You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
52 lines
1.3 KiB
52 lines
1.3 KiB
#pragma once
|
|
#include <Windows.h>
|
|
#include <algorithm>
|
|
#include <vmprofiler.hpp>
|
|
|
|
#include "parser.h"
|
|
|
|
#define NT_HEADER( x ) \
|
|
reinterpret_cast< PIMAGE_NT_HEADERS64 >( reinterpret_cast< PIMAGE_DOS_HEADER >( x )->e_lfanew + x )
|
|
|
|
namespace vm
|
|
{
|
|
struct base_data_t
|
|
{
|
|
std::uintptr_t module_base;
|
|
std::uintptr_t image_base;
|
|
};
|
|
|
|
struct vinstr_data
|
|
{
|
|
std::uint8_t vm_handler;
|
|
std::uint64_t operand;
|
|
std::uint8_t imm_size; // size in bits...
|
|
};
|
|
|
|
struct vlabel_data
|
|
{
|
|
std::string label_name;
|
|
std::vector< vinstr_data > vinstrs;
|
|
};
|
|
|
|
struct compiled_label_data
|
|
{
|
|
std::string label_name;
|
|
std::uintptr_t enc_alloc_rva;
|
|
std::vector< std::uint8_t > vinstrs;
|
|
};
|
|
|
|
class compiler_t
|
|
{
|
|
public:
|
|
explicit compiler_t( vm::ctx_t *vmctx );
|
|
std::vector< vlabel_data > *encode();
|
|
std::vector< compiled_label_data > encrypt();
|
|
|
|
private:
|
|
vm::ctx_t *vmctx;
|
|
transform::map_t calc_jmp_transforms;
|
|
std::vector< vlabel_data > vinstrs;
|
|
std::vector< zydis_decoded_instr_t > encrypt_vinstrs_rva;
|
|
};
|
|
} // namespace vm
|