From 14b145acc534ebc041c57369fcbbcc1e74fd6d00 Mon Sep 17 00:00:00 2001 From: John Doe Date: Tue, 21 Dec 2021 01:06:45 -0800 Subject: [PATCH] added test, added code to vmctx to get vip and vsp native register usage out of a vm_enter... added some shit to vmutils like print zydis_routine's... --- include/vmctx.hpp | 7 +- include/vmutils.hpp | 32 ++++++++ src/vmctx.cpp | 45 +++++++++++- src/vmutils.cpp | 19 ++++- tests/vm_entry_test/src/main.cpp | 121 ++++++++++++++++++++++++++++++- 5 files changed, 215 insertions(+), 9 deletions(-) diff --git a/include/vmctx.hpp b/include/vmctx.hpp index a35f5e1..aad3163 100644 --- a/include/vmctx.hpp +++ b/include/vmctx.hpp @@ -6,10 +6,13 @@ class vmctx_t { public: explicit vmctx_t(std::uintptr_t module_base, std::uintptr_t image_base, - std::uintptr_t vm_entry_rva, - std::uintptr_t image_size); + std::uintptr_t image_size, + std::uintptr_t vm_entry_rva); bool init(); const std::uintptr_t m_module_base, m_image_base, m_vm_entry_rva, m_image_size; + + zydis_register_t m_vip, m_vsp; + zydis_routine_t m_vm_entry; }; } // namespace vm \ No newline at end of file diff --git a/include/vmutils.hpp b/include/vmutils.hpp index 8824495..1c22f93 100644 --- a/include/vmutils.hpp +++ b/include/vmutils.hpp @@ -2,6 +2,7 @@ #include #include #include +#include #include #include #include @@ -41,6 +42,24 @@ inline void init() { } } +inline bool open_binary_file(const std::string& file, + std::vector& data) { + std::ifstream fstr(file, std::ios::binary); + if (!fstr.is_open()) + return false; + + fstr.unsetf(std::ios::skipws); + fstr.seekg(0, std::ios::end); + + const auto file_size = fstr.tellg(); + + fstr.seekg(NULL, std::ios::beg); + data.reserve(static_cast(file_size)); + data.insert(data.begin(), std::istream_iterator(fstr), + std::istream_iterator()); + return true; +} + /// /// determines if a given decoded native instruction is a JCC... /// @@ -48,6 +67,19 @@ inline void init() { /// bool is_jmp(const zydis_decoded_instr_t& instr); +/// +/// prints a disassembly view of a routine... +/// +/// reference to a zydis_routine_t to be +/// printed... +void print(zydis_routine_t& routine); + +/// +/// prints a single disassembly view of an instruction... +/// +/// instruction to print... +void print(const zydis_decoded_instr_t& instr); + /// /// utils pertaining to native registers... /// diff --git a/src/vmctx.cpp b/src/vmctx.cpp index 82e82c0..4a07d92 100644 --- a/src/vmctx.cpp +++ b/src/vmctx.cpp @@ -3,10 +3,51 @@ namespace vm { vmctx_t::vmctx_t(std::uintptr_t module_base, std::uintptr_t image_base, - std::uintptr_t vm_entry_rva, - std::uintptr_t image_size) + std::uintptr_t image_size, + std::uintptr_t vm_entry_rva) : m_module_base(module_base), m_image_base(image_base), m_vm_entry_rva(vm_entry_rva), m_image_size(image_size) {} + +bool vmctx_t::init() { + // flatten and deobfuscate the vm entry... + if (!vm::utils::flatten(m_vm_entry, m_module_base + m_vm_entry_rva)) + return false; + + vm::utils::deobfuscate(m_vm_entry); + + // find mov reg, [rsp+0x90]. this register will be VIP... + const auto vip_fetch = std::find_if( + m_vm_entry.begin(), m_vm_entry.end(), + [&](const zydis_instr_t& instr) -> bool { + return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV && + instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY && + instr.instr.operands[1].mem.base == ZYDIS_REGISTER_RSP && + instr.instr.operands[1].mem.disp.value == 0x90; + }); + + if (vip_fetch == m_vm_entry.end()) + return false; + + m_vip = vip_fetch->instr.operands[0].reg.value; + + // find the register that will be used for the virtual stack... + // mov reg, rsp... + const auto vsp_fetch = std::find_if( + m_vm_entry.begin(), m_vm_entry.end(), + [&](const zydis_instr_t& instr) -> bool { + return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV && + instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.instr.operands[1].reg.value == ZYDIS_REGISTER_RSP; + }); + + if (vsp_fetch == m_vm_entry.end()) + return false; + + m_vsp = vsp_fetch->instr.operands[0].reg.value; + return true; +} } // namespace vm \ No newline at end of file diff --git a/src/vmutils.cpp b/src/vmutils.cpp index 447bf63..2dafbfd 100644 --- a/src/vmutils.cpp +++ b/src/vmutils.cpp @@ -1,6 +1,21 @@ #include -namespace vm::locate { +namespace vm::utils { +void print(const zydis_decoded_instr_t& instr) { + char buffer[256]; + ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr, buffer, + sizeof(buffer), 0u); + std::puts(buffer); +} + +void print(zydis_routine_t& routine) { + char buffer[256]; + for (auto [instr, raw, addr] : routine) { + ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr, + buffer, sizeof(buffer), addr); + std::printf("> %p %s\n", addr, buffer); + } +} bool is_jmp(const zydis_decoded_instr_t& instr) { return instr.mnemonic >= ZYDIS_MNEMONIC_JB && @@ -208,4 +223,4 @@ bool executable(std::uint64_t module_base, std::uint64_t ptr) { return false; } } // namespace scn -} // namespace vm::locate \ No newline at end of file +} // namespace vm::utils \ No newline at end of file diff --git a/tests/vm_entry_test/src/main.cpp b/tests/vm_entry_test/src/main.cpp index 7fdbc06..1bc52cb 100644 --- a/tests/vm_entry_test/src/main.cpp +++ b/tests/vm_entry_test/src/main.cpp @@ -1,6 +1,121 @@ -#include #include +#include + +int __cdecl main(int argc, const char* argv[]) { + argparse::argument_parser_t parser("VMEmu", + "VMProtect 3 VM Handler Emulator"); + parser.add_argument() + .name("--vmentry") + .description("relative virtual address to a vm entry...") + .required(true); + + parser.add_argument() + .name("--bin") + .description("path to unpacked virtualized binary...") + .required(true); + + parser.enable_help(); + auto result = parser.parse(argc, argv); + + if (result) { + std::printf("[!] error parsing commandline arguments... reason = %s\n", + result.what().c_str()); + return -1; + } + + if (parser.exists("help")) { + parser.print_help(); + return 0; + } + + vm::utils::init(); + std::vector module_data, tmp, unpacked_bin; + if (!vm::utils::open_binary_file(parser.get("bin"), + module_data)) { + std::printf("[!] failed to open binary file...\n"); + return -1; + } + + auto img = reinterpret_cast*>(module_data.data()); + auto image_size = img->get_nt_headers()->optional_header.size_image; + const auto image_base = img->get_nt_headers()->optional_header.image_base; + + // page align the vector allocation so that unicorn-engine is happy girl... + tmp.resize(image_size + 0x1000); + const std::uintptr_t module_base = + reinterpret_cast(tmp.data()) + + (0x1000 - (reinterpret_cast(tmp.data()) & 0xFFFull)); + + std::memcpy((void*)module_base, module_data.data(), 0x1000); + std::for_each(img->get_nt_headers()->get_sections(), + img->get_nt_headers()->get_sections() + + img->get_nt_headers()->file_header.num_sections, + [&](const auto& section_header) { + std::memcpy( + (void*)(module_base + section_header.virtual_address), + module_data.data() + section_header.ptr_raw_data, + section_header.size_raw_data); + }); + + auto win_img = reinterpret_cast*>(module_base); + + auto basereloc_dir = + win_img->get_directory(win::directory_id::directory_entry_basereloc); + + auto reloc_dir = reinterpret_cast( + basereloc_dir->rva + module_base); + + win::reloc_block_t* reloc_block = &reloc_dir->first_block; + + // apply relocations to all sections... + while (reloc_block->base_rva && reloc_block->size_block) { + std::for_each(reloc_block->begin(), reloc_block->end(), + [&](win::reloc_entry_t& entry) { + switch (entry.type) { + case win::reloc_type_id::rel_based_dir64: { + auto reloc_at = reinterpret_cast( + entry.offset + reloc_block->base_rva + module_base); + *reloc_at = module_base + ((*reloc_at) - image_base); + break; + } + default: + break; + } + }); + + reloc_block = reloc_block->next(); + } + + std::printf("> image base = %p, image size = %p, module base = %p\n", + image_base, image_size, module_base); + + if (!image_base || !image_size || !module_base) { + std::printf("[!] failed to open binary on disk...\n"); + return -1; + } + + const auto vm_entry_rva = + std::strtoull(parser.get("vmentry").c_str(), nullptr, 16); + + vm::vmctx_t vmctx(module_base, image_base, image_size, vm_entry_rva); + + if (!vmctx.init()) { + std::printf( + "[!] failed to init vmctx... this can be for many reasons..." + " try validating your vm entry rva... make sure the binary is " + "unpacked and is" + "protected with VMProtect 3...\n"); + return -1; + } + + vm::utils::print(vmctx.m_vm_entry); + std::printf("> Virtual Instruction Pointer Register: %s\n", + ZydisRegisterGetString(vmctx.m_vip)); + + std::printf("> Virtual Stack Pointer Register: %s\n", + ZydisRegisterGetString(vmctx.m_vsp)); -int __cdecl main(int argc, char* argv[]) { - + // testing vmlocate port for vmp3... + const auto vm_entries = vm::locate::get_vm_entries(module_base, image_size); + std::printf("> number of vm entries = %d\n", vm_entries.size()); } \ No newline at end of file