including all inherited members.
-compose() | theo::theo_t | |
decompose() | theo::theo_t | |
resolve(const std::string &&sym) | theo::theo_t | |
theo_t(std::vector< std::uint8_t > &lib, lnk_fns_t lnkr_fns, const std::string &&entry_sym) | theo::theo_t | explicit |
- Theodosius
- v3.0
-
- Jit linker, mapper, obfuscator, and mutator
- |
-
the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp. - More...
- -#include <theo.hpp>
-Public Member Functions | |
theo_t (std::vector< std::uint8_t > &lib, lnk_fns_t lnkr_fns, const std::string &&entry_sym) | |
explicit constructor for theo class. More... | |
std::optional< std::uint32_t > | decompose () |
decomposes the lib file and return the number of symbols that are used. More... | |
std::uintptr_t | compose () |
compose the decomposed module. This will run obfuscation passes, the map and resolve symbols to each other. More... | |
std::uintptr_t | resolve (const std::string &&sym) |
given the name of a symbol, it returns the address of where its mapped. More... | |
the main class which encapsulates a symbol table, decomp, and recomp objects. This class is a bridge that connects all three: decomp, obf, recomp.
-You will create an object of this type when using theo.
- - -
-
|
- -explicit | -
explicit constructor for theo class.
-lib | a vector of bytes consisting of a lib |
lnkr_fns | |
entry_sym | the name of the function which will be used as the entry point |
std::uintptr_t theo::theo_t::compose | -( | -) | -- |
compose the decomposed module. This will run obfuscation passes, the map and resolve symbols to each other.
-std::optional<std::uint32_t> theo::theo_t::decompose | -( | -) | -- |
decomposes the lib file and return the number of symbols that are used.
-std::uintptr_t theo::theo_t::resolve | -( | -const std::string && | -sym | ) | -- |
given the name of a symbol, it returns the address of where its mapped.
-sym | the name of the symbol |
File in include/obf/transform | Includes file in include/recomp |
---|---|
gen.hpp | reloc.hpp |