added ADD profiler, added some macros to make matchers easier...

CMakeLists.txt

@@ -53,6 +53,7 @@ list(APPEND vmprofiler_SOURCES
 	"src/vmctx.cpp"
 	"src/vminstrs.cpp"
 	"src/vmlocate.cpp"
+	"src/vmprofiles/add.cpp"
 	"src/vmprofiles/jmp.cpp"
 	"src/vmprofiles/lconst.cpp"
 	"src/vmprofiles/lreg.cpp"

include/vminstrs.hpp

@@ -140,11 +140,12 @@ extern profiler_t jmp;
 extern profiler_t sreg;
 extern profiler_t lreg;
 extern profiler_t lconst;
+extern profiler_t add;
 
 /// <summary>
 /// unsorted vector of profiles... they get sorted once at runtime...
 /// </summary>
-inline std::vector<profiler_t*> profiles = {&jmp, &sreg, &lreg, &lconst};
+inline std::vector<profiler_t*> profiles = {&add, &jmp, &sreg, &lreg, &lconst};
 
 /// <summary>
 /// no i did not make this by hand, you cannot clown upon me!
@@ -249,4 +250,44 @@ vinstr_t determine(zydis_reg_t& vip, zydis_reg_t& vsp, hndlr_trace_t& hndlr);
 /// <param name="mnemonic">mnemonic of the profile to get...</param>
 /// <returns>pointer to the profile...</returns>
 profiler_t* get_profile(mnemonic_t mnemonic);
-}  // namespace vm::instrs
+}  // namespace vm::instrs
+
+// MOV REG, [VIP]
+#define IMM_FETCH                                                   \
+  [&](const zydis_reg_t vip, const zydis_reg_t vsp,                 \
+      const zydis_decoded_instr_t& instr) -> bool {                 \
+    return vm::utils::is_mov(instr) &&                              \
+           instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && \
+           instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&   \
+           instr.operands[1].mem.base == vip;                       \
+  }
+
+// MOV [VSP], REG
+#define STR_VALUE                                                 \
+  [&](const zydis_reg_t vip, const zydis_reg_t vsp,               \
+      const zydis_decoded_instr_t& instr) -> bool {               \
+    return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&                \
+           instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY && \
+           instr.operands[0].mem.base == vsp &&                   \
+           instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; \
+  }
+
+// MOV REG, [VSP]
+#define LOAD_VALUE                                                  \
+  [&](const zydis_reg_t vip, const zydis_reg_t vsp,                 \
+      const zydis_decoded_instr_t& instr) -> bool {                 \
+    return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&                  \
+           instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && \
+           instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&   \
+           instr.operands[1].mem.base == vsp;                       \
+  }
+
+// SUB VSP, OFFSET
+#define SUB_VSP                                                     \
+  [&](const zydis_reg_t vip, const zydis_reg_t vsp,                 \
+      const zydis_decoded_instr_t& instr) -> bool {                 \
+    return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&                  \
+           instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && \
+           instr.operands[0].reg.value == vsp &&                    \
+           instr.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE;  \
+  }

src/vmlocate.cpp

@@ -145,6 +145,14 @@ std::vector<vm_enter_t> get_vm_entries(std::uintptr_t module_base,
         }))
       continue;
 
+    // check for invalid instructions... such as INT instructions...
+    if (vm::locate::find(rtn, [&](const zydis_instr_t& instr) -> bool {
+          const auto& i = instr.instr;
+          return i.mnemonic >= ZYDIS_MNEMONIC_INT &&
+                 i.mnemonic <= ZYDIS_MNEMONIC_INT3;
+        }))
+      continue;
+
     // if code execution gets to here then we can assume this is a legit vm
     // entry... its time to build a vm_enter_t... first we check to see if an
     // existing entry already exits...

src/vmprofiles/add.cpp

@@ -0,0 +1,83 @@
+#include <vminstrs.hpp>
+
+namespace vm::instrs {
+profiler_t add = {
+    "ADD",
+    mnemonic_t::add,
+    {{// MOV REG, [VSP]
+      LOAD_VALUE,
+      // MOV REG, [VSP+OFFSET]
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[1].mem.base == vsp &&
+               instr.operands[1].mem.disp.has_displacement;
+      },
+      // ADD REG, REG
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // MOV [VSP+OFFSET], REG
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp &&
+               instr.operands[0].mem.disp.has_displacement &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // PUSHFQ
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+      },
+      // POP [VSP]
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp;
+      }}},
+    [&](zydis_reg_t& vip,
+        zydis_reg_t& vsp,
+        hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
+      vinstr_t res{mnemonic_t::add};
+
+      // MOV REG, [VSP]
+      const auto mov_reg_vsp = std::find_if(
+          hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
+          [&](emu_instr_t& instr) -> bool {
+            const auto& i = instr.m_instr;
+            return i.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                   i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                   i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                   i.operands[1].mem.base == vsp;
+          });
+
+      // MOV [VSP+OFFSET], REG
+      const auto mov_vsp_offset = std::find_if(
+          hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
+          [&](emu_instr_t& instr) -> bool {
+            const auto& i = instr.m_instr;
+            return i.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                   i.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                   i.operands[0].mem.base == vsp &&
+                   i.operands[0].mem.disp.has_displacement &&
+                   i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+          });
+
+      res.stack_size = mov_vsp_offset->m_instr.operands[1].size;
+      res.imm.size = mov_reg_vsp->m_instr.operands[1].size;
+      return res;
+    }};
+}

src/vmprofiles/jmp.cpp

@@ -5,14 +5,7 @@ profiler_t jmp = {
     "JMP",
     mnemonic_t::jmp,
     {{// MOV REG, [VSP]
-      [&](const zydis_reg_t vip,
+      LOAD_VALUE,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[1].mem.base == vsp;
-      },
       // ADD VSP, 8
       [&](const zydis_reg_t vip,
           const zydis_reg_t vsp,
@@ -45,9 +38,6 @@ profiler_t jmp = {
     [&](zydis_reg_t& vip,
         zydis_reg_t& vsp,
         hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
-      std::printf("> found a jmp...\n");
-      std::getchar();
-
       const auto& instrs = hndlr.m_instrs;
       const auto xchg = std::find_if(
           instrs.begin(), instrs.end(), [&](const emu_instr_t& instr) -> bool {

src/vmprofiles/lconst.cpp

@@ -5,32 +5,11 @@ profiler_t lconst = {
     "LCONST",
     mnemonic_t::lconst,
     {{// MOV REG, [VIP]
-      [&](const zydis_reg_t vip,
+      IMM_FETCH,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return vm::utils::is_mov(instr) &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[1].mem.base == vip;
-      },
       // SUB VSP, OFFSET
-      [&](const zydis_reg_t vip,
+      SUB_VSP,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[0].reg.value == vsp &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE;
-      },
       // MOV [VSP], REG
-      [&](const zydis_reg_t vip,
+      STR_VALUE}},
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[0].mem.base == vsp &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
-      }}},
     [&](zydis_reg_t& vip,
         zydis_reg_t& vsp,
         hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {

src/vmprofiles/lreg.cpp

@@ -5,14 +5,7 @@ profiler_t lreg = {
     "LREG",
     mnemonic_t::lreg,
     {{// MOV REG, [VIP]
-      [&](const zydis_reg_t vip,
+      IMM_FETCH,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return vm::utils::is_mov(instr) &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[1].mem.base == vip;
-      },
       // MOV REG, [RSP+REG]
       [&](const zydis_reg_t vip,
           const zydis_reg_t vsp,
@@ -24,23 +17,9 @@ profiler_t lreg = {
                instr.operands[1].mem.index != ZYDIS_REGISTER_NONE;
       },
       // SUB VSP, OFFSET
-      [&](const zydis_reg_t vip,
+      SUB_VSP,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[0].reg.value == vsp &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE;
-      },
       // MOV [VSP], REG
-      [&](const zydis_reg_t vip,
+      STR_VALUE}},
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[0].mem.base == vsp &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
-      }}},
     [&](zydis_reg_t& vip,
         zydis_reg_t& vsp,
         hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {

src/vmprofiles/sreg.cpp

@@ -5,14 +5,7 @@ profiler_t sreg = {
     "SREG",
     mnemonic_t::sreg,
     {{// MOV REG, [VSP]
-      [&](const zydis_reg_t vip,
+      LOAD_VALUE,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[1].mem.base == vsp;
-      },
       // ADD VSP, OFFSET
       [&](const zydis_reg_t vip,
           const zydis_reg_t vsp,
@@ -23,14 +16,7 @@ profiler_t sreg = {
                instr.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE;
       },
       // MOV REG, [VIP]
-      [&](const zydis_reg_t vip,
+      IMM_FETCH,
-          const zydis_reg_t vsp,
-          const zydis_decoded_instr_t& instr) -> bool {
-        return vm::utils::is_mov(instr) &&
-               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
-               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
-               instr.operands[1].mem.base == vip;
-      },
       // MOV [RSP+REG], REG
       [&](const zydis_reg_t vip,
           const zydis_reg_t vsp,