added test, added code to vmctx to get vip and vsp native register usage

out of a vm_enter... added some shit to vmutils like print
zydis_routine's...
main
John Doe 3 years ago
parent 70cb770db0
commit 14b145acc5

@ -6,10 +6,13 @@ class vmctx_t {
public:
explicit vmctx_t(std::uintptr_t module_base,
std::uintptr_t image_base,
std::uintptr_t vm_entry_rva,
std::uintptr_t image_size);
std::uintptr_t image_size,
std::uintptr_t vm_entry_rva);
bool init();
const std::uintptr_t m_module_base, m_image_base, m_vm_entry_rva,
m_image_size;
zydis_register_t m_vip, m_vsp;
zydis_routine_t m_vm_entry;
};
} // namespace vm

@ -2,6 +2,7 @@
#include <Zydis/Zydis.h>
#include <algorithm>
#include <cstdint>
#include <fstream>
#include <functional>
#include <nt/image.hpp>
#include <vector>
@ -41,6 +42,24 @@ inline void init() {
}
}
inline bool open_binary_file(const std::string& file,
std::vector<uint8_t>& data) {
std::ifstream fstr(file, std::ios::binary);
if (!fstr.is_open())
return false;
fstr.unsetf(std::ios::skipws);
fstr.seekg(0, std::ios::end);
const auto file_size = fstr.tellg();
fstr.seekg(NULL, std::ios::beg);
data.reserve(static_cast<uint32_t>(file_size));
data.insert(data.begin(), std::istream_iterator<uint8_t>(fstr),
std::istream_iterator<uint8_t>());
return true;
}
/// <summary>
/// determines if a given decoded native instruction is a JCC...
/// </summary>
@ -48,6 +67,19 @@ inline void init() {
/// <returns></returns>
bool is_jmp(const zydis_decoded_instr_t& instr);
/// <summary>
/// prints a disassembly view of a routine...
/// </summary>
/// <param name="routine">reference to a zydis_routine_t to be
/// printed...</param>
void print(zydis_routine_t& routine);
/// <summary>
/// prints a single disassembly view of an instruction...
/// </summary>
/// <param name="instr">instruction to print...</param>
void print(const zydis_decoded_instr_t& instr);
/// <summary>
/// utils pertaining to native registers...
/// </summary>

@ -3,10 +3,51 @@
namespace vm {
vmctx_t::vmctx_t(std::uintptr_t module_base,
std::uintptr_t image_base,
std::uintptr_t vm_entry_rva,
std::uintptr_t image_size)
std::uintptr_t image_size,
std::uintptr_t vm_entry_rva)
: m_module_base(module_base),
m_image_base(image_base),
m_vm_entry_rva(vm_entry_rva),
m_image_size(image_size) {}
bool vmctx_t::init() {
// flatten and deobfuscate the vm entry...
if (!vm::utils::flatten(m_vm_entry, m_module_base + m_vm_entry_rva))
return false;
vm::utils::deobfuscate(m_vm_entry);
// find mov reg, [rsp+0x90]. this register will be VIP...
const auto vip_fetch = std::find_if(
m_vm_entry.begin(), m_vm_entry.end(),
[&](const zydis_instr_t& instr) -> bool {
return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.instr.operands[1].mem.base == ZYDIS_REGISTER_RSP &&
instr.instr.operands[1].mem.disp.value == 0x90;
});
if (vip_fetch == m_vm_entry.end())
return false;
m_vip = vip_fetch->instr.operands[0].reg.value;
// find the register that will be used for the virtual stack...
// mov reg, rsp...
const auto vsp_fetch = std::find_if(
m_vm_entry.begin(), m_vm_entry.end(),
[&](const zydis_instr_t& instr) -> bool {
return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.instr.operands[1].reg.value == ZYDIS_REGISTER_RSP;
});
if (vsp_fetch == m_vm_entry.end())
return false;
m_vsp = vsp_fetch->instr.operands[0].reg.value;
return true;
}
} // namespace vm

@ -1,6 +1,21 @@
#include <vmutils.hpp>
namespace vm::locate {
namespace vm::utils {
void print(const zydis_decoded_instr_t& instr) {
char buffer[256];
ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr, buffer,
sizeof(buffer), 0u);
std::puts(buffer);
}
void print(zydis_routine_t& routine) {
char buffer[256];
for (auto [instr, raw, addr] : routine) {
ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr,
buffer, sizeof(buffer), addr);
std::printf("> %p %s\n", addr, buffer);
}
}
bool is_jmp(const zydis_decoded_instr_t& instr) {
return instr.mnemonic >= ZYDIS_MNEMONIC_JB &&
@ -208,4 +223,4 @@ bool executable(std::uint64_t module_base, std::uint64_t ptr) {
return false;
}
} // namespace scn
} // namespace vm::locate
} // namespace vm::utils

@ -1,6 +1,121 @@
#include <vmprofiler.hpp>
#include <cli-parser.hpp>
#include <vmprofiler.hpp>
int __cdecl main(int argc, const char* argv[]) {
argparse::argument_parser_t parser("VMEmu",
"VMProtect 3 VM Handler Emulator");
parser.add_argument()
.name("--vmentry")
.description("relative virtual address to a vm entry...")
.required(true);
parser.add_argument()
.name("--bin")
.description("path to unpacked virtualized binary...")
.required(true);
parser.enable_help();
auto result = parser.parse(argc, argv);
if (result) {
std::printf("[!] error parsing commandline arguments... reason = %s\n",
result.what().c_str());
return -1;
}
if (parser.exists("help")) {
parser.print_help();
return 0;
}
vm::utils::init();
std::vector<std::uint8_t> module_data, tmp, unpacked_bin;
if (!vm::utils::open_binary_file(parser.get<std::string>("bin"),
module_data)) {
std::printf("[!] failed to open binary file...\n");
return -1;
}
auto img = reinterpret_cast<win::image_t<>*>(module_data.data());
auto image_size = img->get_nt_headers()->optional_header.size_image;
const auto image_base = img->get_nt_headers()->optional_header.image_base;
// page align the vector allocation so that unicorn-engine is happy girl...
tmp.resize(image_size + 0x1000);
const std::uintptr_t module_base =
reinterpret_cast<std::uintptr_t>(tmp.data()) +
(0x1000 - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull));
std::memcpy((void*)module_base, module_data.data(), 0x1000);
std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections,
[&](const auto& section_header) {
std::memcpy(
(void*)(module_base + section_header.virtual_address),
module_data.data() + section_header.ptr_raw_data,
section_header.size_raw_data);
});
auto win_img = reinterpret_cast<win::image_t<>*>(module_base);
auto basereloc_dir =
win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
basereloc_dir->rva + module_base);
win::reloc_block_t* reloc_block = &reloc_dir->first_block;
// apply relocations to all sections...
while (reloc_block->base_rva && reloc_block->size_block) {
std::for_each(reloc_block->begin(), reloc_block->end(),
[&](win::reloc_entry_t& entry) {
switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: {
auto reloc_at = reinterpret_cast<std::uintptr_t*>(
entry.offset + reloc_block->base_rva + module_base);
*reloc_at = module_base + ((*reloc_at) - image_base);
break;
}
default:
break;
}
});
reloc_block = reloc_block->next();
}
std::printf("> image base = %p, image size = %p, module base = %p\n",
image_base, image_size, module_base);
if (!image_base || !image_size || !module_base) {
std::printf("[!] failed to open binary on disk...\n");
return -1;
}
const auto vm_entry_rva =
std::strtoull(parser.get<std::string>("vmentry").c_str(), nullptr, 16);
vm::vmctx_t vmctx(module_base, image_base, image_size, vm_entry_rva);
if (!vmctx.init()) {
std::printf(
"[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is "
"unpacked and is"
"protected with VMProtect 3...\n");
return -1;
}
vm::utils::print(vmctx.m_vm_entry);
std::printf("> Virtual Instruction Pointer Register: %s\n",
ZydisRegisterGetString(vmctx.m_vip));
std::printf("> Virtual Stack Pointer Register: %s\n",
ZydisRegisterGetString(vmctx.m_vsp));
int __cdecl main(int argc, char* argv[]) {
// testing vmlocate port for vmp3...
const auto vm_entries = vm::locate::get_vm_entries(module_base, image_size);
std::printf("> number of vm entries = %d\n", vm_entries.size());
}
Loading…
Cancel
Save