vmp2
/
vmemu
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'dev' into 'master'

Browse Source 
Dev

See merge request vmp2/vmemu!4
merge-requests/5/merge
_xeroxz 4 years ago
parent f47e706978 4f75947de5
commit 86faca86a6
9 changed files with 687 additions and 577 deletions
Show Stats Download Patch File Download Diff File

2
dependencies/vmprofiler vendored

@ -1 +1 @@
Subproject commit e58c23c40e13528f5d9b84feb7e23b62a886ed5a
Subproject commit e95ef2537184639e89a4dbbd38355a11ffc46bac

99
src/main.cpp
Unescape View File

@ -8,7 +8,7 @@
int __cdecl main( int argc, const char *argv[] )
{
argparse::argument_parser_t parser( "VMEmu", "VMProtect 2 Static VM Handler Emulator" );
argparse::argument_parser_t parser( "VMEmu", "VMProtect 2 VM Handler Emulator" );
parser.add_argument()
.name( "--vmentry" )
@ -34,45 +34,33 @@ int __cdecl main( int argc, const char *argv[] )
}
auto umtils = xtils::um_t::get_instance();
const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 );
const auto image_base = umtils->image_base( parser.get< std::string >( "vmpbin" ).c_str() );
const auto module_base = reinterpret_cast< std::uintptr_t >(
LoadLibraryExA( parser.get< std::string >( "vmpbin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
zydis_routine_t vm_entry, calc_jmp;
if ( !vm::util::flatten( vm_entry, vm_entry_rva + module_base ) )
{
std::printf( "> failed to flatten vm entry...\n" );
return -1;
}
const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 );
const auto image_base = umtils->image_base( parser.get< std::string >( "vmpbin" ).c_str() );
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage;
vm::util::deobfuscate( vm_entry );
std::printf( "> flattened vm entry...\n" );
std::printf( "> deobfuscated vm entry...\n" );
std::printf( "==================================================================================\n" );
vm::util::print( vm_entry );
std::printf( "> image base = %p, image size = %p, module base = %p\n", image_base, image_size, module_base );
if ( !vm::calc_jmp::get( vm_entry, calc_jmp ) )
if ( !image_base || !image_size || !module_base )
{
std::printf( "> failed to get calc_jmp...\n" );
std::printf( "[!] failed to open binary on disk...\n" );
return -1;
}
vm::util::deobfuscate( calc_jmp );
std::printf( "> calc_jmp extracted from vm_entry... calc_jmp:\n" );
std::printf( "==================================================================================\n" );
vm::util::print( calc_jmp );
const auto advancment = vm::calc_jmp::get_advancement( calc_jmp );
std::vector< vm::instrs::code_block_t > code_blocks;
vm::ctx_t vmctx( module_base, image_base, image_size, vm_entry_rva );
if ( !advancment.has_value() )
if ( !vmctx.init() )
{
std::printf( "> failed to determine advancment...\n" );
std::printf( "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is"
"protected with VMProtect 2...\n" );
return -1;
}
std::vector< vmp2::v2::entry_t > entries;
vm::emu_t emu( vm_entry_rva, image_base, module_base );
vm::emu_t emu( &vmctx );
if ( !emu.init() )
{
@ -80,34 +68,57 @@ int __cdecl main( int argc, const char *argv[] )
return -1;
}
if ( !emu.get_trace( entries ) )
if ( !emu.get_trace( code_blocks ) )
std::printf( "[!] something failed during tracing, review the console for more information...\n" );
std::printf( "> creating trace file...\n" );
std::printf( "> finished tracing... number of virtual instructions = %d\n", entries.size() );
std::ofstream output( parser.get< std::string >( "out" ), std::ios::binary );
std::printf( "> number of blocks = %d\n", code_blocks.size() );
for ( auto &code_block : code_blocks )
{
std::printf( "> code block starts at = %p\n", code_block.vip_begin );
std::printf( "> number of virtual instructions = %d\n", code_block.vinstrs.size() );
std::printf( "> does this code block have a jcc? %s\n", code_block.jcc.has_jcc ? "yes" : "no" );
vmp2::v2::file_header file_header;
memcpy( &file_header.magic, "VMP2", sizeof( "VMP2" ) - 1 );
if ( code_block.jcc.has_jcc )
std::printf( "> branch 1 = %p, branch 2 = %p\n", code_block.jcc.block_addr[ 0 ],
code_block.jcc.block_addr[ 1 ] );
}
file_header.epoch_time = time( nullptr );
file_header.entry_offset = sizeof file_header + NT_HEADER( module_base )->OptionalHeader.SizeOfImage;
file_header.entry_count = entries.size();
file_header.advancement = advancment.value();
std::printf( "> serializing results....\n" );
vmp2::v3::file_header file_header;
file_header.magic = VMP_MAGIC;
file_header.epoch_time = std::time( nullptr );
file_header.version = vmp2::version_t::v3;
file_header.module_base = module_base;
file_header.image_base = image_base;
file_header.vm_entry_rva = vm_entry_rva;
file_header.version = vmp2::version_t::v2;
file_header.module_base = module_base;
file_header.module_offset = sizeof file_header;
file_header.module_size = umtils->image_size( parser.get< std::string >( "vmpbin" ).c_str() );
file_header.module_size = image_size;
file_header.code_block_offset = image_size + sizeof file_header;
file_header.code_block_count = code_blocks.size();
std::ofstream output( parser.get< std::string >( "out" ), std::ios::binary );
output.write( reinterpret_cast< const char * >( &file_header ), sizeof file_header );
output.write( reinterpret_cast< const char * >( module_base ), file_header.module_size );
output.write( reinterpret_cast< const char * >( module_base ), image_size );
for ( const auto &code_block : code_blocks )
{
const auto _code_block_size =
( code_block.vinstrs.size() * sizeof vm::instrs::virt_instr_t ) + sizeof vmp2::v3::code_block_t;
vmp2::v3::code_block_t *_code_block =
reinterpret_cast< vmp2::v3::code_block_t * >( malloc( _code_block_size ) );
_code_block->vip_begin = code_block.vip_begin;
_code_block->jcc = code_block.jcc;
_code_block->next_block_offset = _code_block_size;
_code_block->vinstr_count = code_block.vinstrs.size();
for ( auto &entry : entries )
output.write( reinterpret_cast< const char * >( &entry ), sizeof entry );
for ( auto idx = 0u; idx < code_block.vinstrs.size(); ++idx )
_code_block->vinstr[ idx ] = code_block.vinstrs[ idx ];
output.write( reinterpret_cast< const char * >( _code_block ), _code_block_size );
}
output.close();
std::printf( "> finished writing trace to disk...\n" );
std::printf( "> finished..." );
}

167
src/vmemu.vcxproj
Unescape View File

@ -1,167 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<ItemGroup>
<ClCompile Include="main.cpp" />
<ClCompile Include="vmemu_t.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\dependencies\cli-parser\cli-parser.hpp" />
<ClInclude Include="..\dependencies\unicorn\include\list.h" />
<ClInclude Include="..\dependencies\unicorn\include\qemu.h" />
<ClInclude Include="..\dependencies\unicorn\include\uc_priv.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\arm.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\arm64.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\m68k.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\mips.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\platform.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\sparc.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\unicorn.h" />
<ClInclude Include="..\dependencies\unicorn\include\unicorn\x86.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Allocator.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Memory.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Synchronization.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Terminal.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Thread.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\ArgParse.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Bitset.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Comparison.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Defines.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Format.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\LibC.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\List.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Object.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Status.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\String.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Types.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Vector.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Zycore.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Decoder.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\DecoderTypes.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Formatter.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\FormatterBuffer.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumInstructionCategory.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISAExt.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISASet.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumMnemonic.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumRegister.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\DecoderData.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterATT.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterBase.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterIntel.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\SharedData.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\String.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\MetaInfo.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Mnemonic.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Register.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\SharedTypes.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\ShortString.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Status.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Utils.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Zydis.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\ZycoreExportConfig.h" />
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\ZydisExportConfig.h" />
<ClInclude Include="..\dependencies\vmprofiler\include\transform.hpp" />
<ClInclude Include="..\dependencies\vmprofiler\include\vm.h" />
<ClInclude Include="..\dependencies\vmprofiler\include\vmctx.h" />
<ClInclude Include="..\dependencies\vmprofiler\include\vmp2.hpp" />
<ClInclude Include="..\dependencies\vmprofiler\include\vmprofiler.hpp" />
<ClInclude Include="..\dependencies\vmprofiler\include\vmutils.h" />
<ClInclude Include="..\dependencies\xtils\xtils.hpp" />
<ClInclude Include="vmemu_t.hpp" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj">
<Project>{88a23124-5640-35a0-b890-311d7a67a7d2}</Project>
</ProjectReference>
<ProjectReference Include="..\dependencies\vmprofiler\vmprofiler.vcxproj">
<Project>{d0b6092a-9944-4f24-9486-4b7dae372619}</Project>
</ProjectReference>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{f0d51879-e659-4bd3-b688-7864db3c82aa}</ProjectGuid>
<RootNamespace>vmemu</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
<IncludePath>$(ProjectDir)..\dependencies\unicorn\include\;$(ProjectDir)..\dependencies\xtils\;$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(IncludePath)</IncludePath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<IncludePath>$(ProjectDir)..\dependencies\unicorn\include\;$(ProjectDir)..\dependencies\xtils\;$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(IncludePath)</IncludePath>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS;ZYDIS_STATIC_DEFINE</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp17</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(ProjectDir)..\dependencies\unicorn\msvc\x64\Debug\*.lib</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS;ZYDIS_STATIC_DEFINE</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<Optimization>Disabled</Optimization>
<LanguageStandard>stdcpp17</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(ProjectDir)..\dependencies\unicorn\msvc\x64\Release\*.lib</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>

236
src/vmemu.vcxproj.filters
Unescape View File

@ -1,236 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Header Files\unicorn">
<UniqueIdentifier>{77de32f4-945a-4e10-8c7e-8d4fc0f18281}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\unicorn\unicorn">
<UniqueIdentifier>{998a8467-37d9-4471-ab40-0d509dc3dbfa}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zydis">
<UniqueIdentifier>{adfe78f3-ec5d-425e-8b1b-dd17dfd57c84}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zycore">
<UniqueIdentifier>{1eda3b7d-2ed2-4040-9c91-b58057d77405}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zydis\Generated">
<UniqueIdentifier>{5c809a64-905a-4ee0-8865-368e7ec18a57}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zydis\Internal">
<UniqueIdentifier>{bf1dc79d-ada8-4111-9437-aae281640bca}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zycore\API">
<UniqueIdentifier>{64b33419-584c-44cb-9715-1223ce9e8233}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\vmprofiler">
<UniqueIdentifier>{0be483e2-0fd8-460b-a528-418d29f63b25}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="main.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="vmemu_t.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="vmemu_t.hpp">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\list.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\qemu.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\uc_priv.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\arm.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\arm64.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\m68k.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\mips.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\platform.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\sparc.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\unicorn.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\unicorn\include\unicorn\x86.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Memory.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Synchronization.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Terminal.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Thread.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Allocator.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\ArgParse.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Bitset.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Comparison.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Defines.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Format.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\LibC.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\List.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Object.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Status.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\String.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Types.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Vector.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Zycore.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumInstructionCategory.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISAExt.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISASet.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumMnemonic.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumRegister.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\DecoderData.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterATT.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterBase.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterIntel.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\SharedData.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\String.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Decoder.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\DecoderTypes.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Formatter.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\FormatterBuffer.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\MetaInfo.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Mnemonic.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Register.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\SharedTypes.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\ShortString.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Status.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Utils.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\include\Zydis\Zydis.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\transform.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\vm.h">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\vmctx.h">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\vmp2.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\vmprofiler.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\include\vmutils.h">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\cli-parser\cli-parser.hpp">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\ZycoreExportConfig.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\ZydisExportConfig.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="..\dependencies\xtils\xtils.hpp">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>

241
src/vmemu_t.cpp
Unescape View File

@ -2,48 +2,17 @@
namespace vm
{
emu_t::emu_t( std::uint32_t vm_entry_rva, std::uintptr_t image_base, std::uintptr_t module_base )
: module_base( module_base ), image_base( image_base ), vm_entry_rva( vm_entry_rva ),
vm_handler_table( nullptr ), uc( nullptr ), trace_entries( nullptr )
emu_t::emu_t( vm::ctx_t *vmctx ) : uc( nullptr ), vmctx( vmctx )
{
}
bool emu_t::init()
{
// vmprofiler init stuff...
if ( !vm::util::flatten( vm_entry, vm_entry_rva + module_base ) )
{
std::printf( "[!] failed to get vm entry...\n" );
return false;
}
vm::util::deobfuscate( vm_entry );
vm::util::print( vm_entry );
if ( !( vm_handler_table = vm::handler::table::get( vm_entry ) ) )
{
std::printf( "[!] failed to get vm handler table...\n" );
return false;
}
std::printf( "> vm handler table = 0x%p\n", vm_handler_table );
if ( !vm::handler::get_all( module_base, image_base, vm_entry, vm_handler_table, vm_handlers ) )
{
std::printf( "[!] failed to get all vm handlers...\n" );
return false;
}
std::printf( "> got all vm handlers...\n" );
for ( const vm::handler::handler_t &vm_handler : vm_handlers )
std::printf( ">>> handler addr = 0x%p\n", vm_handler.address );
// unicorn init stuff...
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage;
uc_err err;
std::uintptr_t stack_base = 0x1000000;
std::uintptr_t stack_addr = ( stack_base + ( 0x1000 * 20 ) ) - 0x6000;
const auto rip = vmctx->module_base + vmctx->vm_entry_rva;
uc_err err;
if ( ( err = uc_open( UC_ARCH_X86, UC_MODE_64, &uc ) ) )
{
std::printf( "failed on uc_mem_map() with error returned %u: %s\n", err, uc_strerror( err ) );
@ -51,28 +20,29 @@ namespace vm
return false;
}
if ( ( err = uc_mem_map( uc, module_base, image_size, UC_PROT_ALL ) ) )
if ( ( err = uc_mem_map( uc, vmctx->module_base, vmctx->image_size, UC_PROT_ALL ) ) )
{
std::printf( "failed on uc_mem_map() with error returned %u: %s\n", err, uc_strerror( err ) );
return false;
}
if ( ( err = uc_mem_map( uc, 0x1000000, 0x1000 * 20, UC_PROT_ALL ) ) )
if ( ( err = uc_mem_map( uc, UC_STACK_ADDR, sizeof vm::cpu_ctx::stack, UC_PROT_ALL ) ) )
{
std::printf( "failed on uc_mem_map() with error returned %u: %s\n", err, uc_strerror( err ) );
return false;
}
if ( ( err = uc_mem_write( uc, module_base, reinterpret_cast< void * >( module_base ), image_size ) ) )
if ( ( err = uc_mem_write( uc, vmctx->module_base, reinterpret_cast< void * >( vmctx->module_base ),
vmctx->image_size ) ) )
{
std::printf( "failed on uc_mem_write() with error returned %u: %s\n", err, uc_strerror( err ) );
return false;
}
if ( ( err = uc_reg_write( uc, UC_X86_REG_RIP, &vm_entry ) ) )
if ( ( err = uc_reg_write( uc, UC_X86_REG_RIP, &rip ) ) )
{
std::printf( "failed on uc_reg_write() with error returned %u: %s\n", err, uc_strerror( err ) );
@ -86,8 +56,8 @@ namespace vm
return false;
}
if ( ( err = uc_hook_add( uc, &trace, UC_HOOK_CODE, &vm::emu_t::hook_code, this, module_base,
module_base + image_size ) ) )
if ( ( err = uc_hook_add( uc, &trace, UC_HOOK_CODE, &vm::emu_t::hook_code, this, vmctx->module_base,
vmctx->module_base + vmctx->image_size ) ) )
{
std::printf( "failed on uc_hook_add() with error returned %u: %s\n", err, uc_strerror( err ) );
@ -110,18 +80,92 @@ namespace vm
uc_close( uc );
}
bool emu_t::get_trace( std::vector< vmp2::v2::entry_t > &entries )
bool emu_t::get_trace( std::vector< vm::instrs::code_block_t > &entries )
{
// hook_code will fill this vector up with values...
trace_entries = &entries;
uc_err err;
code_blocks.push_back( { vm::instrs::code_block_t{ 0u }, {} } );
if ( ( err = uc_emu_start( uc, vm_entry_rva + module_base, NULL, NULL, NULL ) ) )
if ( ( err = uc_emu_start( uc, vmctx->vm_entry_rva + vmctx->module_base, NULL, NULL, NULL ) ) )
{
std::printf( "failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror( err ) );
return false;
}
static const auto _already_traced = [ & ]( std::uintptr_t code_block_addr ) -> bool {
return std::find_if( code_blocks.begin(), code_blocks.end(), [ & ]( const auto code_block_data ) -> bool {
return code_block_data.first.vip_begin == code_block_addr ||
// sometimes the code block address is displaced by 1... and another byte for the
// opcode...
code_block_data.first.vip_begin == code_block_addr - 2 ||
code_block_data.first.vip_begin == code_block_addr - 1;
} ) != code_blocks.end();
};
static const auto _traced_all_paths =
[ & ]( const std::vector< std::pair< vm::instrs::code_block_t, std::shared_ptr< cpu_ctx > > > &code_blocks )
-> bool {
return std::find_if(
code_blocks.begin(), code_blocks.end(),
[]( const std::pair< vm::instrs::code_block_t, std::shared_ptr< cpu_ctx > > &code_block_data )
-> bool {
return code_block_data.first.jcc.has_jcc &&
( !_already_traced( code_block_data.first.jcc.block_addr[ 0 ] ) ||
!_already_traced( code_block_data.first.jcc.block_addr[ 1 ] ) );
} ) == code_blocks.end();
};
static const auto _trace_branch = [ & ]( vm::instrs::code_block_t &code_block,
std::shared_ptr< cpu_ctx > &context,
std::uintptr_t branch_addr ) -> bool {
if ( !context )
return {};
// restore context to virtual jmp... changing branch...
uc_context_restore( uc, context->context );
// restore entire stack....
uc_mem_write( uc, UC_STACK_ADDR, context->stack, sizeof vm::cpu_ctx::stack );
std::uintptr_t rip = 0u;
uc_reg_read( uc, UC_X86_REG_RIP, &rip );
// change the top qword on the stack to the branch rva...
// the rva is image base'ed and only the bottom 32bits...
std::uintptr_t branch_rva = ( ( branch_addr - vmctx->module_base ) + vmctx->image_base ) & 0xFFFFFFFFull;
uc_mem_write( uc, code_block.vinstrs.back().trace_data.regs.rbp, &branch_rva, sizeof branch_rva );
code_blocks.push_back( { vm::instrs::code_block_t{ 0u }, {} } );
skip_current_jmp = true;
if ( ( err = uc_emu_start( uc, rip, NULL, NULL, NULL ) ) )
{
std::printf( "failed on uc_emu_start() with error returned %u: %s\n", err, uc_strerror( err ) );
return false;
}
return true;
};
while ( !_traced_all_paths( code_blocks ) )
{
for ( auto &[ code_block, uc_code_block_context ] : code_blocks )
{
if ( code_block.jcc.has_jcc )
{
if ( !_already_traced( code_block.jcc.block_addr[ 0 ] ) )
_trace_branch( code_block, uc_code_block_context, code_block.jcc.block_addr[ 0 ] );
if ( !_already_traced( code_block.jcc.block_addr[ 1 ] ) )
_trace_branch( code_block, uc_code_block_context, code_block.jcc.block_addr[ 1 ] );
}
}
}
for ( auto &[ code_block, uc_code_block_context ] : code_blocks )
entries.push_back( code_block );
return true;
}
@ -165,38 +209,35 @@ namespace vm
{
std::printf( ">>> Tracing instruction at 0x%p, instruction size = 0x%x\n", address, size );
// bad code... but i need to skip JMP instructions when tracing branches since i save context
// on the jmp instruction... so it needs to be skipped...
if ( obj->skip_current_jmp )
{
obj->skip_current_jmp = false;
return;
}
// grab JMP RDX/RCX <-- this register...
static const auto jmp_reg = obj->vm_entry[ obj->vm_entry.size() ].instr.operands[ 0 ].reg.value;
static const auto jmp_reg = obj->vmctx->vm_entry[ obj->vmctx->vm_entry.size() ].instr.operands[ 0 ].reg.value;
static ZydisDecoder decoder;
static std::once_flag once;
static ZydisDecodedInstruction instr;
static std::uintptr_t reg_val = 0u;
// init zydis decoder just a single time...
std::call_once( once, [ & ]() -> void {
// init zydis decoder only a single time...
if ( static std::atomic< bool > once = true; once.exchange( false ) )
ZydisDecoderInit( &decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64 );
} );
// last instruction in vm_entry is jmp rcx/rdx...
if ( address == obj->vm_entry[ obj->vm_entry.size() - 1 ].addr )
{
uc_err err;
vmp2::v2::entry_t new_entry;
if ( ( err = obj->create_entry( &new_entry ) ) )
{
std::printf( "[!] failed to create new entry... reason = %u, %s\n", err, uc_strerror( err ) );
exit( 0 );
}
obj->trace_entries->push_back( new_entry );
}
// if we are getting a callback for a JMP RCX/RDX instruction...
else if ( ZYAN_SUCCESS(
if ( ZYAN_SUCCESS(
ZydisDecoderDecodeBuffer( &decoder, reinterpret_cast< void * >( address ), size, &instr ) ) &&
instr.mnemonic == ZYDIS_MNEMONIC_JMP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == jmp_reg )
{
uc_err err;
vmp2::v2::entry_t new_entry;
std::optional< vm::instrs::virt_instr_t > virt_instr;
vm::handler::profile_t *vm_handler_profile = nullptr;
switch ( jmp_reg )
{
case ZYDIS_REGISTER_RDX:
@ -216,22 +257,84 @@ namespace vm
return vm_handler.address == reg_val;
};
if ( std::find_if( obj->vm_handlers.begin(), obj->vm_handlers.end(), vm_handler_check ) ==
obj->vm_handlers.end() )
if ( std::find_if( obj->vmctx->vm_handlers.begin(), obj->vmctx->vm_handlers.end(), vm_handler_check ) ==
obj->vmctx->vm_handlers.end() )
return;
uc_err err;
vmp2::v2::entry_t new_entry;
if ( ( err = obj->create_entry( &new_entry ) ) )
{
std::printf( "[!] failed to create new entry... reason = %u, %s\n", err, uc_strerror( err ) );
exit( 0 );
}
obj->trace_entries->push_back( new_entry );
if ( !obj->code_blocks.back().first.vip_begin )
// -1 because the first byte is the opcode...
obj->code_blocks.back().first.vip_begin = new_entry.vip - 1;
if ( virt_instr = vm::instrs::get( *obj->vmctx, new_entry ); !virt_instr.has_value() )
{
std::printf( "[!] failed to create vm::instrs::virt_instr_t...\n" );
exit( 0 );
}
obj->code_blocks.back().first.vinstrs.push_back( virt_instr.value() );
// if there is a virtual JMP instruction then we need to grab jcc data for the current code_block_t
// and then create a new code_block_t...
if ( ( vm_handler_profile = obj->vmctx->vm_handlers[ new_entry.handler_idx ].profile ) &&
vm_handler_profile->mnemonic == vm::handler::mnemonic_t::JMP )
{
const auto code_block_address = vm::instrs::code_block_addr( *obj->vmctx, new_entry );
auto jcc = vm::instrs::get_jcc_data( *obj->vmctx, obj->code_blocks.back().first );
if ( jcc.has_value() )
obj->code_blocks.back().first.jcc = jcc.value();
// save cpu state as well as stack...
obj->code_blocks.back().second = std::make_shared< cpu_ctx >();
if ( ( err = uc_context_alloc( uc, &obj->code_blocks.back().second->context ) ) )
{
std::printf( "[!] failed to allocate context space...\n" );
exit( 0 );
}
if ( ( err = uc_context_save( uc, obj->code_blocks.back().second->context ) ) )
{
std::printf( "[!] failed to save cpu context...\n" );
exit( 0 );
}
if ( ( err = uc_mem_read( uc, UC_STACK_ADDR, obj->code_blocks.back().second->stack,
sizeof vm::cpu_ctx::stack ) ) )
{
std::printf( "[!] failed to read stack into backup buffer...\n" );
exit( 0 );
}
// if the next code block has already been traced then stop emulation...
if ( auto already_traced = std::find_if( obj->code_blocks.begin(), obj->code_blocks.end(),
[ & ]( const auto &code_block_data ) -> bool {
return code_block_data.first.vip_begin ==
code_block_address;
} );
already_traced != obj->code_blocks.end() )
{
uc_emu_stop( uc );
}
else // else set the next code block up...
{
obj->code_blocks.push_back( { vm::instrs::code_block_t{ 0u }, {} } );
}
}
}
else if ( instr.mnemonic == ZYDIS_MNEMONIC_RET ) // finish tracing...
{
uc_emu_stop( uc );
// vmexit's cannot have a branch...
obj->code_blocks.back().first.jcc.has_jcc = false;
}
}
bool emu_t::hook_mem_invalid( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value,

22
src/vmemu_t.hpp
Unescape View File

@ -9,18 +9,26 @@
#include <vmprofiler.hpp>
#include <xtils.hpp>
#define UC_STACK_ADDR 0x1000000
namespace vm
{
struct cpu_ctx
{
uc_context *context;
std::uint8_t stack[ PAGE_4K * 20 ];
};
class emu_t
{
using callback_t = std::function< void( uc_engine *, uint64_t, uint32_t, void * ) >;
public:
explicit emu_t( std::uint32_t vm_entry_rva, std::uintptr_t image_base, std::uintptr_t module_base );
explicit emu_t( vm::ctx_t *vmctx );
~emu_t();
bool init();
bool get_trace( std::vector< vmp2::v2::entry_t > &entries );
bool get_trace( std::vector< vm::instrs::code_block_t > &entries );
private:
uc_err create_entry( vmp2::v2::entry_t *entry );
@ -31,12 +39,8 @@ namespace vm
uc_engine *uc;
uc_hook trace, trace1;
std::uintptr_t image_base, module_base;
std::uint32_t vm_entry_rva;
zydis_routine_t vm_entry;
std::uintptr_t *vm_handler_table;
std::vector< vm::handler::handler_t > vm_handlers;
std::vector< vmp2::v2::entry_t > *trace_entries;
bool skip_current_jmp;
vm::ctx_t *vmctx;
std::vector< std::pair< vm::instrs::code_block_t, std::shared_ptr<cpu_ctx> > > code_blocks;
};
} // namespace vm

103
vmemu.sln
Unescape View File

@ -3,12 +3,12 @@ Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.30907.101
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "vmemu", "src\vmemu.vcxproj", "{F0D51879-E659-4BD3-B688-7864DB3C82AA}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Zydis", "dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj", "{88A23124-5640-35A0-B890-311D7A67A7D2}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "vmprofiler", "dependencies\vmprofiler\vmprofiler.vcxproj", "{D0B6092A-9944-4F24-9486-4B7DAE372619}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "vmemu", "vmemu.vcxproj", "{F0D51879-E659-4BD3-B688-7864DB3C82AA}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
DBG|x64 = DBG|x64
@ -39,55 +39,6 @@ Global
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x86.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x86.ActiveCfg = Release|x64
{88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.ActiveCfg = Debug MT|x64
{88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.Build.0 = Debug MT|x64
{88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x86.ActiveCfg = Debug MT|Win32
@ -194,6 +145,56 @@ Global
{D0B6092A-9944-4F24-9486-4B7DAE372619}.Release|x64.ActiveCfg = Release|x64
{D0B6092A-9944-4F24-9486-4B7DAE372619}.Release|x64.Build.0 = Release|x64
{D0B6092A-9944-4F24-9486-4B7DAE372619}.Release|x86.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.DBG|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug Kernel|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD DLL|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MD|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT DLL|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug MT|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x64.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x64.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Debug|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release Kernel|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD DLL|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MD|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT DLL|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x86.ActiveCfg = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release MT|x86.Build.0 = Debug|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x64.ActiveCfg = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x64.Build.0 = Release|x64
{F0D51879-E659-4BD3-B688-7864DB3C82AA}.Release|x86.ActiveCfg = Release|x64
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE

164
vmemu.vcxproj
Unescape View File

@ -0,0 +1,164 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<ItemGroup>
<ClCompile Include="src\main.cpp" />
<ClCompile Include="src\vmemu_t.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="dependencies\unicorn\include\list.h" />
<ClInclude Include="dependencies\unicorn\include\qemu.h" />
<ClInclude Include="dependencies\unicorn\include\uc_priv.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\arm.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\arm64.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\m68k.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\mips.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\platform.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\sparc.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\unicorn.h" />
<ClInclude Include="dependencies\unicorn\include\unicorn\x86.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Allocator.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Memory.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Synchronization.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Terminal.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Thread.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\ArgParse.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Bitset.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Comparison.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Defines.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Format.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\LibC.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\List.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Object.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Status.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\String.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Types.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Vector.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Zycore.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Decoder.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\DecoderTypes.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Formatter.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\FormatterBuffer.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumInstructionCategory.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISAExt.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISASet.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumMnemonic.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumRegister.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\DecoderData.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterATT.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterBase.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterIntel.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\SharedData.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\String.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\MetaInfo.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Mnemonic.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Register.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\SharedTypes.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\ShortString.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Status.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Utils.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Zydis.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\msvc\ZycoreExportConfig.h" />
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\msvc\ZydisExportConfig.h" />
<ClInclude Include="dependencies\vmprofiler\include\transform.hpp" />
<ClInclude Include="dependencies\vmprofiler\include\vmp2.hpp" />
<ClInclude Include="dependencies\vmprofiler\include\vmprofiler.hpp" />
<ClInclude Include="dependencies\vmprofiler\include\vmutils.h" />
<ClInclude Include="dependencies\xtils\xtils.hpp" />
<ClInclude Include="src\vmemu_t.hpp" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj">
<Project>{88a23124-5640-35a0-b890-311d7a67a7d2}</Project>
</ProjectReference>
<ProjectReference Include="dependencies\vmprofiler\vmprofiler.vcxproj">
<Project>{d0b6092a-9944-4f24-9486-4b7dae372619}</Project>
</ProjectReference>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{f0d51879-e659-4bd3-b688-7864db3c82aa}</ProjectGuid>
<RootNamespace>vmemu</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
<IncludePath>$(ProjectDir)dependencies\unicorn\include\;$(ProjectDir)dependencies\xtils\;$(ProjectDir)dependencies\vmprofiler\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\msvc;$(IncludePath)</IncludePath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<IncludePath>$(ProjectDir)dependencies\unicorn\include\;$(ProjectDir)dependencies\xtils\;$(ProjectDir)dependencies\vmprofiler\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)dependencies\vmprofiler\dependencies\zydis\msvc;$(IncludePath)</IncludePath>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS;ZYDIS_STATIC_DEFINE</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp17</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(ProjectDir)dependencies\unicorn\msvc\x64\Debug\*.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS;ZYDIS_STATIC_DEFINE</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<Optimization>Disabled</Optimization>
<LanguageStandard>stdcpp17</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(ProjectDir)dependencies\unicorn\msvc\x64\Release\*.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>

230
vmemu.vcxproj.filters
Unescape View File

@ -0,0 +1,230 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Header Files\Zydis">
<UniqueIdentifier>{0e65ecf2-7cf9-449e-ac20-f6f27fa629c0}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zydis\Internal">
<UniqueIdentifier>{259313a0-e773-46e6-9960-61605385a4ac}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zydis\Generated">
<UniqueIdentifier>{08d401b5-5aae-4d6a-a074-a4777c64db3c}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zycore">
<UniqueIdentifier>{9daf9cd5-9ffb-44d5-9bc4-18d289129a5e}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\Zycore\API">
<UniqueIdentifier>{b36cf687-0a35-4dcc-8593-e6f065702197}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\unicorn">
<UniqueIdentifier>{f99ac6e7-b1d9-4877-a45b-12e422ea2003}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\unicorn\unicorn">
<UniqueIdentifier>{dbddce53-e0ac-4b58-b5c9-3e3325ef5d43}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\xtils">
<UniqueIdentifier>{19233bd7-fbee-4047-aedc-e2352cd634cb}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\vmprofiler">
<UniqueIdentifier>{084b3477-86b1-4088-82a3-d67a0d5f017d}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="src\main.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="src\vmemu_t.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="src\vmemu_t.hpp">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\DecoderData.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterATT.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterBase.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\FormatterIntel.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\SharedData.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Internal\String.h">
<Filter>Header Files\Zydis\Internal</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumInstructionCategory.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISAExt.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumISASet.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumMnemonic.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Generated\EnumRegister.h">
<Filter>Header Files\Zydis\Generated</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Decoder.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\DecoderTypes.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Formatter.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\FormatterBuffer.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\MetaInfo.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Mnemonic.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Register.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\SharedTypes.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\ShortString.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Status.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Utils.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\include\Zydis\Zydis.h">
<Filter>Header Files\Zydis</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Memory.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Synchronization.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Terminal.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\API\Thread.h">
<Filter>Header Files\Zycore\API</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Allocator.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\ArgParse.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Bitset.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Comparison.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Defines.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Format.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\LibC.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\List.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Object.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Status.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\String.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Types.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Vector.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include\Zycore\Zycore.h">
<Filter>Header Files\Zycore</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\list.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\qemu.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\uc_priv.h">
<Filter>Header Files\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\arm.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\arm64.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\m68k.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\mips.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\platform.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\sparc.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\unicorn.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\unicorn\include\unicorn\x86.h">
<Filter>Header Files\unicorn\unicorn</Filter>
</ClInclude>
<ClInclude Include="dependencies\xtils\xtils.hpp">
<Filter>Header Files\xtils</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\include\transform.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\include\vmp2.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\include\vmprofiler.hpp">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\include\vmutils.h">
<Filter>Header Files\vmprofiler</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\msvc\ZycoreExportConfig.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="dependencies\vmprofiler\dependencies\zydis\msvc\ZydisExportConfig.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
Write Preview
Loading…
Cancel
Save