#pragma once #include #include #include #include #include "parser.h" namespace vm { /// /// struct containing encoded data for a given virtual instruction... /// struct vinstr_data { /// /// vm handler index also known as the opcode... /// std::uint8_t vm_handler; /// /// this field contains the second operand if any... /// std::uint64_t operand; /// /// size in bits of the second operand if any... zero if none... /// std::uint8_t imm_size; }; /// /// struct containing all information for a label... /// struct vlabel_data { /// /// name of the label... /// std::string label_name; /// /// vector of encoded virtual instructions... /// std::vector< vinstr_data > vinstrs; }; /// /// struct containing compiled virtual instructions (encoded and encrypted) for a given label... /// struct compiled_label_data { /// /// label name... /// std::string label_name; /// /// relative virtual address from vm_entry to the virtual instructions... /// std::uintptr_t alloc_rva; /// /// encrypted relative virtual address from vm_entry to virtual instructions... /// std::uintptr_t enc_alloc_rva; /// /// vector of bytes containing the raw, encrypted virtual instructions... /// std::vector< std::uint8_t > vinstrs; }; /// /// class containing member functions used to encode and encrypted virtual instructions... /// class compiler_t { public: /// /// default constructor /// /// pointer to a vm context object which has already been init... explicit compiler_t( vm::ctx_t *vmctx ); /// /// encode virtual instructions from parser::virt_labels /// /// returns a vector of labels containing encoded virtual instructions std::vector< vlabel_data > *encode(); /// /// encrypt virtual instructions from parser::virt_labels /// /// returns a vector of compiled labels containing encoded and encrypted virtual /// instructions... std::vector< compiled_label_data > encrypt(); private: /// /// encrypt virtual instructions rva... read more /// here... /// /// relative virtual address to encrypted virtual instructions... /// std::uint64_t encrypt_rva( std::uint64_t rva ); /// /// pointer to the vmctx passed in by the constructor... /// vm::ctx_t *vmctx; /// /// transformations used to decrypt the opcode operand extracted from calc_jmp... /// you can read more here... /// transform::map_t calc_jmp_transforms; /// /// vector of encoded labels... /// std::vector< vlabel_data > virt_labels; /// /// vector of decoded zydis instructions containing the native instructions to encrypt the virtual instruction /// rva which will be pushed onto the stack prior to jmping to vm entry... /// std::vector< zydis_decoded_instr_t > encrypt_vinstrs_rva; }; } // namespace vm