vmp2
/
vmemu
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fixed an issue with the unpacker

Browse Source
master
_xeroxz 3 years ago
parent baf6e2d80d
commit c636737116
6 changed files with 250 additions and 204 deletions
Show Stats Download Patch File Download Diff File

16
.clang-format
Unescape View File

@ -1,18 +1,4 @@
--- ---
BasedOnStyle: Microsoft BasedOnStyle: Chromium
AlignAfterOpenBracket: Align
AllowAllArgumentsOnNextLine: 'true'
AllowAllParametersOfDeclarationOnNextLine: 'true'
AllowShortIfStatementsOnASingleLine: Never
BreakBeforeBraces: Allman
IndentWidth: '4'
Language: Cpp
NamespaceIndentation: All
SpacesInAngles: 'true'
SpacesInCStyleCastParentheses: 'true'
SpacesInContainerLiterals: 'true'
SpacesInParentheses: 'true'
SpacesInSquareBrackets: 'true'
UseTab: Never
... ...

82
include/unpacker.hpp
Unescape View File

@ -32,6 +32,8 @@
#define UNMAP_VIEW_OF_FILE_VECTOR 11 #define UNMAP_VIEW_OF_FILE_VECTOR 11
#define CLOSE_HANDLE_VECTOR 12 #define CLOSE_HANDLE_VECTOR 12
#define VIRTUAL_PROTECT_VECTOR 13 #define VIRTUAL_PROTECT_VECTOR 13
#define IS_DEBUGGER_PRESENT_VECTOR 14
#define IS_REMOTE_DEBUGGER_PRESENT_VECTOR 15
#define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00" #define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00"
#define MOV_RAX_0_MASK "xxxxxxxxxx" #define MOV_RAX_0_MASK "xxxxxxxxxx"
@ -42,48 +44,58 @@ static_assert(sizeof MOV_RAX_0_SIG == sizeof MOV_RAX_0_MASK,
namespace engine { namespace engine {
class unpack_t { class unpack_t {
public: public:
explicit unpack_t(const std::string &module_name, explicit unpack_t(const std::string& module_name,
const std::vector<std::uint8_t> &bin); const std::vector<std::uint8_t>& bin);
~unpack_t(void); ~unpack_t(void);
bool init(void); bool init(void);
bool unpack(std::vector<std::uint8_t> &output); bool unpack(std::vector<std::uint8_t>& output);
private: private:
using iat_hook_t = std::function<void(uc_engine *, unpack_t *)>; using iat_hook_t = std::function<void(uc_engine*, unpack_t*)>;
uc_engine *uc_ctx; uc_engine* uc_ctx;
std::vector<uint8_t> bin, map_bin; std::vector<uint8_t> bin, map_bin;
std::vector<uc_hook *> uc_hooks; std::vector<uc_hook*> uc_hooks;
std::string module_name; std::string module_name;
std::uintptr_t img_base, img_size, heap_offset, pack_section_offset; std::uintptr_t img_base, img_size, heap_offset, pack_section_offset;
win::image_t<> *win_img; win::image_t<>* win_img;
static void local_alloc_hook(uc_engine *, unpack_t *); static void local_alloc_hook(uc_engine*, unpack_t*);
static void local_free_hook(uc_engine *, unpack_t *); static void local_free_hook(uc_engine*, unpack_t*);
static void load_library_hook(uc_engine *, unpack_t *); static void load_library_hook(uc_engine*, unpack_t*);
static void get_module_file_name_w_hook(uc_engine *, unpack_t *); static void get_module_file_name_w_hook(uc_engine*, unpack_t*);
static void create_file_w_hook(uc_engine *, unpack_t *); static void create_file_w_hook(uc_engine*, unpack_t*);
static void get_file_size_hook(uc_engine *, unpack_t *); static void get_file_size_hook(uc_engine*, unpack_t*);
static void create_file_mapping_hook(uc_engine *, unpack_t *); static void create_file_mapping_hook(uc_engine*, unpack_t*);
static void map_view_of_file_hook(uc_engine *, unpack_t *); static void map_view_of_file_hook(uc_engine*, unpack_t*);
static void unmap_view_of_file_hook(uc_engine *, unpack_t *); static void unmap_view_of_file_hook(uc_engine*, unpack_t*);
static void close_handle_hook(uc_engine *, unpack_t *); static void close_handle_hook(uc_engine*, unpack_t*);
static void virtual_protect_hook(uc_engine *, unpack_t *); static void virtual_protect_hook(uc_engine*, unpack_t*);
static void is_debugger_present_hook(uc_engine*, unpack_t*);
static void uc_strcpy(uc_engine *uc, char *buff, std::uintptr_t addr);
static void uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff); static void uc_strcpy(uc_engine* uc, char* buff, std::uintptr_t addr);
static void uc_strcpy(uc_engine* uc, std::uintptr_t addr, char* buff);
static bool iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size,
unpack_t *unpack); static bool iat_dispatcher(uc_engine* uc,
uint64_t address,
static bool unpack_section_callback(uc_engine *uc, uc_mem_type type, uint32_t size,
uint64_t address, int size, int64_t value, unpack_t* unpack);
unpack_t *unpack);
static bool unpack_section_callback(uc_engine* uc,
static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address, uc_mem_type type,
int size, int64_t value, unpack_t *unpack); uint64_t address,
int size,
int64_t value,
unpack_t* unpack);
static void invalid_mem(uc_engine* uc,
uc_mem_type type,
uint64_t address,
int size,
int64_t value,
unpack_t* unpack);
std::map<std::string, std::uintptr_t> loaded_modules; std::map<std::string, std::uintptr_t> loaded_modules;
std::map<std::string, std::pair<std::uint32_t, iat_hook_t> > iat_hooks = { std::map<std::string, std::pair<std::uint32_t, iat_hook_t> > iat_hooks = {
@ -100,6 +112,10 @@ class unpack_t {
{"UnmapViewOfFile", {"UnmapViewOfFile",
{UNMAP_VIEW_OF_FILE_VECTOR, &unmap_view_of_file_hook}}, {UNMAP_VIEW_OF_FILE_VECTOR, &unmap_view_of_file_hook}},
{"CloseHandle", {CLOSE_HANDLE_VECTOR, &close_handle_hook}}, {"CloseHandle", {CLOSE_HANDLE_VECTOR, &close_handle_hook}},
{"VirtualProtect", {VIRTUAL_PROTECT_VECTOR, &virtual_protect_hook}}}; {"VirtualProtect", {VIRTUAL_PROTECT_VECTOR, &virtual_protect_hook}},
{"IsDebuggerPresent",
{IS_DEBUGGER_PRESENT_VECTOR, &is_debugger_present_hook}},
{"CheckRemoteDebuggerPresent",
{IS_REMOTE_DEBUGGER_PRESENT_VECTOR, &is_debugger_present_hook}}};
}; };
} // namespace engine } // namespace engine

31
include/vmemu_t.hpp
Unescape View File

@ -17,7 +17,7 @@ inline bool g_force_emu = false;
class emu_t { class emu_t {
struct cpu_ctx_t { struct cpu_ctx_t {
std::uintptr_t rip; std::uintptr_t rip;
uc_context *context; uc_context* context;
std::uint8_t stack[STACK_SIZE]; std::uint8_t stack[STACK_SIZE];
}; };
@ -28,29 +28,36 @@ class emu_t {
}; };
public: public:
explicit emu_t(vm::ctx_t *vm_ctx); explicit emu_t(vm::ctx_t* vm_ctx);
~emu_t(); ~emu_t();
bool init(); bool init();
bool get_trace(std::vector<vm::instrs::code_block_t> &code_blocks); bool get_trace(std::vector<vm::instrs::code_block_t>& code_blocks);
private: private:
std::uintptr_t img_base, img_size; std::uintptr_t img_base, img_size;
uc_hook code_exec_hook, invalid_mem_hook, int_hook; uc_hook code_exec_hook, invalid_mem_hook, int_hook;
uc_engine *uc_ctx; uc_engine* uc_ctx;
vm::ctx_t *g_vm_ctx; vm::ctx_t* g_vm_ctx;
code_block_data_t *cc_block; code_block_data_t* cc_block;
std::vector<std::uintptr_t> vip_begins; std::vector<std::uintptr_t> vip_begins;
std::vector<code_block_data_t> code_blocks; std::vector<code_block_data_t> code_blocks;
std::map<std::uintptr_t, std::shared_ptr<vm::ctx_t> > vm_ctxs; std::map<std::uintptr_t, std::shared_ptr<vm::ctx_t> > vm_ctxs;
uc_err create_entry(vmp2::v2::entry_t *entry); uc_err create_entry(vmp2::v2::entry_t* entry);
static void int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj); static void int_callback(uc_engine* uc, std::uint32_t intno, emu_t* obj);
static bool code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size, static bool code_exec_callback(uc_engine* uc,
emu_t *obj); uint64_t address,
static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address, uint32_t size,
int size, int64_t value, emu_t *obj); emu_t* obj);
static void invalid_mem(uc_engine* uc,
uc_mem_type type,
uint64_t address,
int size,
int64_t value,
emu_t* obj);
}; };
} // namespace vm } // namespace vm

77
src/main.cpp
Unescape View File

@ -8,7 +8,7 @@
#define NUM_THREADS 20 #define NUM_THREADS 20
int __cdecl main(int argc, const char *argv[]) { int __cdecl main(int argc, const char* argv[]) {
argparse::argument_parser_t parser("VMEmu", argparse::argument_parser_t parser("VMEmu",
"VMProtect 2 VM Handler Emulator"); "VMProtect 2 VM Handler Emulator");
parser.add_argument() parser.add_argument()
@ -56,7 +56,7 @@ int __cdecl main(int argc, const char *argv[]) {
return -1; return -1;
} }
auto img = reinterpret_cast<win::image_t<> *>(module_data.data()); auto img = reinterpret_cast<win::image_t<>*>(module_data.data());
auto image_size = img->get_nt_headers()->optional_header.size_image; auto image_size = img->get_nt_headers()->optional_header.size_image;
const auto image_base = img->get_nt_headers()->optional_header.image_base; const auto image_base = img->get_nt_headers()->optional_header.image_base;
@ -66,34 +66,34 @@ int __cdecl main(int argc, const char *argv[]) {
reinterpret_cast<std::uintptr_t>(tmp.data()) + reinterpret_cast<std::uintptr_t>(tmp.data()) +
(PAGE_4KB - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull)); (PAGE_4KB - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull));
std::memcpy((void *)module_base, module_data.data(), 0x1000); std::memcpy((void*)module_base, module_data.data(), 0x1000);
std::for_each(img->get_nt_headers()->get_sections(), std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() + img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections, img->get_nt_headers()->file_header.num_sections,
[&](const auto &section_header) { [&](const auto& section_header) {
std::memcpy( std::memcpy(
(void *)(module_base + section_header.virtual_address), (void*)(module_base + section_header.virtual_address),
module_data.data() + section_header.ptr_raw_data, module_data.data() + section_header.ptr_raw_data,
section_header.size_raw_data); section_header.size_raw_data);
}); });
auto win_img = reinterpret_cast<win::image_t<> *>(module_base); auto win_img = reinterpret_cast<win::image_t<>*>(module_base);
auto basereloc_dir = auto basereloc_dir =
win_img->get_directory(win::directory_id::directory_entry_basereloc); win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>( auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
basereloc_dir->rva + module_base); basereloc_dir->rva + module_base);
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t* reloc_block = &reloc_dir->first_block;
// apply relocations to all sections... // apply relocations to all sections...
while (reloc_block->base_rva && reloc_block->size_block) { while (reloc_block->base_rva && reloc_block->size_block) {
std::for_each(reloc_block->begin(), reloc_block->end(), std::for_each(reloc_block->begin(), reloc_block->end(),
[&](win::reloc_entry_t &entry) { [&](win::reloc_entry_t& entry) {
switch (entry.type) { switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: { case win::reloc_type_id::rel_based_dir64: {
auto reloc_at = reinterpret_cast<std::uintptr_t *>( auto reloc_at = reinterpret_cast<std::uintptr_t*>(
entry.offset + reloc_block->base_rva + module_base); entry.offset + reloc_block->base_rva + module_base);
*reloc_at = module_base + ((*reloc_at) - image_base); *reloc_at = module_base + ((*reloc_at) - image_base);
break; break;
@ -145,7 +145,7 @@ int __cdecl main(int argc, const char *argv[]) {
} }
std::printf("> number of blocks = %d\n", code_blocks.size()); std::printf("> number of blocks = %d\n", code_blocks.size());
for (auto &code_block : code_blocks) { for (auto& code_block : code_blocks) {
std::printf("> code block starts at = %p\n", code_block.vip_begin); std::printf("> code block starts at = %p\n", code_block.vip_begin);
std::printf("> number of virtual instructions = %d\n", std::printf("> number of virtual instructions = %d\n",
code_block.vinstrs.size()); code_block.vinstrs.size());
@ -190,19 +190,19 @@ int __cdecl main(int argc, const char *argv[]) {
vmp2::v4::rtn_t rtn; vmp2::v4::rtn_t rtn;
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write(reinterpret_cast<const char *>(&file_header), output.write(reinterpret_cast<const char*>(&file_header),
sizeof file_header); sizeof file_header);
output.write(reinterpret_cast<const char *>(module_base), image_size); output.write(reinterpret_cast<const char*>(module_base), image_size);
std::vector<vmp2::v4::code_block_t *> vmp2_blocks; std::vector<vmp2::v4::code_block_t*> vmp2_blocks;
for (const auto &code_block : code_blocks) { for (const auto& code_block : code_blocks) {
const auto _code_block_size = const auto _code_block_size =
sizeof(vmp2::v4::code_block_t) + sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8) + (code_block.jcc.block_addr.size() * 8) +
code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t); code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
vmp2::v4::code_block_t *_code_block = vmp2::v4::code_block_t* _code_block =
reinterpret_cast<vmp2::v4::code_block_t *>(malloc(_code_block_size)); reinterpret_cast<vmp2::v4::code_block_t*>(malloc(_code_block_size));
// serialize block meta data... // serialize block meta data...
_code_block->vip_begin = code_block.vip_begin; _code_block->vip_begin = code_block.vip_begin;
@ -216,7 +216,7 @@ int __cdecl main(int argc, const char *argv[]) {
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx) for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
_code_block->branch_addr[idx] = code_block.jcc.block_addr[idx]; _code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>( auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t*>(
reinterpret_cast<std::uintptr_t>(_code_block) + reinterpret_cast<std::uintptr_t>(_code_block) +
sizeof(vmp2::v4::code_block_t) + sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8)); (code_block.jcc.block_addr.size() * 8));
@ -232,7 +232,7 @@ int __cdecl main(int argc, const char *argv[]) {
sizeof(vmp2::v4::rtn_t::vm_enter_offset); sizeof(vmp2::v4::rtn_t::vm_enter_offset);
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(), std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void { [&](vmp2::v4::code_block_t* vmp2_block) -> void {
code_blocks_size += vmp2_block->next_block_offset; code_blocks_size += vmp2_block->next_block_offset;
}); });
@ -240,14 +240,14 @@ int __cdecl main(int argc, const char *argv[]) {
rtn.code_block_count = vmp2_blocks.size(); rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_entry_rva; rtn.vm_enter_offset = vm_entry_rva;
output.write(reinterpret_cast<const char *>(&rtn), output.write(reinterpret_cast<const char*>(&rtn),
sizeof(vmp2::v4::rtn_t::size) + sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) + sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset)); sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(), std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void { [&](vmp2::v4::code_block_t* vmp2_block) -> void {
output.write(reinterpret_cast<const char *>(vmp2_block), output.write(reinterpret_cast<const char*>(vmp2_block),
vmp2_block->next_block_offset); vmp2_block->next_block_offset);
free(vmp2_block); free(vmp2_block);
}); });
@ -269,7 +269,7 @@ int __cdecl main(int argc, const char *argv[]) {
parser.get<std::string>("out").c_str()); parser.get<std::string>("out").c_str());
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write(reinterpret_cast<char *>(unpacked_bin.data()), output.write(reinterpret_cast<char*>(unpacked_bin.data()),
unpacked_bin.size()); unpacked_bin.size());
output.close(); output.close();
@ -281,10 +281,10 @@ int __cdecl main(int argc, const char *argv[]) {
virt_rtns; virt_rtns;
std::vector<std::thread> threads; std::vector<std::thread> threads;
for (const auto &[vm_enter_offset, encrypted_rva, hndlr_tble] : entries) { for (const auto& [vm_enter_offset, encrypted_rva, hndlr_tble] : entries) {
if (threads.size() == NUM_THREADS) { if (threads.size() == NUM_THREADS) {
std::for_each(threads.begin(), threads.end(), std::for_each(threads.begin(), threads.end(),
[&](std::thread &t) { t.join(); }); [&](std::thread& t) { t.join(); });
threads.clear(); threads.clear();
} }
@ -328,7 +328,7 @@ int __cdecl main(int argc, const char *argv[]) {
} }
std::for_each(threads.begin(), threads.end(), std::for_each(threads.begin(), threads.end(),
[&](std::thread &t) { t.join(); }); [&](std::thread& t) { t.join(); });
std::printf("> traced %d virtual routines...\n", virt_rtns.size()); std::printf("> traced %d virtual routines...\n", virt_rtns.size());
std::printf("> serializing results....\n"); std::printf("> serializing results....\n");
@ -346,23 +346,22 @@ int __cdecl main(int argc, const char *argv[]) {
file_header.rtn_offset = image_size + sizeof file_header; file_header.rtn_offset = image_size + sizeof file_header;
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write(reinterpret_cast<const char *>(&file_header), output.write(reinterpret_cast<const char*>(&file_header),
sizeof file_header); sizeof file_header);
output.write(reinterpret_cast<const char *>(module_base), image_size); output.write(reinterpret_cast<const char*>(module_base), image_size);
for (auto &[vm_enter_offset, virt_rtn] : virt_rtns) { for (auto& [vm_enter_offset, virt_rtn] : virt_rtns) {
vmp2::v4::rtn_t rtn{(u32)virt_rtn.size()}; vmp2::v4::rtn_t rtn{(u32)virt_rtn.size()};
std::vector<vmp2::v4::code_block_t *> vmp2_blocks; std::vector<vmp2::v4::code_block_t*> vmp2_blocks;
for (const auto &code_block : virt_rtn) { for (const auto& code_block : virt_rtn) {
const auto _code_block_size = const auto _code_block_size =
sizeof(vmp2::v4::code_block_t) + sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8) + (code_block.jcc.block_addr.size() * 8) +
code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t); code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
vmp2::v4::code_block_t *_code_block = vmp2::v4::code_block_t* _code_block =
reinterpret_cast<vmp2::v4::code_block_t *>( reinterpret_cast<vmp2::v4::code_block_t*>(malloc(_code_block_size));
malloc(_code_block_size));
// serialize block meta data... // serialize block meta data...
_code_block->vip_begin = code_block.vip_begin; _code_block->vip_begin = code_block.vip_begin;
@ -376,7 +375,7 @@ int __cdecl main(int argc, const char *argv[]) {
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx) for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
_code_block->branch_addr[idx] = code_block.jcc.block_addr[idx]; _code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>( auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t*>(
reinterpret_cast<std::uintptr_t>(_code_block) + reinterpret_cast<std::uintptr_t>(_code_block) +
sizeof(vmp2::v4::code_block_t) + sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8)); (code_block.jcc.block_addr.size() * 8));
@ -392,7 +391,7 @@ int __cdecl main(int argc, const char *argv[]) {
sizeof(vmp2::v4::rtn_t::code_block_count); sizeof(vmp2::v4::rtn_t::code_block_count);
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(), std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void { [&](vmp2::v4::code_block_t* vmp2_block) -> void {
code_blocks_size += vmp2_block->next_block_offset; code_blocks_size += vmp2_block->next_block_offset;
}); });
@ -400,14 +399,14 @@ int __cdecl main(int argc, const char *argv[]) {
rtn.code_block_count = vmp2_blocks.size(); rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_enter_offset; rtn.vm_enter_offset = vm_enter_offset;
output.write(reinterpret_cast<const char *>(&rtn), output.write(reinterpret_cast<const char*>(&rtn),
sizeof(vmp2::v4::rtn_t::size) + sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) + sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset)); sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(), std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void { [&](vmp2::v4::code_block_t* vmp2_block) -> void {
output.write(reinterpret_cast<const char *>(vmp2_block), output.write(reinterpret_cast<const char*>(vmp2_block),
vmp2_block->next_block_offset); vmp2_block->next_block_offset);
free(vmp2_block); free(vmp2_block);
}); });

186
src/unpacker.cpp
Unescape View File

@ -1,24 +1,26 @@
#include <unpacker.hpp> #include <unpacker.hpp>
namespace engine { namespace engine {
unpack_t::unpack_t(const std::string &module_name, unpack_t::unpack_t(const std::string& module_name,
const std::vector<std::uint8_t> &packed_bin) const std::vector<std::uint8_t>& packed_bin)
: module_name(module_name), : module_name(module_name),
bin(packed_bin), bin(packed_bin),
uc_ctx(nullptr), uc_ctx(nullptr),
heap_offset(0ull), heap_offset(0ull),
pack_section_offset(0ull) { pack_section_offset(0ull) {
win_img = reinterpret_cast<win::image_t<> *>(bin.data()); win_img = reinterpret_cast<win::image_t<>*>(bin.data());
img_base = win_img->get_nt_headers()->optional_header.image_base; img_base = win_img->get_nt_headers()->optional_header.image_base;
img_size = win_img->get_nt_headers()->optional_header.size_image; img_size = win_img->get_nt_headers()->optional_header.size_image;
std::printf("> image base = 0x%p, image size = 0x%x\n", img_base, img_size); std::printf("> image base = 0x%p, image size = 0x%x\n", img_base, img_size);
} }
unpack_t::~unpack_t(void) { unpack_t::~unpack_t(void) {
if (uc_ctx) uc_close(uc_ctx); if (uc_ctx)
uc_close(uc_ctx);
for (auto &ptr : uc_hooks) for (auto& ptr : uc_hooks)
if (ptr) delete ptr; if (ptr)
delete ptr;
} }
bool unpack_t::init(void) { bool unpack_t::init(void) {
@ -67,7 +69,7 @@ bool unpack_t::init(void) {
win_img->get_nt_headers()->file_header.num_sections; win_img->get_nt_headers()->file_header.num_sections;
std::for_each( std::for_each(
sec_begin, sec_end, [&](const win::section_header_t &sec_header) { sec_begin, sec_end, [&](const win::section_header_t& sec_header) {
memcpy(map_bin.data() + sec_header.virtual_address, memcpy(map_bin.data() + sec_header.virtual_address,
bin.data() + sec_header.ptr_raw_data, sec_header.size_raw_data); bin.data() + sec_header.ptr_raw_data, sec_header.size_raw_data);
}); });
@ -75,19 +77,19 @@ bool unpack_t::init(void) {
auto basereloc_dir = auto basereloc_dir =
win_img->get_directory(win::directory_id::directory_entry_basereloc); win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>( auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
basereloc_dir->rva + map_bin.data()); basereloc_dir->rva + map_bin.data());
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t* reloc_block = &reloc_dir->first_block;
// apply relocations to all sections... // apply relocations to all sections...
while (reloc_block->base_rva && reloc_block->size_block) { while (reloc_block->base_rva && reloc_block->size_block) {
std::for_each( std::for_each(
reloc_block->begin(), reloc_block->end(), reloc_block->begin(), reloc_block->end(),
[&](win::reloc_entry_t &entry) { [&](win::reloc_entry_t& entry) {
switch (entry.type) { switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: { case win::reloc_type_id::rel_based_dir64: {
auto reloc_at = reinterpret_cast<std::uintptr_t *>( auto reloc_at = reinterpret_cast<std::uintptr_t*>(
entry.offset + reloc_block->base_rva + map_bin.data()); entry.offset + reloc_block->base_rva + map_bin.data());
*reloc_at = img_base + ((*reloc_at) - img_base); *reloc_at = img_base + ((*reloc_at) - img_base);
@ -102,17 +104,18 @@ bool unpack_t::init(void) {
} }
// install iat hooks... // install iat hooks...
for (auto import_dir = reinterpret_cast<win::import_directory_t *>( for (auto import_dir = reinterpret_cast<win::import_directory_t*>(
win_img->get_directory(win::directory_id::directory_entry_import) win_img->get_directory(win::directory_id::directory_entry_import)
->rva + ->rva +
map_bin.data()); map_bin.data());
import_dir->rva_name; ++import_dir) { import_dir->rva_name; ++import_dir) {
for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>( for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<>*>(
import_dir->rva_first_thunk + map_bin.data()); import_dir->rva_first_thunk + map_bin.data());
iat_thunk->address; ++iat_thunk) { iat_thunk->address; ++iat_thunk) {
if (iat_thunk->is_ordinal) continue; if (iat_thunk->is_ordinal)
continue;
auto iat_name = reinterpret_cast<win::image_named_import_t *>( auto iat_name = reinterpret_cast<win::image_named_import_t*>(
iat_thunk->address + map_bin.data()); iat_thunk->address + map_bin.data());
if (iat_hooks.find(iat_name->name) != iat_hooks.end()) { if (iat_hooks.find(iat_name->name) != iat_hooks.end()) {
@ -137,7 +140,7 @@ bool unpack_t::init(void) {
uc_hooks.push_back(new uc_hook); uc_hooks.push_back(new uc_hook);
if ((err = uc_hook_add(uc_ctx, uc_hooks.back(), UC_HOOK_CODE, if ((err = uc_hook_add(uc_ctx, uc_hooks.back(), UC_HOOK_CODE,
(void *)&engine::unpack_t::iat_dispatcher, this, (void*)&engine::unpack_t::iat_dispatcher, this,
IAT_VECTOR_TABLE, IAT_VECTOR_TABLE + PAGE_4KB))) { IAT_VECTOR_TABLE, IAT_VECTOR_TABLE + PAGE_4KB))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
@ -148,21 +151,21 @@ bool unpack_t::init(void) {
uc_ctx, uc_hooks.back(), uc_ctx, uc_hooks.back(),
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED |
UC_HOOK_MEM_FETCH_UNMAPPED | UC_HOOK_INSN_INVALID, UC_HOOK_MEM_FETCH_UNMAPPED | UC_HOOK_INSN_INVALID,
(void *)&engine::unpack_t::invalid_mem, this, true, false))) { (void*)&engine::unpack_t::invalid_mem, this, true, false))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
// execution break points on all sections that are executable but have no // execution break points on all sections that are executable but have no
// physical size on disk... // physical size on disk...
std::for_each(sec_begin, sec_end, [&](const win::section_header_t &header) { std::for_each(sec_begin, sec_end, [&](const win::section_header_t& header) {
if (!header.ptr_raw_data && !header.size_raw_data && if (!header.ptr_raw_data && !header.size_raw_data &&
header.characteristics.mem_execute && header.characteristics.mem_execute &&
header.characteristics.mem_write && !header.is_discardable()) { header.characteristics.mem_write && !header.is_discardable()) {
uc_hooks.push_back(new uc_hook); uc_hooks.push_back(new uc_hook);
if ((err = uc_hook_add( if ((err = uc_hook_add(
uc_ctx, uc_hooks.back(), UC_HOOK_CODE | UC_HOOK_MEM_WRITE, uc_ctx, uc_hooks.back(), UC_HOOK_CODE | UC_HOOK_MEM_WRITE,
(void *)&engine::unpack_t::unpack_section_callback, this, (void*)&engine::unpack_t::unpack_section_callback, this,
header.virtual_address + img_base, header.virtual_address + img_base,
header.virtual_address + header.virtual_size + img_base))) { header.virtual_address + header.virtual_size + img_base))) {
std::printf("> failed to add hook... reason = %d\n", err); std::printf("> failed to add hook... reason = %d\n", err);
@ -175,7 +178,7 @@ bool unpack_t::init(void) {
return true; return true;
} }
bool unpack_t::unpack(std::vector<std::uint8_t> &output) { bool unpack_t::unpack(std::vector<std::uint8_t>& output) {
uc_err err; uc_err err;
auto nt_headers = win_img->get_nt_headers(); auto nt_headers = win_img->get_nt_headers();
std::uintptr_t rip = nt_headers->optional_header.entry_point + img_base, std::uintptr_t rip = nt_headers->optional_header.entry_point + img_base,
@ -204,21 +207,21 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
return false; return false;
} }
auto output_img = reinterpret_cast<win::image_t<> *>(output.data()); auto output_img = reinterpret_cast<win::image_t<>*>(output.data());
auto sections = output_img->get_nt_headers()->get_sections(); auto sections = output_img->get_nt_headers()->get_sections();
auto section_cnt = output_img->get_file_header()->num_sections; auto section_cnt = output_img->get_file_header()->num_sections;
// { section virtual address -> vector of section offset to reloc } // { section virtual address -> vector of section offset to reloc }
std::map<std::uint32_t, std::vector<std::uint16_t> > new_relocs; std::map<std::uint32_t, std::vector<std::uint16_t>> new_relocs;
// search executable sections for MOV RAX, 00 00 00 00 00 00 00 00... // search executable sections for MOV RAX, 00 00 00 00 00 00 00 00...
std::for_each( std::for_each(
sections, sections + section_cnt, [&](win::section_header_t &header) { sections, sections + section_cnt, [&](win::section_header_t& header) {
if (header.characteristics.mem_execute) { if (header.characteristics.mem_execute) {
auto result = output.data() + header.virtual_address; auto result = output.data() + header.virtual_address;
do { do {
result = reinterpret_cast<std::uint8_t *>(vm::locate::sigscan( result = reinterpret_cast<std::uint8_t*>(vm::locate::sigscan(
result, result,
header.virtual_size - header.virtual_size -
(reinterpret_cast<std::uintptr_t>(result) - (reinterpret_cast<std::uintptr_t>(result) -
@ -247,18 +250,19 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
// determines if a relocation block exists for a given page... // determines if a relocation block exists for a given page...
static const auto has_reloc_page = [&](std::uint32_t page) -> bool { static const auto has_reloc_page = [&](std::uint32_t page) -> bool {
auto img = reinterpret_cast<win::image_t<> *>(output.data()); auto img = reinterpret_cast<win::image_t<>*>(output.data());
auto sections = img->get_nt_headers()->get_sections(); auto sections = img->get_nt_headers()->get_sections();
auto section_cnt = img->get_file_header()->num_sections; auto section_cnt = img->get_file_header()->num_sections;
auto basereloc_dir = auto basereloc_dir =
img->get_directory(win::directory_id::directory_entry_basereloc); img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>( auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
basereloc_dir->rva + output.data()); basereloc_dir->rva + output.data());
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t* reloc_block = &reloc_dir->first_block;
while (reloc_block->base_rva && reloc_block->size_block) { while (reloc_block->base_rva && reloc_block->size_block) {
if (reloc_block->base_rva == page) return true; if (reloc_block->base_rva == page)
return true;
reloc_block = reloc_block->next(); reloc_block = reloc_block->next();
} }
@ -268,7 +272,7 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
// calc size to add new reloc info... // calc size to add new reloc info...
std::size_t resize_cnt = 0ull; std::size_t resize_cnt = 0ull;
for (const auto &[reloc_rva, relocs] : new_relocs) for (const auto& [reloc_rva, relocs] : new_relocs)
if (!has_reloc_page(reloc_rva)) if (!has_reloc_page(reloc_rva))
resize_cnt += sizeof(win::reloc_block_t) + resize_cnt += sizeof(win::reloc_block_t) +
(relocs.size() * sizeof(win::reloc_entry_t)); (relocs.size() * sizeof(win::reloc_entry_t));
@ -278,12 +282,12 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
resize_cnt += sizeof(win::reloc_block_t) + basereloc_dir->size; resize_cnt += sizeof(win::reloc_block_t) + basereloc_dir->size;
output.resize(output.size() + resize_cnt); output.resize(output.size() + resize_cnt);
output_img = reinterpret_cast<win::image_t<> *>(output.data()); output_img = reinterpret_cast<win::image_t<>*>(output.data());
basereloc_dir = basereloc_dir =
output_img->get_directory(win::directory_id::directory_entry_basereloc); output_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>( auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
basereloc_dir->rva + output.data()); basereloc_dir->rva + output.data());
// move .reloc section to the end of the file... // move .reloc section to the end of the file...
@ -291,7 +295,7 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
output_img->get_nt_headers()->get_sections(), output_img->get_nt_headers()->get_sections(),
output_img->get_nt_headers()->get_sections() + output_img->get_nt_headers()->get_sections() +
output_img->get_nt_headers()->file_header.num_sections, output_img->get_nt_headers()->file_header.num_sections,
[&](coff::section_header_t &hdr) { [&](coff::section_header_t& hdr) {
if (hdr.virtual_address == basereloc_dir->rva) { if (hdr.virtual_address == basereloc_dir->rva) {
hdr.virtual_size = resize_cnt; hdr.virtual_size = resize_cnt;
hdr.size_raw_data = resize_cnt; hdr.size_raw_data = resize_cnt;
@ -316,10 +320,11 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
~0xFFFull; ~0xFFFull;
// add new relocs to the .reloc section... // add new relocs to the .reloc section...
for (const auto &[reloc_rva, relocs] : new_relocs) { for (const auto& [reloc_rva, relocs] : new_relocs) {
if (has_reloc_page(reloc_rva)) continue; if (has_reloc_page(reloc_rva))
continue;
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t* reloc_block = &reloc_dir->first_block;
while (reloc_block->base_rva && reloc_block->size_block) while (reloc_block->base_rva && reloc_block->size_block)
reloc_block = reloc_block->next(); reloc_block = reloc_block->next();
@ -338,7 +343,7 @@ bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
return true; return true;
} }
void unpack_t::local_alloc_hook(uc_engine *uc_ctx, unpack_t *obj) { void unpack_t::local_alloc_hook(uc_engine* uc_ctx, unpack_t* obj) {
uc_err err; uc_err err;
std::uintptr_t rax, rdx; std::uintptr_t rax, rdx;
@ -363,7 +368,12 @@ void unpack_t::local_alloc_hook(uc_engine *uc_ctx, unpack_t *obj) {
} }
} }
void unpack_t::local_free_hook(uc_engine *uc_ctx, unpack_t *obj) { void unpack_t::is_debugger_present_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rax = 0ull;
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
}
void unpack_t::local_free_hook(uc_engine* uc_ctx, unpack_t* obj) {
uc_err err; uc_err err;
std::uintptr_t rax = 0ull; std::uintptr_t rax = 0ull;
@ -373,34 +383,34 @@ void unpack_t::local_free_hook(uc_engine *uc_ctx, unpack_t *obj) {
} }
} }
void unpack_t::unmap_view_of_file_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::unmap_view_of_file_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, rax = true; std::uintptr_t rcx, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RAX, &rax);
std::printf("> UnmapViewOfFile(%p)\n", rcx); std::printf("> UnmapViewOfFile(%p)\n", rcx);
} }
void unpack_t::close_handle_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::close_handle_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, rax = true; std::uintptr_t rcx, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RAX, &rax);
std::printf("> CloseHandle(%x)\n", rcx); std::printf("> CloseHandle(%x)\n", rcx);
} }
void unpack_t::get_module_file_name_w_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::get_module_file_name_w_hook(uc_engine* uc, unpack_t* obj) {
uc_err err; uc_err err;
std::uintptr_t rcx, rdx, r8; std::uintptr_t rcx, rdx, r8;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R8, &r8);
std::printf("> GetModuleFileNameW(%p, %p, %d)\n", rcx, rdx, r8); std::printf("> GetModuleFileNameW(%p, %p, %d)\n", rcx, rdx, r8);
uc_strcpy(uc, rdx, (char *)obj->module_name.c_str()); uc_strcpy(uc, rdx, (char*)obj->module_name.c_str());
std::uint32_t size = obj->module_name.size(); std::uint32_t size = obj->module_name.size();
uc_reg_write(uc, UC_X86_REG_RAX, &size); uc_reg_write(uc, UC_X86_REG_RAX, &size);
} }
void unpack_t::create_file_w_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::create_file_w_hook(uc_engine* uc, unpack_t* obj) {
char buff[256]; char buff[256];
std::uintptr_t rcx, rax = PACKED_FILE_HANDLE; std::uintptr_t rcx, rax = PACKED_FILE_HANDLE;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
@ -410,7 +420,7 @@ void unpack_t::create_file_w_hook(uc_engine *uc, unpack_t *obj) {
uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RAX, &rax);
} }
void unpack_t::get_file_size_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::get_file_size_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, rdx, rax; std::uintptr_t rcx, rdx, rax;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
@ -425,7 +435,7 @@ void unpack_t::get_file_size_hook(uc_engine *uc, unpack_t *obj) {
} }
} }
void unpack_t::create_file_mapping_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::create_file_mapping_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, r8, rax = PACKED_FILE_HANDLE; std::uintptr_t rcx, r8, rax = PACKED_FILE_HANDLE;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_R8, &r8); uc_reg_read(uc, UC_X86_REG_R8, &r8);
@ -438,7 +448,7 @@ void unpack_t::create_file_mapping_hook(uc_engine *uc, unpack_t *obj) {
} }
} }
void unpack_t::map_view_of_file_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::map_view_of_file_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, rdx, r8, r9, rax; std::uintptr_t rcx, rdx, r8, r9, rax;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
@ -472,7 +482,7 @@ void unpack_t::map_view_of_file_hook(uc_engine *uc, unpack_t *obj) {
} }
} }
void unpack_t::virtual_protect_hook(uc_engine *uc, unpack_t *obj) { void unpack_t::virtual_protect_hook(uc_engine* uc, unpack_t* obj) {
std::uintptr_t rcx, rdx, r8, r9, rax = true; std::uintptr_t rcx, rdx, r8, r9, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx); uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx); uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
@ -482,7 +492,7 @@ void unpack_t::virtual_protect_hook(uc_engine *uc, unpack_t *obj) {
uc_reg_write(uc, UC_X86_REG_RAX, &rax); uc_reg_write(uc, UC_X86_REG_RAX, &rax);
} }
void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) { void unpack_t::load_library_hook(uc_engine* uc_ctx, unpack_t* obj) {
uc_err err; uc_err err;
std::uintptr_t rcx = 0ull; std::uintptr_t rcx = 0ull;
@ -506,7 +516,7 @@ void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) {
exit(-1); exit(-1);
} }
auto img = reinterpret_cast<win::image_t<> *>(module_data.data()); auto img = reinterpret_cast<win::image_t<>*>(module_data.data());
auto image_size = img->get_nt_headers()->optional_header.size_image; auto image_size = img->get_nt_headers()->optional_header.size_image;
tmp.resize(image_size); tmp.resize(image_size);
@ -514,7 +524,7 @@ void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) {
std::for_each(img->get_nt_headers()->get_sections(), std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() + img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections, img->get_nt_headers()->file_header.num_sections,
[&](const auto &section_header) { [&](const auto& section_header) {
std::memcpy( std::memcpy(
tmp.data() + section_header.virtual_address, tmp.data() + section_header.virtual_address,
module_data.data() + section_header.ptr_raw_data, module_data.data() + section_header.ptr_raw_data,
@ -522,31 +532,38 @@ void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) {
}); });
const auto module_base = reinterpret_cast<std::uintptr_t>(tmp.data()); const auto module_base = reinterpret_cast<std::uintptr_t>(tmp.data());
img = reinterpret_cast<win::image_t<> *>(module_base); img = reinterpret_cast<win::image_t<>*>(module_base);
const auto image_base = img->get_nt_headers()->optional_header.image_base; const auto image_base = img->get_nt_headers()->optional_header.image_base;
const auto alloc_addr = module_base & ~0xFFFull; const auto alloc_addr = module_base & ~0xFFFull;
obj->loaded_modules[buff] = alloc_addr; obj->loaded_modules[buff] = alloc_addr;
// install iat hooks... auto dir = reinterpret_cast<win::import_directory_t*>(
for (auto import_dir = reinterpret_cast<win::import_directory_t *>( img->get_directory(win::directory_id::directory_entry_import));
img->get_directory(win::directory_id::directory_entry_import)
->rva + if (dir) {
module_base); // install iat hooks...
import_dir->rva_name; ++import_dir) { for (auto import_dir = reinterpret_cast<win::import_directory_t*>(
for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>( img->get_directory(win::directory_id::directory_entry_import)
import_dir->rva_first_thunk + module_base); ->rva +
iat_thunk->address; ++iat_thunk) { module_base);
if (iat_thunk->is_ordinal) continue; import_dir->rva_name; ++import_dir) {
for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<>*>(
auto iat_name = reinterpret_cast<win::image_named_import_t *>( import_dir->rva_first_thunk + module_base);
iat_thunk->address + module_base); iat_thunk->address; ++iat_thunk) {
if (iat_thunk->is_ordinal)
if (obj->iat_hooks.find(iat_name->name) != obj->iat_hooks.end()) { continue;
std::printf("> iat hooking %s to vector table %p\n", iat_name->name,
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE); auto iat_name = reinterpret_cast<win::image_named_import_t*>(
iat_thunk->address + module_base);
iat_thunk->function =
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE; if (obj->iat_hooks.find(iat_name->name) != obj->iat_hooks.end()) {
std::printf(
"> iat hooking %s to vector table %p\n", iat_name->name,
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE);
iat_thunk->function =
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE;
}
} }
} }
} }
@ -577,7 +594,7 @@ void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) {
} }
} // namespace engine } // namespace engine
void unpack_t::uc_strcpy(uc_engine *uc_ctx, char *buff, std::uintptr_t addr) { void unpack_t::uc_strcpy(uc_engine* uc_ctx, char* buff, std::uintptr_t addr) {
uc_err err; uc_err err;
char i = 0u; char i = 0u;
auto idx = 0ul; auto idx = 0ul;
@ -590,7 +607,7 @@ void unpack_t::uc_strcpy(uc_engine *uc_ctx, char *buff, std::uintptr_t addr) {
} while ((buff[idx++] = i)); } while ((buff[idx++] = i));
} }
void unpack_t::uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff) { void unpack_t::uc_strcpy(uc_engine* uc, std::uintptr_t addr, char* buff) {
uc_err err; uc_err err;
for (char idx = 0u, c = buff[idx]; buff[idx]; ++idx, c = buff[idx]) { for (char idx = 0u, c = buff[idx]; buff[idx]; ++idx, c = buff[idx]) {
if ((err = uc_mem_write(uc, addr + idx, &c, sizeof c))) { if ((err = uc_mem_write(uc, addr + idx, &c, sizeof c))) {
@ -600,10 +617,12 @@ void unpack_t::uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff) {
} }
} }
bool unpack_t::iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size, bool unpack_t::iat_dispatcher(uc_engine* uc,
unpack_t *unpack) { uint64_t address,
uint32_t size,
unpack_t* unpack) {
auto vec = address - IAT_VECTOR_TABLE; auto vec = address - IAT_VECTOR_TABLE;
for (auto &[iat_name, iat_hook_data] : unpack->iat_hooks) { for (auto& [iat_name, iat_hook_data] : unpack->iat_hooks) {
if (iat_hook_data.first == vec) { if (iat_hook_data.first == vec) {
iat_hook_data.second(uc, unpack); iat_hook_data.second(uc, unpack);
return true; return true;
@ -612,9 +631,12 @@ bool unpack_t::iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size,
return false; return false;
} }
bool unpack_t::unpack_section_callback(uc_engine *uc, uc_mem_type type, bool unpack_t::unpack_section_callback(uc_engine* uc,
uint64_t address, int size, uc_mem_type type,
int64_t value, unpack_t *unpack) { uint64_t address,
int size,
int64_t value,
unpack_t* unpack) {
if (address == unpack->pack_section_offset + unpack->img_base) { if (address == unpack->pack_section_offset + unpack->img_base) {
std::printf("> last byte written to unpack section... dumping...\n"); std::printf("> last byte written to unpack section... dumping...\n");
uc_emu_stop(uc); uc_emu_stop(uc);
@ -623,8 +645,12 @@ bool unpack_t::unpack_section_callback(uc_engine *uc, uc_mem_type type,
return true; return true;
} }
void unpack_t::invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address, void unpack_t::invalid_mem(uc_engine* uc,
int size, int64_t value, unpack_t *unpack) { uc_mem_type type,
uint64_t address,
int size,
int64_t value,
unpack_t* unpack) {
switch (type) { switch (type) {
case UC_MEM_READ_UNMAPPED: { case UC_MEM_READ_UNMAPPED: {
uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL); uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);

62
src/vmemu_t.cpp
Unescape View File

@ -1,14 +1,15 @@
#include "vmemu_t.hpp" #include "vmemu_t.hpp"
namespace vm { namespace vm {
emu_t::emu_t(vm::ctx_t *vm_ctx) emu_t::emu_t(vm::ctx_t* vm_ctx)
: g_vm_ctx(vm_ctx), : g_vm_ctx(vm_ctx),
uc_ctx(nullptr), uc_ctx(nullptr),
img_base(vm_ctx->image_base), img_base(vm_ctx->image_base),
img_size(vm_ctx->image_size) {} img_size(vm_ctx->image_size) {}
emu_t::~emu_t() { emu_t::~emu_t() {
if (uc_ctx) uc_close(uc_ctx); if (uc_ctx)
uc_close(uc_ctx);
} }
bool emu_t::init() { bool emu_t::init() {
@ -41,18 +42,19 @@ bool emu_t::init() {
} }
free(c3_page); free(c3_page);
auto win_img = reinterpret_cast<win::image_t<> *>(g_vm_ctx->module_base); auto win_img = reinterpret_cast<win::image_t<>*>(g_vm_ctx->module_base);
// iat hook all imports to return... // iat hook all imports to return...
for (auto import_dir = reinterpret_cast<win::import_directory_t *>( for (auto import_dir = reinterpret_cast<win::import_directory_t*>(
win_img->get_directory(win::directory_id::directory_entry_import) win_img->get_directory(win::directory_id::directory_entry_import)
->rva + ->rva +
g_vm_ctx->module_base); g_vm_ctx->module_base);
import_dir->rva_name; ++import_dir) { import_dir->rva_name; ++import_dir) {
for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>( for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<>*>(
import_dir->rva_first_thunk + g_vm_ctx->module_base); import_dir->rva_first_thunk + g_vm_ctx->module_base);
iat_thunk->address; ++iat_thunk) { iat_thunk->address; ++iat_thunk) {
if (iat_thunk->is_ordinal) continue; if (iat_thunk->is_ordinal)
continue;
iat_thunk->function = IAT_VECTOR_TABLE; iat_thunk->function = IAT_VECTOR_TABLE;
} }
} }
@ -64,14 +66,14 @@ bool emu_t::init() {
} }
if ((err = uc_mem_write(uc_ctx, g_vm_ctx->module_base, if ((err = uc_mem_write(uc_ctx, g_vm_ctx->module_base,
reinterpret_cast<void *>(g_vm_ctx->module_base), reinterpret_cast<void*>(g_vm_ctx->module_base),
img_size))) { img_size))) {
std::printf("> failed to write memory... reason = %d\n", err); std::printf("> failed to write memory... reason = %d\n", err);
return false; return false;
} }
if ((err = uc_hook_add(uc_ctx, &code_exec_hook, UC_HOOK_CODE, if ((err = uc_hook_add(uc_ctx, &code_exec_hook, UC_HOOK_CODE,
(void *)&vm::emu_t::code_exec_callback, this, (void*)&vm::emu_t::code_exec_callback, this,
g_vm_ctx->module_base, g_vm_ctx->module_base,
g_vm_ctx->module_base + img_size))) { g_vm_ctx->module_base + img_size))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
@ -79,7 +81,7 @@ bool emu_t::init() {
} }
if ((err = uc_hook_add(uc_ctx, &int_hook, UC_HOOK_INTR, if ((err = uc_hook_add(uc_ctx, &int_hook, UC_HOOK_INTR,
(void *)&vm::emu_t::int_callback, this, 0ull, 0ull))) { (void*)&vm::emu_t::int_callback, this, 0ull, 0ull))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
@ -88,14 +90,14 @@ bool emu_t::init() {
uc_hook_add(uc_ctx, &invalid_mem_hook, uc_hook_add(uc_ctx, &invalid_mem_hook,
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED |
UC_HOOK_MEM_FETCH_UNMAPPED, UC_HOOK_MEM_FETCH_UNMAPPED,
(void *)&vm::emu_t::invalid_mem, this, true, false))) { (void*)&vm::emu_t::invalid_mem, this, true, false))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
return true; return true;
} }
bool emu_t::get_trace(std::vector<vm::instrs::code_block_t> &entries) { bool emu_t::get_trace(std::vector<vm::instrs::code_block_t>& entries) {
uc_err err; uc_err err;
std::uintptr_t rip = g_vm_ctx->vm_entry_rva + g_vm_ctx->module_base, std::uintptr_t rip = g_vm_ctx->vm_entry_rva + g_vm_ctx->module_base,
rsp = STACK_BASE + STACK_SIZE - PAGE_4KB; rsp = STACK_BASE + STACK_SIZE - PAGE_4KB;
@ -120,13 +122,15 @@ bool emu_t::get_trace(std::vector<vm::instrs::code_block_t> &entries) {
return false; return false;
} }
if (cc_block) code_blocks.push_back(code_block); if (cc_block)
code_blocks.push_back(code_block);
// code_blocks.size() will continue to grow as all branches are traced... // code_blocks.size() will continue to grow as all branches are traced...
// when idx is > code_blocks.size() then we have traced all branches... // when idx is > code_blocks.size() then we have traced all branches...
for (auto idx = 0u; idx < code_blocks.size(); ++idx) { for (auto idx = 0u; idx < code_blocks.size(); ++idx) {
const auto _code_block = code_blocks[idx]; const auto _code_block = code_blocks[idx];
if (!_code_block.code_block.jcc.has_jcc) continue; if (!_code_block.code_block.jcc.has_jcc)
continue;
switch (_code_block.code_block.jcc.type) { switch (_code_block.code_block.jcc.type) {
case vm::instrs::jcc_type::branching: { case vm::instrs::jcc_type::branching: {
@ -306,7 +310,7 @@ bool emu_t::get_trace(std::vector<vm::instrs::code_block_t> &entries) {
} }
} }
for (auto &[code_block, cpu_ctx, vm_ctx] : code_blocks) { for (auto& [code_block, cpu_ctx, vm_ctx] : code_blocks) {
// convert linear virtual addresses to image based addresses... // convert linear virtual addresses to image based addresses...
code_block.vip_begin = code_block.vip_begin =
(code_block.vip_begin - g_vm_ctx->module_base) + g_vm_ctx->image_base; (code_block.vip_begin - g_vm_ctx->module_base) + g_vm_ctx->image_base;
@ -338,7 +342,7 @@ bool emu_t::get_trace(std::vector<vm::instrs::code_block_t> &entries) {
return true; return true;
} }
uc_err emu_t::create_entry(vmp2::v2::entry_t *entry) { uc_err emu_t::create_entry(vmp2::v2::entry_t* entry) {
uc_reg_read(uc_ctx, UC_X86_REG_R15, &entry->regs.r15); uc_reg_read(uc_ctx, UC_X86_REG_R15, &entry->regs.r15);
uc_reg_read(uc_ctx, UC_X86_REG_R14, &entry->regs.r14); uc_reg_read(uc_ctx, UC_X86_REG_R14, &entry->regs.r14);
uc_reg_read(uc_ctx, UC_X86_REG_R13, &entry->regs.r13); uc_reg_read(uc_ctx, UC_X86_REG_R13, &entry->regs.r13);
@ -375,8 +379,10 @@ uc_err emu_t::create_entry(vmp2::v2::entry_t *entry) {
return UC_ERR_OK; return UC_ERR_OK;
} }
bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size, bool emu_t::code_exec_callback(uc_engine* uc,
emu_t *obj) { uint64_t address,
uint32_t size,
emu_t* obj) {
uc_err err; uc_err err;
vmp2::v2::entry_t vinstr_entry; vmp2::v2::entry_t vinstr_entry;
std::uint8_t vm_handler_table_idx = 0u; std::uint8_t vm_handler_table_idx = 0u;
@ -388,7 +394,7 @@ bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
static thread_local ZydisDecodedInstruction instr; static thread_local ZydisDecodedInstruction instr;
if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(vm::util::g_decoder.get(), if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(vm::util::g_decoder.get(),
reinterpret_cast<void *>(address), reinterpret_cast<void*>(address),
PAGE_4KB, &instr))) { PAGE_4KB, &instr))) {
std::printf("> failed to decode instruction at = 0x%p\n", address); std::printf("> failed to decode instruction at = 0x%p\n", address);
if ((err = uc_emu_stop(uc))) { if ((err = uc_emu_stop(uc))) {
@ -460,7 +466,7 @@ bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
return false; return false;
} }
auto &vm_handler = obj->g_vm_ctx->vm_handlers[vm_handler_table_idx]; auto& vm_handler = obj->g_vm_ctx->vm_handlers[vm_handler_table_idx];
if ((err = obj->create_entry(&vinstr_entry))) { if ((err = obj->create_entry(&vinstr_entry))) {
std::printf("> failed to create vinstr entry... reason = %d\n", err); std::printf("> failed to create vinstr entry... reason = %d\n", err);
@ -491,7 +497,8 @@ bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
} }
if (!vm_handler.profile) { if (!vm_handler.profile) {
if (!g_force_emu) obj->cc_block = nullptr; if (!g_force_emu)
obj->cc_block = nullptr;
std::printf("> please define virtual machine handler (%p): \n\n", std::printf("> please define virtual machine handler (%p): \n\n",
(vm_handler_addr - obj->g_vm_ctx->module_base) + (vm_handler_addr - obj->g_vm_ctx->module_base) +
@ -500,7 +507,8 @@ bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
vm::util::print(vm_handler.instrs); vm::util::print(vm_handler.instrs);
std::printf("\n\n"); std::printf("\n\n");
if (!g_force_emu) exit(0); if (!g_force_emu)
exit(0);
} }
auto vinstr = vm::instrs::get(*obj->g_vm_ctx, vinstr_entry); auto vinstr = vm::instrs::get(*obj->g_vm_ctx, vinstr_entry);
@ -627,7 +635,7 @@ bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
return true; return true;
} }
void emu_t::int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj) { void emu_t::int_callback(uc_engine* uc, std::uint32_t intno, emu_t* obj) {
uc_err err; uc_err err;
std::uintptr_t rip = 0ull; std::uintptr_t rip = 0ull;
static ZydisDecoder decoder; static ZydisDecoder decoder;
@ -643,7 +651,7 @@ void emu_t::int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj) {
} }
if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer( if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(
&decoder, reinterpret_cast<void *>(rip), PAGE_4KB, &instr))) { &decoder, reinterpret_cast<void*>(rip), PAGE_4KB, &instr))) {
std::printf("> failed to decode instruction at = 0x%p\n", rip); std::printf("> failed to decode instruction at = 0x%p\n", rip);
if ((err = uc_emu_stop(uc))) { if ((err = uc_emu_stop(uc))) {
@ -662,8 +670,12 @@ void emu_t::int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj) {
} }
} }
void emu_t::invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address, void emu_t::invalid_mem(uc_engine* uc,
int size, int64_t value, emu_t *obj) { uc_mem_type type,
uint64_t address,
int size,
int64_t value,
emu_t* obj) {
switch (type) { switch (type) {
case UC_MEM_READ_UNMAPPED: { case UC_MEM_READ_UNMAPPED: {
uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL); uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);

Write Preview
Loading…
Cancel
Save