#pragma once #include #include #include #include #include namespace vm { /// /// struct containing encoded data for a given virtual instruction... /// struct vinstr_data { /// /// vm handler index also known as the opcode... /// std::uint8_t vm_handler; /// /// this field contains the second operand if any... /// std::uint64_t operand; /// /// size in bits of the second operand if any... zero if none... /// std::uint8_t imm_size; }; /// /// struct containing all information for a label... /// struct vlabel_data { /// /// name of the label... /// std::string label_name; /// /// vector of encoded virtual instructions... /// std::vector vinstrs; }; /// /// struct containing compiled virtual instructions (encoded and encrypted) for /// a given label... /// struct compiled_label_data { /// /// label name... /// std::string label_name; /// /// relative virtual address from vm_entry to the virtual instructions... /// std::uintptr_t alloc_rva; /// /// encrypted relative virtual address from vm_entry to virtual /// instructions... /// std::uintptr_t enc_alloc_rva; /// /// vector of bytes containing the raw, encrypted virtual instructions... /// std::vector vinstrs; }; /// /// class containing member functions used to encode and encrypted virtual /// instructions... /// class compiler_t { public: /// /// default constructor /// /// pointer to a vm context object which has already been /// init... explicit compiler_t(vm::ctx_t* vmctx); /// /// encode virtual instructions from parser::virt_labels /// /// returns a vector of labels containing encoded virtual /// instructions std::vector* encode(); /// /// encrypt virtual instructions from parser::virt_labels /// /// returns a vector of compiled labels containing encoded and /// encrypted virtual instructions... std::vector encrypt(); private: /// /// encrypt virtual instructions rva... read more here... /// /// relative virtual address to encrypted virtual /// instructions... std::uint64_t encrypt_rva(std::uint64_t rva); /// /// pointer to the vmctx passed in by the constructor... /// vm::ctx_t* vmctx; /// /// transformations used to decrypt the opcode operand extracted from /// calc_jmp... you can read more here... /// transform::map_t calc_jmp_transforms; /// /// vector of encoded labels... /// std::vector virt_labels; /// /// vector of decoded zydis instructions containing the native instructions to /// encrypt the virtual instruction rva which will be pushed onto the stack /// prior to jmping to vm entry... /// std::vector encrypt_vinstrs_rva; }; } // namespace vm