vmp2
/
vmemu
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'linux-port' into 'master'

Browse Source 
porting project to support linux...

See merge request vmp2/vmemu!14
merge-requests/15/merge
_xeroxz 3 years ago
parent 1385a7cfe2 c798e736d2
commit e0d756c252
6 changed files with 1712 additions and 1560 deletions
Show Stats Download Patch File Download Diff File

2
dependencies/vmprofiler vendored

@ -1 +1 @@
Subproject commit 1b6875d18825529907289bc87990fed5d99e7f96 Subproject commit dd7d3777ad10373d0eeb23c118e4bdcfc7464494

65
include/unpacker.hpp
Unescape View File

@ -1,15 +1,16 @@
#pragma once #pragma once
#include <functional> #include <Zydis/Zydis.h>
#include <unicorn/unicorn.h> #include <unicorn/unicorn.h>
#include <Zydis/Zydis.h>
#include <atomic> #include <atomic>
#include <fstream> #include <fstream>
#include <functional>
#include <map> #include <map>
#include <nt/image.hpp> #include <nt/image.hpp>
#include <vector> #include <vector>
#include <xtils.hpp> #include <vmprofiler.hpp>
#define PACKED_FILE_HANDLE 0x69420
#define PAGE_4KB 0x1000 #define PAGE_4KB 0x1000
#define STACK_SIZE PAGE_4KB * 512 #define STACK_SIZE PAGE_4KB * 512
@ -23,18 +24,26 @@
#define LOCAL_FREE_VECTOR 3 #define LOCAL_FREE_VECTOR 3
#define LOAD_LIBRARY_VECTOR 4 #define LOAD_LIBRARY_VECTOR 4
#define NT_QUERY_SYSTEM_INFO_VECTOR 5 #define NT_QUERY_SYSTEM_INFO_VECTOR 5
#define GET_MODULE_FILE_NAME_W_VECTOR 6
#define CREATE_FILE_W_VECTOR 7
#define GET_FILE_SIZE_VECTOR 8
#define CREATE_FILE_MAPPING_VECTOR 9
#define MAP_VIEW_OF_FILE_VECTOR 10
#define UNMAP_VIEW_OF_FILE_VECTOR 11
#define CLOSE_HANDLE_VECTOR 12
#define VIRTUAL_PROTECT_VECTOR 13
#define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00" #define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00"
#define MOV_RAX_0_MASK "xxxxxxxxxx" #define MOV_RAX_0_MASK "xxxxxxxxxx"
static_assert( sizeof MOV_RAX_0_SIG == sizeof MOV_RAX_0_MASK, "signature and mask sizes are wrong..." ); static_assert(sizeof MOV_RAX_0_SIG == sizeof MOV_RAX_0_MASK,
"signature and mask sizes are wrong...");
namespace engine namespace engine {
{ class unpack_t {
class unpack_t
{
public: public:
explicit unpack_t( const std::vector< std::uint8_t > &bin ); explicit unpack_t(const std::string &module_name,
const std::vector<std::uint8_t> &bin);
~unpack_t(void); ~unpack_t(void);
bool init(void); bool init(void);
@ -46,6 +55,7 @@ namespace engine
uc_engine *uc_ctx; uc_engine *uc_ctx;
std::vector<uint8_t> bin, map_bin; std::vector<uint8_t> bin, map_bin;
std::vector<uc_hook *> uc_hooks; std::vector<uc_hook *> uc_hooks;
std::string module_name;
std::uintptr_t img_base, img_size, heap_offset, pack_section_offset; std::uintptr_t img_base, img_size, heap_offset, pack_section_offset;
win::image_t<> *win_img; win::image_t<> *win_img;
@ -53,20 +63,43 @@ namespace engine
static void local_alloc_hook(uc_engine *, unpack_t *); static void local_alloc_hook(uc_engine *, unpack_t *);
static void local_free_hook(uc_engine *, unpack_t *); static void local_free_hook(uc_engine *, unpack_t *);
static void load_library_hook(uc_engine *, unpack_t *); static void load_library_hook(uc_engine *, unpack_t *);
static void uc_strcpy( uc_engine *, char *buff, std::uintptr_t addr ); static void get_module_file_name_w_hook(uc_engine *, unpack_t *);
static void create_file_w_hook(uc_engine *, unpack_t *);
static void get_file_size_hook(uc_engine *, unpack_t *);
static void create_file_mapping_hook(uc_engine *, unpack_t *);
static void map_view_of_file_hook(uc_engine *, unpack_t *);
static void unmap_view_of_file_hook(uc_engine *, unpack_t *);
static void close_handle_hook(uc_engine *, unpack_t *);
static void virtual_protect_hook(uc_engine *, unpack_t *);
static void uc_strcpy(uc_engine *uc, char *buff, std::uintptr_t addr);
static void uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff);
static bool iat_dispatcher( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack ); static bool iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size,
static bool unpack_section_callback( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value,
unpack_t *unpack); unpack_t *unpack);
static bool code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack ); static bool unpack_section_callback(uc_engine *uc, uc_mem_type type,
static void invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, uint64_t address, int size, int64_t value,
unpack_t *unpack); unpack_t *unpack);
std::vector< std::uintptr_t > loaded_modules; static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
int size, int64_t value, unpack_t *unpack);
std::map<std::string, std::uintptr_t> loaded_modules;
std::map<std::string, std::pair<std::uint32_t, iat_hook_t> > iat_hooks = { std::map<std::string, std::pair<std::uint32_t, iat_hook_t> > iat_hooks = {
{"LocalAlloc", {LOCAL_ALLOC_VECTOR, &local_alloc_hook}}, {"LocalAlloc", {LOCAL_ALLOC_VECTOR, &local_alloc_hook}},
{"LocalFree", {LOCAL_FREE_VECTOR, &local_free_hook}}, {"LocalFree", {LOCAL_FREE_VECTOR, &local_free_hook}},
{ "LoadLibraryA", { LOAD_LIBRARY_VECTOR, &load_library_hook } } }; {"LoadLibraryA", {LOAD_LIBRARY_VECTOR, &load_library_hook}},
{"GetModuleFileNameW",
{GET_MODULE_FILE_NAME_W_VECTOR, &get_module_file_name_w_hook}},
{"CreateFileW", {CREATE_FILE_W_VECTOR, &create_file_w_hook}},
{"GetFileSize", {GET_FILE_SIZE_VECTOR, &get_file_size_hook}},
{"CreateFileMappingW",
{CREATE_FILE_MAPPING_VECTOR, &create_file_mapping_hook}},
{"MapViewOfFile", {MAP_VIEW_OF_FILE_VECTOR, &map_view_of_file_hook}},
{"UnmapViewOfFile",
{UNMAP_VIEW_OF_FILE_VECTOR, &unmap_view_of_file_hook}},
{"CloseHandle", {CLOSE_HANDLE_VECTOR, &close_handle_hook}},
{"VirtualProtect", {VIRTUAL_PROTECT_VECTOR, &virtual_protect_hook}}};
}; };
} // namespace engine } // namespace engine

18
include/vmemu_t.hpp
Unescape View File

@ -1,6 +1,7 @@
#pragma once #pragma once
#include <unicorn/unicorn.h> #include <unicorn/unicorn.h>
#include <atomic>
#include <nt/image.hpp> #include <nt/image.hpp>
#include <vmprofiler.hpp> #include <vmprofiler.hpp>
@ -10,21 +11,17 @@
#define STACK_BASE 0xFFFF000000000000 #define STACK_BASE 0xFFFF000000000000
#define IAT_VECTOR_TABLE 0xFFFFF00000000000 #define IAT_VECTOR_TABLE 0xFFFFF00000000000
namespace vm namespace vm {
{
inline bool g_force_emu = false; inline bool g_force_emu = false;
class emu_t class emu_t {
{ struct cpu_ctx_t {
struct cpu_ctx_t
{
std::uintptr_t rip; std::uintptr_t rip;
uc_context *context; uc_context *context;
std::uint8_t stack[STACK_SIZE]; std::uint8_t stack[STACK_SIZE];
}; };
struct code_block_data_t struct code_block_data_t {
{
vm::instrs::code_block_t code_block; vm::instrs::code_block_t code_block;
std::shared_ptr<cpu_ctx_t> cpu_ctx; std::shared_ptr<cpu_ctx_t> cpu_ctx;
std::shared_ptr<vm::ctx_t> g_vm_ctx; std::shared_ptr<vm::ctx_t> g_vm_ctx;
@ -51,8 +48,9 @@ namespace vm
uc_err create_entry(vmp2::v2::entry_t *entry); uc_err create_entry(vmp2::v2::entry_t *entry);
static void int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj); static void int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj);
static bool code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, emu_t *obj ); static bool code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
static void invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value,
emu_t *obj); emu_t *obj);
static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
int size, int64_t value, emu_t *obj);
}; };
} // namespace vm } // namespace vm

363
src/main.cpp
Unescape View File

@ -1,121 +1,173 @@
#include "unpacker.hpp"
#include "vmemu_t.hpp"
#include <cli-parser.hpp> #include <cli-parser.hpp>
#include <fstream> #include <fstream>
#include <iostream> #include <iostream>
#include <xtils.hpp>
#include "unpacker.hpp"
int __cdecl main( int argc, const char *argv[] ) #include "vmemu_t.hpp"
{
argparse::argument_parser_t parser( "VMEmu", "VMProtect 2 VM Handler Emulator" ); int __cdecl main(int argc, const char *argv[]) {
parser.add_argument().name( "--vmentry" ).description( "relative virtual address to a vm entry..." ); argparse::argument_parser_t parser("VMEmu",
parser.add_argument().name( "--bin" ).description( "path to unpacked virtualized binary..." ); "VMProtect 2 VM Handler Emulator");
parser.add_argument().name( "--out" ).description( "output file name..." ); parser.add_argument()
.name("--vmentry")
.description("relative virtual address to a vm entry...");
parser.add_argument()
.name("--bin")
.description("path to unpacked virtualized binary...")
.required(true);
parser.add_argument()
.name("--out")
.description("output file name...")
.required(true);
parser.add_argument().name("--unpack").description("unpack a vmp2 binary..."); parser.add_argument().name("--unpack").description("unpack a vmp2 binary...");
parser.add_argument().names( { "-f", "--force" } ).description( "force emulation of unknown vm handlers...\n" );
parser.add_argument() parser.add_argument()
.name( "--emuall" ) .names({"-f", "--force"})
.description( "scan for all vm enters and trace all of them... this may take a few minutes..." ); .description("force emulation of unknown vm handlers...");
parser.add_argument() parser.add_argument()
.name( "--locateconst" ) .name("--emuall")
.description( "scan all vm enters for a specific constant value...\n" ); .description(
"scan for all vm enters and trace all of them... this may take a few "
"minutes...");
parser.enable_help(); parser.enable_help();
auto result = parser.parse(argc, argv); auto result = parser.parse(argc, argv);
if ( result ) if (result) {
{ std::printf("[!] error parsing commandline arguments... reason = %s\n",
std::printf( "[!] error parsing commandline arguments... reason = %s\n", result.what().c_str() ); result.what().c_str());
return -1; return -1;
} }
if ( parser.exists( "help" ) ) if (parser.exists("help")) {
{
parser.print_help(); parser.print_help();
return 0; return 0;
} }
auto umtils = xtils::um_t::get_instance(); vm::util::init();
vm::g_force_emu = parser.exists("force"); vm::g_force_emu = parser.exists("force");
if ( !parser.exists( "unpack" ) && parser.exists( "vmentry" ) && parser.exists( "bin" ) && parser.exists( "out" ) ) std::vector<std::uint8_t> module_data, tmp, unpacked_bin;
{ if (!vm::util::open_binary_file(parser.get<std::string>("bin"),
const auto module_base = reinterpret_cast< std::uintptr_t >( module_data)) {
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
if ( !module_base )
{
std::printf("[!] failed to open binary file...\n"); std::printf("[!] failed to open binary file...\n");
return -1; return -1;
} }
const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); auto img = reinterpret_cast<win::image_t<> *>(module_data.data());
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() ); auto image_size = img->get_nt_headers()->optional_header.size_image;
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; const auto image_base = img->get_nt_headers()->optional_header.image_base;
// page align the vector allocation so that unicorn-engine is happy girl...
tmp.resize(image_size + PAGE_4KB);
const std::uintptr_t module_base =
reinterpret_cast<std::uintptr_t>(tmp.data()) +
(PAGE_4KB - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull));
std::memcpy((void *)module_base, module_data.data(), 0x1000);
std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections,
[&](const auto &section_header) {
std::memcpy(
(void *)(module_base + section_header.virtual_address),
module_data.data() + section_header.ptr_raw_data,
section_header.size_raw_data);
});
auto win_img = reinterpret_cast<win::image_t<> *>(module_base);
auto basereloc_dir =
win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>(
basereloc_dir->rva + module_base);
win::reloc_block_t *reloc_block = &reloc_dir->first_block;
// apply relocations to all sections...
while (reloc_block->base_rva && reloc_block->size_block) {
std::for_each(reloc_block->begin(), reloc_block->end(),
[&](win::reloc_entry_t &entry) {
switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: {
auto reloc_at = reinterpret_cast<std::uintptr_t *>(
entry.offset + reloc_block->base_rva + module_base);
*reloc_at = module_base + ((*reloc_at) - image_base);
break;
}
default:
break;
}
});
reloc_block = reloc_block->next();
}
std::printf( "> image base = %p, image size = %p, module base = %p\n", image_base, image_size, module_base ); std::printf("> image base = %p, image size = %p, module base = %p\n",
image_base, image_size, module_base);
if ( !image_base || !image_size || !module_base ) if (!image_base || !image_size || !module_base) {
{
std::printf("[!] failed to open binary on disk...\n"); std::printf("[!] failed to open binary on disk...\n");
return -1; return -1;
} }
if (parser.exists("vmentry")) {
const auto vm_entry_rva =
std::strtoull(parser.get<std::string>("vmentry").c_str(), nullptr, 16);
std::vector<vm::instrs::code_block_t> code_blocks; std::vector<vm::instrs::code_block_t> code_blocks;
vm::ctx_t vmctx(module_base, image_base, image_size, vm_entry_rva); vm::ctx_t vmctx(module_base, image_base, image_size, vm_entry_rva);
if ( !vmctx.init() ) if (!vmctx.init()) {
{ std::printf(
std::printf( "[!] failed to init vmctx... this can be for many reasons..." "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is" " try validating your vm entry rva... make sure the binary is "
"unpacked and is"
"protected with VMProtect 2...\n"); "protected with VMProtect 2...\n");
return -1; return -1;
} }
vm::emu_t emu(&vmctx); vm::emu_t emu(&vmctx);
if ( !emu.init() ) if (!emu.init()) {
{
std::printf("[!] failed to init emulator...\n"); std::printf("[!] failed to init emulator...\n");
return -1; return -1;
} }
if ( !emu.get_trace( code_blocks ) ) if (!emu.get_trace(code_blocks)) {
{ std::printf(
std::printf( "[!] something failed during tracing, review the console for more information...\n" ); "[!] something failed during tracing, review the console for more "
"information...\n");
return -1; return -1;
} }
std::printf("> number of blocks = %d\n", code_blocks.size()); std::printf("> number of blocks = %d\n", code_blocks.size());
for ( auto &code_block : code_blocks ) for (auto &code_block : code_blocks) {
{
std::printf("> code block starts at = %p\n", code_block.vip_begin); std::printf("> code block starts at = %p\n", code_block.vip_begin);
std::printf( "> number of virtual instructions = %d\n", code_block.vinstrs.size() ); std::printf("> number of virtual instructions = %d\n",
std::printf( "> does this code block have a jcc? %s\n", code_block.jcc.has_jcc ? "yes" : "no" ); code_block.vinstrs.size());
std::printf("> does this code block have a jcc? %s\n",
if ( code_block.jcc.has_jcc ) code_block.jcc.has_jcc ? "yes" : "no");
{
switch ( code_block.jcc.type ) if (code_block.jcc.has_jcc) {
{ switch (code_block.jcc.type) {
case vm::instrs::jcc_type::branching: case vm::instrs::jcc_type::branching: {
{ std::printf("> branch 1 = %p, branch 2 = %p\n",
std::printf( "> branch 1 = %p, branch 2 = %p\n", code_block.jcc.block_addr[ 0 ], code_block.jcc.block_addr[0],
code_block.jcc.block_addr[1]); code_block.jcc.block_addr[1]);
break; break;
} }
case vm::instrs::jcc_type::absolute: case vm::instrs::jcc_type::absolute: {
{
std::printf("> branch 1 = %p\n", code_block.jcc.block_addr[0]); std::printf("> branch 1 = %p\n", code_block.jcc.block_addr[0]);
break; break;
} }
case vm::instrs::jcc_type::switch_case: case vm::instrs::jcc_type::switch_case: {
{
std::printf("> switch case blocks:\n"); std::printf("> switch case blocks:\n");
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx) for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
std::printf( " case block at = 0x%p\n", code_block.jcc.block_addr[ idx ] ); std::printf(" case block at = 0x%p\n",
code_block.jcc.block_addr[idx]);
break; break;
} }
} }
@ -137,14 +189,16 @@ int __cdecl main( int argc, const char *argv[] )
vmp2::v4::rtn_t rtn; vmp2::v4::rtn_t rtn;
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write( reinterpret_cast< const char * >( &file_header ), sizeof file_header ); output.write(reinterpret_cast<const char *>(&file_header),
sizeof file_header);
output.write(reinterpret_cast<const char *>(module_base), image_size); output.write(reinterpret_cast<const char *>(module_base), image_size);
std::vector<vmp2::v4::code_block_t *> vmp2_blocks; std::vector<vmp2::v4::code_block_t *> vmp2_blocks;
for ( const auto &code_block : code_blocks ) for (const auto &code_block : code_blocks) {
{ const auto _code_block_size =
const auto _code_block_size = sizeof vmp2::v4::code_block_t + ( code_block.jcc.block_addr.size() * 8 ) + sizeof(vmp2::v4::code_block_t) +
code_block.vinstrs.size() * sizeof vm::instrs::virt_instr_t; (code_block.jcc.block_addr.size() * 8) +
code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
vmp2::v4::code_block_t *_code_block = vmp2::v4::code_block_t *_code_block =
reinterpret_cast<vmp2::v4::code_block_t *>(malloc(_code_block_size)); reinterpret_cast<vmp2::v4::code_block_t *>(malloc(_code_block_size));
@ -162,7 +216,8 @@ int __cdecl main( int argc, const char *argv[] )
_code_block->branch_addr[idx] = code_block.jcc.block_addr[idx]; _code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>( auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>(
reinterpret_cast< std::uintptr_t >( _code_block ) + sizeof vmp2::v4::code_block_t + reinterpret_cast<std::uintptr_t>(_code_block) +
sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8)); (code_block.jcc.block_addr.size() * 8));
for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx) for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx)
@ -171,10 +226,12 @@ int __cdecl main( int argc, const char *argv[] )
vmp2_blocks.push_back(_code_block); vmp2_blocks.push_back(_code_block);
} }
std::size_t code_blocks_size = sizeof( vmp2::v4::rtn_t::size ) + sizeof( vmp2::v4::rtn_t::code_block_count ) + std::size_t code_blocks_size = sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset); sizeof(vmp2::v4::rtn_t::vm_enter_offset);
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void {
code_blocks_size += vmp2_block->next_block_offset; code_blocks_size += vmp2_block->next_block_offset;
}); });
@ -182,82 +239,72 @@ int __cdecl main( int argc, const char *argv[] )
rtn.code_block_count = vmp2_blocks.size(); rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_entry_rva; rtn.vm_enter_offset = vm_entry_rva;
output.write( reinterpret_cast< const char * >( &rtn ), sizeof( vmp2::v4::rtn_t::size ) + output.write(reinterpret_cast<const char *>(&rtn),
sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) + sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset)); sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
output.write( reinterpret_cast< const char * >( vmp2_block ), vmp2_block->next_block_offset ); [&](vmp2::v4::code_block_t *vmp2_block) -> void {
output.write(reinterpret_cast<const char *>(vmp2_block),
vmp2_block->next_block_offset);
free(vmp2_block); free(vmp2_block);
}); });
output.close(); output.close();
} } else if (parser.exists("unpack")) {
else if ( parser.exists( "unpack" ) && parser.exists( "out" ) ) engine::unpack_t unpacker(parser.get<std::string>("bin"), module_data);
{
std::vector< std::uint8_t > packed_bin, unpacked_bin;
if ( !umtils->open_binary_file( parser.get< std::string >( "unpack" ), packed_bin ) )
{
std::printf( "> failed to read bin off disk...\n" );
return -1;
}
engine::unpack_t unpacker( packed_bin ); if (!unpacker.init()) {
if ( !unpacker.init() )
{
std::printf("> failed to init unpacker...\n"); std::printf("> failed to init unpacker...\n");
return -1; return -1;
} }
if ( !unpacker.unpack( unpacked_bin ) ) if (!unpacker.unpack(unpacked_bin)) {
{
std::printf("> failed to unpack binary... refer to log above...\n"); std::printf("> failed to unpack binary... refer to log above...\n");
return -1; return -1;
} }
std::printf( "> writing result to = %s\n", parser.get< std::string >( "out" ).c_str() ); std::printf("> writing result to = %s\n",
parser.get<std::string>("out").c_str());
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write( reinterpret_cast< char * >( unpacked_bin.data() ), unpacked_bin.size() ); output.write(reinterpret_cast<char *>(unpacked_bin.data()),
output.close(); unpacked_bin.size());
}
else if ( parser.exists( "bin" ) && parser.exists( "emuall" ) && parser.exists( "out" ) )
{
const auto module_base = reinterpret_cast< std::uintptr_t >(
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() ); output.close();
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; } else if (parser.exists("emuall")) {
auto entries = vm::locate::get_vm_entries(module_base, image_size);
auto vm_handler_tables = vm::locate::all_handler_tables( module_base ); std::vector<
auto vm_enters = vm::locate::all_vm_enters( module_base, vm_handler_tables ); std::pair<std::uintptr_t, std::vector<vm::instrs::code_block_t> > >
virt_rtns;
std::vector< std::pair< std::uintptr_t, std::vector< vm::instrs::code_block_t > > > virt_rtns; for (const auto &[vm_enter_offset, encrypted_rva, hndlr_tble] : entries) {
for ( const auto &[ vm_enter_offset, encrypted_rva ] : vm_enters )
{
std::printf("> emulating vm enter at rva = 0x%x\n", vm_enter_offset); std::printf("> emulating vm enter at rva = 0x%x\n", vm_enter_offset);
vm::ctx_t vm_ctx(module_base, image_base, image_size, vm_enter_offset); vm::ctx_t vm_ctx(module_base, image_base, image_size, vm_enter_offset);
if ( !vm_ctx.init() ) if (!vm_ctx.init()) {
{ std::printf(
std::printf( "[!] failed to init vmctx... this can be for many reasons..." "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is" " try validating your vm entry rva... make sure the binary is "
"unpacked and is"
"protected with VMProtect 2...\n"); "protected with VMProtect 2...\n");
return -1; return -1;
} }
vm::emu_t emu(&vm_ctx); vm::emu_t emu(&vm_ctx);
if ( !emu.init() ) if (!emu.init()) {
{
std::printf("[!] failed to init emulator...\n"); std::printf("[!] failed to init emulator...\n");
return -1; return -1;
} }
std::vector<vm::instrs::code_block_t> code_blocks; std::vector<vm::instrs::code_block_t> code_blocks;
if ( !emu.get_trace( code_blocks ) ) if (!emu.get_trace(code_blocks)) {
{ std::printf(
std::printf( "[!] something failed during tracing, review the console for more information...\n" ); "[!] something failed during tracing, review the console for more "
"information...\n");
continue; continue;
} }
@ -281,21 +328,23 @@ int __cdecl main( int argc, const char *argv[] )
file_header.rtn_offset = image_size + sizeof file_header; file_header.rtn_offset = image_size + sizeof file_header;
std::ofstream output(parser.get<std::string>("out"), std::ios::binary); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write( reinterpret_cast< const char * >( &file_header ), sizeof file_header ); output.write(reinterpret_cast<const char *>(&file_header),
sizeof file_header);
output.write(reinterpret_cast<const char *>(module_base), image_size); output.write(reinterpret_cast<const char *>(module_base), image_size);
for ( auto &[ vm_enter_offset, virt_rtn ] : virt_rtns ) for (auto &[vm_enter_offset, virt_rtn] : virt_rtns) {
{ vmp2::v4::rtn_t rtn{(u32)virt_rtn.size()};
vmp2::v4::rtn_t rtn{ virt_rtn.size() };
std::vector<vmp2::v4::code_block_t *> vmp2_blocks; std::vector<vmp2::v4::code_block_t *> vmp2_blocks;
for ( const auto &code_block : virt_rtn ) for (const auto &code_block : virt_rtn) {
{ const auto _code_block_size =
const auto _code_block_size = sizeof vmp2::v4::code_block_t + ( code_block.jcc.block_addr.size() * 8 ) + sizeof(vmp2::v4::code_block_t) +
code_block.vinstrs.size() * sizeof vm::instrs::virt_instr_t; (code_block.jcc.block_addr.size() * 8) +
code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
vmp2::v4::code_block_t *_code_block = vmp2::v4::code_block_t *_code_block =
reinterpret_cast< vmp2::v4::code_block_t * >( malloc( _code_block_size ) ); reinterpret_cast<vmp2::v4::code_block_t *>(
malloc(_code_block_size));
// serialize block meta data... // serialize block meta data...
_code_block->vip_begin = code_block.vip_begin; _code_block->vip_begin = code_block.vip_begin;
@ -310,7 +359,8 @@ int __cdecl main( int argc, const char *argv[] )
_code_block->branch_addr[idx] = code_block.jcc.block_addr[idx]; _code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>( auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>(
reinterpret_cast< std::uintptr_t >( _code_block ) + sizeof vmp2::v4::code_block_t + reinterpret_cast<std::uintptr_t>(_code_block) +
sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8)); (code_block.jcc.block_addr.size() * 8));
for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx) for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx)
@ -323,7 +373,8 @@ int __cdecl main( int argc, const char *argv[] )
sizeof(vmp2::v4::rtn_t::vm_enter_offset) + sizeof(vmp2::v4::rtn_t::vm_enter_offset) +
sizeof(vmp2::v4::rtn_t::code_block_count); sizeof(vmp2::v4::rtn_t::code_block_count);
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void {
code_blocks_size += vmp2_block->next_block_offset; code_blocks_size += vmp2_block->next_block_offset;
}); });
@ -331,72 +382,18 @@ int __cdecl main( int argc, const char *argv[] )
rtn.code_block_count = vmp2_blocks.size(); rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_enter_offset; rtn.vm_enter_offset = vm_enter_offset;
output.write( reinterpret_cast< const char * >( &rtn ), sizeof( vmp2::v4::rtn_t::size ) + output.write(reinterpret_cast<const char *>(&rtn),
sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) + sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset)); sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
output.write( reinterpret_cast< const char * >( vmp2_block ), vmp2_block->next_block_offset ); [&](vmp2::v4::code_block_t *vmp2_block) -> void {
output.write(reinterpret_cast<const char *>(vmp2_block),
vmp2_block->next_block_offset);
free(vmp2_block); free(vmp2_block);
}); });
} }
output.close(); output.close();
} }
else if ( parser.exists( "bin" ) && parser.exists( "locateconst" ) )
{
const auto module_base = reinterpret_cast< std::uintptr_t >(
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
const auto const_val = std::strtoull( parser.get< std::string >( "locateconst" ).c_str(), nullptr, 16 );
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() );
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage;
auto vm_handler_tables = vm::locate::all_handler_tables( module_base );
auto vm_enters = vm::locate::all_vm_enters( module_base, vm_handler_tables );
std::printf( "> number of vm enters = %d\n", vm_enters.size() );
for ( const auto &[ vm_enter_offset, encrypted_rva ] : vm_enters )
{
std::printf( "> emulating vm enter at rva = 0x%x\n", vm_enter_offset );
vm::ctx_t vm_ctx( module_base, image_base, image_size, vm_enter_offset );
if ( !vm_ctx.init() )
{
std::printf( "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is"
"protected with VMProtect 2...\n" );
return -1;
}
vm::emu_t emu( &vm_ctx );
if ( !emu.init() )
{
std::printf( "[!] failed to init emulator...\n" );
return -1;
}
std::vector< vm::instrs::code_block_t > code_blocks;
if ( !emu.get_trace( code_blocks ) )
{
std::printf( "[!] something failed during tracing, review the console for more information...\n" );
return -1;
}
std::printf( "> number of blocks = %d\n", code_blocks.size() );
for ( auto &code_block : code_blocks )
{
for ( const auto &vinstr : code_block.vinstrs )
{
if ( vinstr.operand.has_imm && vinstr.operand.imm.u == const_val )
{
std::printf( "> found constant in vm enter at = 0x%x\n", vm_enter_offset );
std::getchar();
}
}
}
}
}
} }

580
src/unpacker.cpp
Unescape View File

@ -1,49 +1,44 @@
#include <unpacker.hpp> #include <unpacker.hpp>
namespace engine namespace engine {
{ unpack_t::unpack_t(const std::string &module_name,
unpack_t::unpack_t( const std::vector< std::uint8_t > &packed_bin ) const std::vector<std::uint8_t> &packed_bin)
: bin( packed_bin ), uc_ctx( nullptr ), heap_offset( 0ull ), pack_section_offset( 0ull ) : module_name(module_name),
{ bin(packed_bin),
uc_ctx(nullptr),
heap_offset(0ull),
pack_section_offset(0ull) {
win_img = reinterpret_cast<win::image_t<> *>(bin.data()); win_img = reinterpret_cast<win::image_t<> *>(bin.data());
img_base = win_img->get_nt_headers()->optional_header.image_base; img_base = win_img->get_nt_headers()->optional_header.image_base;
img_size = win_img->get_nt_headers()->optional_header.size_image; img_size = win_img->get_nt_headers()->optional_header.size_image;
std::printf("> image base = 0x%p, image size = 0x%x\n", img_base, img_size); std::printf("> image base = 0x%p, image size = 0x%x\n", img_base, img_size);
} }
unpack_t::~unpack_t( void ) unpack_t::~unpack_t(void) {
{ if (uc_ctx) uc_close(uc_ctx);
if ( uc_ctx )
uc_close( uc_ctx );
for (auto &ptr : uc_hooks) for (auto &ptr : uc_hooks)
if ( ptr ) if (ptr) delete ptr;
delete ptr;
} }
bool unpack_t::init( void ) bool unpack_t::init(void) {
{
uc_err err; uc_err err;
if ( ( err = uc_open( UC_ARCH_X86, UC_MODE_64, &uc_ctx ) ) ) if ((err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc_ctx))) {
{
std::printf("> uc_open err = %d\n", err); std::printf("> uc_open err = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_map( uc_ctx, IAT_VECTOR_TABLE, PAGE_4KB, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, IAT_VECTOR_TABLE, PAGE_4KB, UC_PROT_ALL))) {
{
std::printf("> uc_mem_map iat vector table err = %d\n", err); std::printf("> uc_mem_map iat vector table err = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_map( uc_ctx, STACK_BASE, STACK_SIZE, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, STACK_BASE, STACK_SIZE, UC_PROT_ALL))) {
{
std::printf("> uc_mem_map stack err, reason = %d\n", err); std::printf("> uc_mem_map stack err, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_map( uc_ctx, img_base, img_size, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, img_base, img_size, UC_PROT_ALL))) {
{
std::printf("> map memory failed, reason = %d\n", err); std::printf("> map memory failed, reason = %d\n", err);
return false; return false;
} }
@ -53,8 +48,7 @@ namespace engine
{ {
memset(c3_page, 0xC3, PAGE_4KB); memset(c3_page, 0xC3, PAGE_4KB);
if ( ( err = uc_mem_write( uc_ctx, IAT_VECTOR_TABLE, c3_page, PAGE_4KB ) ) ) if ((err = uc_mem_write(uc_ctx, IAT_VECTOR_TABLE, c3_page, PAGE_4KB))) {
{
std::printf("> failed to init iat vector table...\n"); std::printf("> failed to init iat vector table...\n");
free(c3_page); free(c3_page);
return false; return false;
@ -63,31 +57,38 @@ namespace engine
free(c3_page); free(c3_page);
map_bin.resize(img_size); map_bin.resize(img_size);
memcpy( map_bin.data(), bin.data(), // copies pe headers (includes section headers) memcpy(map_bin.data(),
bin.data(), // copies pe headers (includes section headers)
win_img->get_nt_headers()->optional_header.size_headers); win_img->get_nt_headers()->optional_header.size_headers);
win::section_header_t *sec_begin = win_img->get_nt_headers()->get_sections(), win::section_header_t *sec_begin = win_img->get_nt_headers()->get_sections(),
*sec_end = sec_begin + win_img->get_nt_headers()->file_header.num_sections; *sec_end =
sec_begin +
std::for_each( sec_begin, sec_end, [ & ]( const win::section_header_t &sec_header ) { win_img->get_nt_headers()->file_header.num_sections;
memcpy( map_bin.data() + sec_header.virtual_address, bin.data() + sec_header.ptr_raw_data,
sec_header.size_raw_data ); std::for_each(
sec_begin, sec_end, [&](const win::section_header_t &sec_header) {
memcpy(map_bin.data() + sec_header.virtual_address,
bin.data() + sec_header.ptr_raw_data, sec_header.size_raw_data);
}); });
auto basereloc_dir = win_img->get_directory( win::directory_id::directory_entry_basereloc ); auto basereloc_dir =
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + map_bin.data() ); win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>(
basereloc_dir->rva + map_bin.data());
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t *reloc_block = &reloc_dir->first_block;
// apply relocations to all sections... // apply relocations to all sections...
while ( reloc_block->base_rva && reloc_block->size_block ) while (reloc_block->base_rva && reloc_block->size_block) {
{ std::for_each(
std::for_each( reloc_block->begin(), reloc_block->end(), [ & ]( win::reloc_entry_t &entry ) { reloc_block->begin(), reloc_block->end(),
switch ( entry.type ) [&](win::reloc_entry_t &entry) {
{ switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: case win::reloc_type_id::rel_based_dir64: {
{ auto reloc_at = reinterpret_cast<std::uintptr_t *>(
auto reloc_at = entry.offset + reloc_block->base_rva + map_bin.data());
reinterpret_cast< std::uintptr_t * >( entry.offset + reloc_block->base_rva + map_bin.data() );
*reloc_at = img_base + ((*reloc_at) - img_base); *reloc_at = img_base + ((*reloc_at) - img_base);
break; break;
@ -100,115 +101,105 @@ namespace engine
reloc_block = reloc_block->next(); reloc_block = reloc_block->next();
} }
// iat hook specific function... // install iat hooks...
for (auto import_dir = reinterpret_cast<win::import_directory_t *>( for (auto import_dir = reinterpret_cast<win::import_directory_t *>(
win_img->get_directory( win::directory_id::directory_entry_import )->rva + map_bin.data() ); win_img->get_directory(win::directory_id::directory_entry_import)
import_dir->rva_name; ++import_dir ) ->rva +
{ map_bin.data());
for ( auto iat_thunk = import_dir->rva_name; ++import_dir) {
reinterpret_cast< win::image_thunk_data_t<> * >( import_dir->rva_first_thunk + map_bin.data() ); for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>(
iat_thunk->address; ++iat_thunk ) import_dir->rva_first_thunk + map_bin.data());
{ iat_thunk->address; ++iat_thunk) {
if ( iat_thunk->is_ordinal ) if (iat_thunk->is_ordinal) continue;
continue;
auto iat_name = reinterpret_cast< win::image_named_import_t * >( iat_thunk->address + map_bin.data() ); auto iat_name = reinterpret_cast<win::image_named_import_t *>(
iat_thunk->address + map_bin.data());
if ( iat_hooks.find( iat_name->name ) != iat_hooks.end() ) if (iat_hooks.find(iat_name->name) != iat_hooks.end()) {
iat_thunk->function = iat_hooks[ iat_name->name ].first + IAT_VECTOR_TABLE; std::printf("> iat hooking %s to vector table %p\n", iat_name->name,
iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE);
iat_thunk->function =
iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE;
}
} }
} }
// map the entire map buffer into unicorn-engine since we have set everything else up... // map the entire map buffer into unicorn-engine since we have set everything
if ( ( err = uc_mem_write( uc_ctx, img_base, map_bin.data(), map_bin.size() ) ) ) // else up...
{ if ((err = uc_mem_write(uc_ctx, img_base, map_bin.data(), map_bin.size()))) {
std::printf("> failed to write memory... reason = %d\n", err); std::printf("> failed to write memory... reason = %d\n", err);
return false; return false;
} }
// setup unicorn-engine hooks on IAT vector table, sections with 0 raw size/ptr, and an invalid memory // setup unicorn-engine hooks on IAT vector table, sections with 0 raw
// handler... // size/ptr, and an invalid memory handler...
uc_hooks.push_back(new uc_hook); uc_hooks.push_back(new uc_hook);
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE, &engine::unpack_t::iat_dispatcher, this, if ((err = uc_hook_add(uc_ctx, uc_hooks.back(), UC_HOOK_CODE,
IAT_VECTOR_TABLE, IAT_VECTOR_TABLE + PAGE_4KB ) ) ) (void *)&engine::unpack_t::iat_dispatcher, this,
{ IAT_VECTOR_TABLE, IAT_VECTOR_TABLE + PAGE_4KB))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
uc_hooks.push_back(new uc_hook); uc_hooks.push_back(new uc_hook);
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), if ((err = uc_hook_add(
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_FETCH_UNMAPPED | uc_ctx, uc_hooks.back(),
UC_HOOK_INSN_INVALID, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED |
&engine::unpack_t::invalid_mem, this, true, false ) ) ) UC_HOOK_MEM_FETCH_UNMAPPED | UC_HOOK_INSN_INVALID,
{ (void *)&engine::unpack_t::invalid_mem, this, true, false))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
// execution break points on all sections that are executable but have no physical size on disk... // execution break points on all sections that are executable but have no
std::for_each( sec_begin, sec_end, [ & ]( win::section_header_t &header ) { // physical size on disk...
if ( !header.ptr_raw_data && !header.size_raw_data && header.characteristics.mem_execute && std::for_each(sec_begin, sec_end, [&](const win::section_header_t &header) {
header.characteristics.mem_write && !header.is_discardable() ) if (!header.ptr_raw_data && !header.size_raw_data &&
{ header.characteristics.mem_execute &&
header.characteristics.mem_write && !header.is_discardable()) {
uc_hooks.push_back(new uc_hook); uc_hooks.push_back(new uc_hook);
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE | UC_HOOK_MEM_WRITE, if ((err = uc_hook_add(
&engine::unpack_t::unpack_section_callback, this, uc_ctx, uc_hooks.back(), UC_HOOK_CODE | UC_HOOK_MEM_WRITE,
(void *)&engine::unpack_t::unpack_section_callback, this,
header.virtual_address + img_base, header.virtual_address + img_base,
header.virtual_address + header.virtual_size + img_base ) ) ) header.virtual_address + header.virtual_size + img_base))) {
{
std::printf("> failed to add hook... reason = %d\n", err); std::printf("> failed to add hook... reason = %d\n", err);
return false; return;
} }
pack_section_offset = header.virtual_address + header.virtual_size; pack_section_offset = header.virtual_address + header.virtual_size;
} }
else if ( header.characteristics.mem_execute )
{
uc_hooks.push_back( new uc_hook );
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE, &engine::unpack_t::code_exec_callback,
this, header.virtual_address + img_base,
header.virtual_address + header.virtual_size + img_base ) ) )
{
std::printf( "> failed to add hook... reason = %d\n", err );
return false;
}
}
}); });
return true; return true;
} }
bool unpack_t::unpack( std::vector< std::uint8_t > &output ) bool unpack_t::unpack(std::vector<std::uint8_t> &output) {
{
uc_err err; uc_err err;
auto nt_headers = win_img->get_nt_headers(); auto nt_headers = win_img->get_nt_headers();
std::uintptr_t rip = nt_headers->optional_header.entry_point + img_base, rsp = STACK_BASE + STACK_SIZE; std::uintptr_t rip = nt_headers->optional_header.entry_point + img_base,
rsp = STACK_BASE + STACK_SIZE;
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RSP, &rsp ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RSP, &rsp))) {
{
std::printf("> uc_reg_write error, reason = %d\n", err); std::printf("> uc_reg_write error, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RIP, &rip ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RIP, &rip))) {
{
std::printf("> uc_reg_write error, reason = %d\n", err); std::printf("> uc_reg_write error, reason = %d\n", err);
return false; return false;
} }
std::printf( "> beginning execution at = 0x%p\n", rip ); std::printf("> beginning execution at = %p\n", rip);
if ( ( err = uc_emu_start( uc_ctx, rip, 0ull, 0ull, 0ull ) ) ) if ((err = uc_emu_start(uc_ctx, rip, 0ull, 0ull, 0ull))) {
{
std::printf("> error starting emu... reason = %d\n", err); std::printf("> error starting emu... reason = %d\n", err);
return false; return false;
} }
output.resize(img_size); output.resize(img_size);
if ( ( err = uc_mem_read( uc_ctx, img_base, output.data(), output.size() ) ) ) if ((err = uc_mem_read(uc_ctx, img_base, output.data(), output.size()))) {
{
std::printf("> uc_mem_read failed... err = %d\n", err); std::printf("> uc_mem_read failed... err = %d\n", err);
return false; return false;
} }
@ -221,30 +212,30 @@ namespace engine
std::map<std::uint32_t, std::vector<std::uint16_t> > new_relocs; std::map<std::uint32_t, std::vector<std::uint16_t> > new_relocs;
// search executable sections for MOV RAX, 00 00 00 00 00 00 00 00... // search executable sections for MOV RAX, 00 00 00 00 00 00 00 00...
std::for_each( sections, sections + section_cnt, [ & ]( win::section_header_t &header ) { std::for_each(
if ( header.characteristics.mem_execute ) sections, sections + section_cnt, [&](win::section_header_t &header) {
{ if (header.characteristics.mem_execute) {
auto result = output.data() + header.virtual_address; auto result = output.data() + header.virtual_address;
do do {
{ result = reinterpret_cast<std::uint8_t *>(vm::locate::sigscan(
result = reinterpret_cast< std::uint8_t * >( xtils::um_t::get_instance()->sigscan(
result, result,
header.virtual_size - header.virtual_size -
(reinterpret_cast<std::uintptr_t>(result) - (reinterpret_cast<std::uintptr_t>(result) -
( header.virtual_address + reinterpret_cast< std::uintptr_t >( output.data() ) ) ), (header.virtual_address +
reinterpret_cast<std::uintptr_t>(output.data()))),
MOV_RAX_0_SIG, MOV_RAX_0_MASK)); MOV_RAX_0_SIG, MOV_RAX_0_MASK));
if ( result ) if (result) {
{
result += 2; // advance ahead of the 0x48 0xB8... result += 2; // advance ahead of the 0x48 0xB8...
// offset from section begin... // offset from section begin...
auto reloc_offset = auto reloc_offset = (reinterpret_cast<std::uintptr_t>(result)) -
( reinterpret_cast< std::uintptr_t >( result ) ) - reinterpret_cast<std::uintptr_t>(
reinterpret_cast< std::uintptr_t >( output.data() + header.virtual_address ); output.data() + header.virtual_address);
new_relocs[ ( header.virtual_address + reloc_offset ) & ~0xFFFull ].push_back( reloc_offset ); new_relocs[(header.virtual_address + reloc_offset) & ~0xFFFull]
.push_back(reloc_offset);
} }
} while (result); } while (result);
@ -260,14 +251,14 @@ namespace engine
auto sections = img->get_nt_headers()->get_sections(); auto sections = img->get_nt_headers()->get_sections();
auto section_cnt = img->get_file_header()->num_sections; auto section_cnt = img->get_file_header()->num_sections;
auto basereloc_dir = img->get_directory( win::directory_id::directory_entry_basereloc ); auto basereloc_dir =
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + output.data() ); img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>(
basereloc_dir->rva + output.data());
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t *reloc_block = &reloc_dir->first_block;
while ( reloc_block->base_rva && reloc_block->size_block ) while (reloc_block->base_rva && reloc_block->size_block) {
{ if (reloc_block->base_rva == page) return true;
if ( reloc_block->base_rva == page )
return true;
reloc_block = reloc_block->next(); reloc_block = reloc_block->next();
} }
@ -279,36 +270,36 @@ namespace engine
std::size_t resize_cnt = 0ull; std::size_t resize_cnt = 0ull;
for (const auto &[reloc_rva, relocs] : new_relocs) for (const auto &[reloc_rva, relocs] : new_relocs)
if (!has_reloc_page(reloc_rva)) if (!has_reloc_page(reloc_rva))
resize_cnt += sizeof( win::reloc_block_t ) + ( relocs.size() * sizeof( win::reloc_entry_t ) ); resize_cnt += sizeof(win::reloc_block_t) +
(relocs.size() * sizeof(win::reloc_entry_t));
// last block needs to contain 0 for block_rva and size_block... // last block needs to contain 0 for block_rva and size_block...
if ( resize_cnt ) if (resize_cnt) resize_cnt += sizeof(win::reloc_block_t);
resize_cnt += sizeof win::reloc_block_t;
output.resize(output.size() + resize_cnt); output.resize(output.size() + resize_cnt);
output_img = reinterpret_cast<win::image_t<> *>(output.data()); output_img = reinterpret_cast<win::image_t<> *>(output.data());
auto basereloc_dir = output_img->get_directory( win::directory_id::directory_entry_basereloc ); auto basereloc_dir =
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + output.data() ); output_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>(
basereloc_dir->rva + output.data());
basereloc_dir->size += resize_cnt; basereloc_dir->size += resize_cnt;
for ( const auto &[ reloc_rva, relocs ] : new_relocs ) for (const auto &[reloc_rva, relocs] : new_relocs) {
{ if (has_reloc_page(reloc_rva)) continue;
if ( has_reloc_page( reloc_rva ) )
continue;
win::reloc_block_t *reloc_block = &reloc_dir->first_block; win::reloc_block_t *reloc_block = &reloc_dir->first_block;
while (reloc_block->base_rva && reloc_block->size_block) while (reloc_block->base_rva && reloc_block->size_block)
reloc_block = reloc_block->next(); reloc_block = reloc_block->next();
reloc_block->base_rva = reloc_rva; reloc_block->base_rva = reloc_rva;
reloc_block->size_block = relocs.size() * sizeof( win::reloc_entry_t ) + sizeof uint64_t; reloc_block->size_block =
relocs.size() * sizeof(win::reloc_entry_t) + sizeof(uint64_t);
reloc_block->next()->base_rva = 0ull; reloc_block->next()->base_rva = 0ull;
reloc_block->next()->size_block = 0ull; reloc_block->next()->size_block = 0ull;
for ( auto idx = 0u; idx < relocs.size(); ++idx ) for (auto idx = 0u; idx < relocs.size(); ++idx) {
{
reloc_block->entries[idx].type = win::reloc_type_id::rel_based_dir64; reloc_block->entries[idx].type = win::reloc_type_id::rel_based_dir64;
reloc_block->entries[idx].offset = relocs[idx]; reloc_block->entries[idx].offset = relocs[idx];
} }
@ -316,20 +307,18 @@ namespace engine
return true; return true;
} }
void unpack_t::local_alloc_hook( uc_engine *uc_ctx, unpack_t *obj ) void unpack_t::local_alloc_hook(uc_engine *uc_ctx, unpack_t *obj) {
{
uc_err err; uc_err err;
std::uintptr_t rax, rdx; std::uintptr_t rax, rdx;
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RDX, &rdx ) ) ) if ((err = uc_reg_read(uc_ctx, UC_X86_REG_RDX, &rdx))) {
{
std::printf("> failed to read RDX... reason = %d\n", rdx); std::printf("> failed to read RDX... reason = %d\n", rdx);
return; return;
} }
auto size = ((rdx + PAGE_4KB) & ~0xFFFull); auto size = ((rdx + PAGE_4KB) & ~0xFFFull);
if ( ( err = uc_mem_map( uc_ctx, HEAP_BASE + obj->heap_offset, size, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, HEAP_BASE + obj->heap_offset, size,
{ UC_PROT_ALL))) {
std::printf("> failed to allocate memory... reason = %d\n", err); std::printf("> failed to allocate memory... reason = %d\n", err);
return; return;
} }
@ -337,32 +326,136 @@ namespace engine
rax = HEAP_BASE + obj->heap_offset; rax = HEAP_BASE + obj->heap_offset;
obj->heap_offset += size; obj->heap_offset += size;
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &rax ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RAX, &rax))) {
{
std::printf("> failed to write rax... reason = %d\n", err); std::printf("> failed to write rax... reason = %d\n", err);
return; return;
} }
} }
void unpack_t::local_free_hook( uc_engine *uc_ctx, unpack_t *obj ) void unpack_t::local_free_hook(uc_engine *uc_ctx, unpack_t *obj) {
{
uc_err err; uc_err err;
std::uintptr_t rax = 0ull; std::uintptr_t rax = 0ull;
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &rax ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RAX, &rax))) {
{
std::printf("> failed to write rax... reason = %d\n", err); std::printf("> failed to write rax... reason = %d\n", err);
return; return;
} }
} }
void unpack_t::load_library_hook( uc_engine *uc_ctx, unpack_t *obj ) void unpack_t::unmap_view_of_file_hook(uc_engine *uc, unpack_t *obj) {
{ std::uintptr_t rcx, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
std::printf("> UnmapViewOfFile(%p)\n", rcx);
}
void unpack_t::close_handle_hook(uc_engine *uc, unpack_t *obj) {
std::uintptr_t rcx, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
std::printf("> CloseHandle(%x)\n", rcx);
}
void unpack_t::get_module_file_name_w_hook(uc_engine *uc, unpack_t *obj) {
uc_err err;
std::uintptr_t rcx, rdx, r8;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
uc_reg_read(uc, UC_X86_REG_R8, &r8);
std::printf("> GetModuleFileNameW(%p, %p, %d)\n", rcx, rdx, r8);
uc_strcpy(uc, rdx, (char *)obj->module_name.c_str());
std::uint32_t size = obj->module_name.size();
uc_reg_write(uc, UC_X86_REG_RAX, &size);
}
void unpack_t::create_file_w_hook(uc_engine *uc, unpack_t *obj) {
char buff[256];
std::uintptr_t rcx, rax = PACKED_FILE_HANDLE;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_strcpy(uc, buff, rcx);
std::printf("> CreateFileW(%s)\n", buff);
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
}
void unpack_t::get_file_size_hook(uc_engine *uc, unpack_t *obj) {
std::uintptr_t rcx, rdx, rax;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
std::printf("> GetFileSize(%x, %p)\n", rcx, rdx);
if (rcx == PACKED_FILE_HANDLE) {
rax = obj->bin.size();
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
} else {
std::printf("> asking for file size to unknown handle = %x\n", rcx);
uc_emu_stop(uc);
}
}
void unpack_t::create_file_mapping_hook(uc_engine *uc, unpack_t *obj) {
std::uintptr_t rcx, r8, rax = PACKED_FILE_HANDLE;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_R8, &r8);
std::printf("> CreateFileMappingW(%x, %x)\n", rcx, r8);
if (rcx == PACKED_FILE_HANDLE) {
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
} else {
std::printf("> asking to create mapping for unknown handle = %x\n", rcx);
uc_emu_stop(uc);
}
}
void unpack_t::map_view_of_file_hook(uc_engine *uc, unpack_t *obj) {
std::uintptr_t rcx, rdx, r8, r9, rax;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
uc_reg_read(uc, UC_X86_REG_R8, &r8);
uc_reg_read(uc, UC_X86_REG_R9, &r9);
std::printf("> MapViewOfFile(%x, %x, %x, %x)\n", rcx, rdx, r8, r9);
if (rcx == PACKED_FILE_HANDLE) {
uc_err err;
auto size = ((obj->bin.size() + PAGE_4KB) & ~0xFFFull);
if ((err =
uc_mem_map(uc, HEAP_BASE + obj->heap_offset, size, UC_PROT_ALL))) {
std::printf("> failed to allocate memory... reason = %d\n", err);
return;
}
rax = HEAP_BASE + obj->heap_offset;
obj->heap_offset += size;
if ((err = uc_mem_write(uc, rax, obj->bin.data(), obj->bin.size()))) {
std::printf("> failed to map view of file... reason = %d\n", err);
return;
}
if ((err = uc_reg_write(uc, UC_X86_REG_RAX, &rax))) {
std::printf("> failed to write rax... reason = %d\n", err);
return;
}
} else {
std::printf("> asking to map file for unknown handle = %x\n", rcx);
uc_emu_stop(uc);
}
}
void unpack_t::virtual_protect_hook(uc_engine *uc, unpack_t *obj) {
std::uintptr_t rcx, rdx, r8, r9, rax = true;
uc_reg_read(uc, UC_X86_REG_RCX, &rcx);
uc_reg_read(uc, UC_X86_REG_RDX, &rdx);
uc_reg_read(uc, UC_X86_REG_R8, &r8);
uc_reg_read(uc, UC_X86_REG_R9, &r9);
std::printf("> VirtualProtect(%p, %x, %x, %p)\n", rcx, rdx, r8, r9);
uc_reg_write(uc, UC_X86_REG_RAX, &rax);
}
void unpack_t::load_library_hook(uc_engine *uc_ctx, unpack_t *obj) {
uc_err err; uc_err err;
std::uintptr_t rcx = 0ull; std::uintptr_t rcx = 0ull;
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RCX, &rcx ) ) ) if ((err = uc_reg_read(uc_ctx, UC_X86_REG_RCX, &rcx))) {
{
std::printf("> uc_reg_read error, reason = %d\n", err); std::printf("> uc_reg_read error, reason = %d\n", err);
return; return;
} }
@ -371,133 +464,154 @@ namespace engine
uc_strcpy(uc_ctx, buff, rcx); uc_strcpy(uc_ctx, buff, rcx);
std::printf("> LoadLibraryA(\"%s\")\n", buff); std::printf("> LoadLibraryA(\"%s\")\n", buff);
auto module_base = reinterpret_cast< std::uintptr_t >( LoadLibraryA( buff ) ); if (!obj->loaded_modules[buff]) {
std::printf("> loading library from disk...\n");
std::vector<std::uint8_t> module_data, tmp;
if (!vm::util::open_binary_file(buff, module_data)) {
std::printf(
"> failed to open a dependency... please put %s in the same folder "
"as vmemu...\n",
buff);
exit(-1);
}
auto img = reinterpret_cast<win::image_t<> *>(module_data.data());
auto image_size = img->get_nt_headers()->optional_header.size_image;
tmp.resize(image_size);
std::memcpy(tmp.data(), module_data.data(), PAGE_4KB);
std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections,
[&](const auto &section_header) {
std::memcpy(
tmp.data() + section_header.virtual_address,
module_data.data() + section_header.ptr_raw_data,
section_header.size_raw_data);
});
auto module_size = const auto module_base = reinterpret_cast<std::uintptr_t>(tmp.data());
reinterpret_cast< win::image_t<> * >( module_base )->get_nt_headers()->optional_header.size_image; img = reinterpret_cast<win::image_t<> *>(module_base);
const auto image_base = img->get_nt_headers()->optional_header.image_base;
const auto alloc_addr = module_base & ~0xFFFull;
obj->loaded_modules[buff] = alloc_addr;
if ( std::find( obj->loaded_modules.begin(), obj->loaded_modules.end(), module_base ) != // install iat hooks...
obj->loaded_modules.end() ) for (auto import_dir = reinterpret_cast<win::import_directory_t *>(
{ img->get_directory(win::directory_id::directory_entry_import)
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &module_base ) ) ) ->rva +
{ module_base);
std::printf( "> failed to set rax... reason = %d\n", err ); import_dir->rva_name; ++import_dir) {
return; for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>(
import_dir->rva_first_thunk + module_base);
iat_thunk->address; ++iat_thunk) {
if (iat_thunk->is_ordinal) continue;
auto iat_name = reinterpret_cast<win::image_named_import_t *>(
iat_thunk->address + module_base);
if (obj->iat_hooks.find(iat_name->name) != obj->iat_hooks.end()) {
std::printf("> iat hooking %s to vector table %p\n", iat_name->name,
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE);
iat_thunk->function =
obj->iat_hooks[iat_name->name].first + IAT_VECTOR_TABLE;
} }
} }
else }
{
if ( ( err = uc_mem_map( uc_ctx, module_base, module_size, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, alloc_addr, image_size, UC_PROT_ALL))) {
{
std::printf("> failed to load library... reason = %d\n", err); std::printf("> failed to load library... reason = %d\n", err);
return; return;
} }
if ( ( err = uc_mem_write( uc_ctx, module_base, reinterpret_cast< void * >( module_base ), module_size ) ) ) if ((err = uc_mem_write(uc_ctx, alloc_addr, tmp.data(), image_size))) {
{ std::printf("> failed to copy module into emulator... reason = %d\n",
std::printf( "> failed to copy module into emulator... reason = %d\n", err ); err);
return; return;
} }
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &module_base ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RAX, &alloc_addr))) {
{
std::printf("> failed to set rax... reason = %d\n", err); std::printf("> failed to set rax... reason = %d\n", err);
return; return;
} }
std::printf("> mapped %s to base address %p\n", buff, alloc_addr);
obj->loaded_modules.push_back( module_base ); } else {
const auto alloc_addr = obj->loaded_modules[buff];
std::printf("> library already loaded... returning %p...\n", alloc_addr);
if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RAX, &alloc_addr))) {
std::printf("> failed to set rax... reason = %d\n", err);
return;
} }
} }
} // namespace engine
void unpack_t::uc_strcpy( uc_engine *uc_ctx, char *buff, std::uintptr_t addr ) void unpack_t::uc_strcpy(uc_engine *uc_ctx, char *buff, std::uintptr_t addr) {
{
uc_err err; uc_err err;
char i = 0u; char i = 0u;
auto idx = 0ul; auto idx = 0ul;
do do {
{ if ((err = uc_mem_read(uc_ctx, addr + idx, &i, sizeof i))) {
if ( ( err = uc_mem_read( uc_ctx, addr + idx, &i, sizeof i ) ) ) std::printf("[!] error reading string byte... reason = %d\n", err);
break; break;
}
} while ((buff[idx++] = i)); } while ((buff[idx++] = i));
} }
bool unpack_t::iat_dispatcher( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack ) void unpack_t::uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff) {
{ uc_err err;
auto vec = address - IAT_VECTOR_TABLE; for (char idx = 0u, c = buff[idx]; buff[idx]; ++idx, c = buff[idx]) {
for ( auto &[ iat_name, iat_hook_data ] : unpack->iat_hooks ) if ((err = uc_mem_write(uc, addr + idx, &c, sizeof c))) {
{ std::printf("[!] error writing string byte... reason = %d\n", err);
if ( iat_hook_data.first == vec ) break;
{
std::printf( "> hooking import = %s\n", iat_name.c_str() );
iat_hook_data.second( uc, unpack );
return true;
} }
} }
return false;
}
bool unpack_t::code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack )
{
static ZydisDecoder decoder;
static ZydisFormatter formatter;
static ZydisDecodedInstruction instr;
if ( static std::atomic< bool > once{ false }; !once.exchange( true ) )
{
ZydisDecoderInit( &decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64 );
ZydisFormatterInit( &formatter, ZYDIS_FORMATTER_STYLE_INTEL );
} }
auto instr_ptr = reinterpret_cast< void * >( unpack->map_bin.data() + ( address - unpack->img_base ) ); bool unpack_t::iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size,
if ( ZYAN_SUCCESS( ZydisDecoderDecodeBuffer( &decoder, instr_ptr, PAGE_4KB, &instr ) ) ) unpack_t *unpack) {
{ auto vec = address - IAT_VECTOR_TABLE;
if ( instr.mnemonic == ZYDIS_MNEMONIC_CALL && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER && for (auto &[iat_name, iat_hook_data] : unpack->iat_hooks) {
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX ) if (iat_hook_data.first == vec) {
{ iat_hook_data.second(uc, unpack);
std::uintptr_t rax = 0u, rip = 0u; return true;
uc_reg_read( uc, UC_X86_REG_RAX, &rax );
uc_reg_read( uc, UC_X86_REG_RIP, &rip );
if ( rax > unpack->img_base + unpack->img_size ) // skip calls to kernel32.dll...
{
rip += instr.length;
uc_reg_write( uc, UC_X86_REG_RIP, &rip );
}
} }
} }
return false;
return true;
} }
bool unpack_t::unpack_section_callback( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, bool unpack_t::unpack_section_callback(uc_engine *uc, uc_mem_type type,
unpack_t *unpack ) uint64_t address, int size,
{ int64_t value, unpack_t *unpack) {
if ( address == unpack->pack_section_offset + unpack->img_base ) if (address == unpack->pack_section_offset + unpack->img_base) {
{ std::printf("> last byte written to unpack section... dumping...\n");
std::printf( "> dumping...\n" );
uc_emu_stop(uc); uc_emu_stop(uc);
return false; return false;
} }
return true; return true;
} }
void unpack_t::invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, void unpack_t::invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
unpack_t *unpack ) int size, int64_t value, unpack_t *unpack) {
{ switch (type) {
switch ( type ) case UC_MEM_READ_UNMAPPED: {
{ uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);
case UC_MEM_READ_UNMAPPED: std::printf(">>> reading invalid memory at address = %p, size = 0x%x\n",
std::printf( ">>> reading invalid memory at address = 0x%p, size = 0x%x\n", address, size ); address, size);
break; break;
case UC_MEM_WRITE_UNMAPPED: }
std::printf( ">>> writing invalid memory at address = 0x%p, size = 0x%x, val = 0x%x\n", address, size, case UC_MEM_WRITE_UNMAPPED: {
value ); uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);
std::printf(
">>> writing invalid memory at address = %p, size = 0x%x, val = "
"0x%x\n",
address, size, value);
break; break;
case UC_MEM_FETCH_UNMAPPED: }
{ case UC_MEM_FETCH_UNMAPPED: {
std::printf( ">>> fetching invalid instructions at address = 0x%p\n", address ); std::printf(">>> fetching invalid instructions at address = %p\n",
address);
break; break;
} }
default: default:

538
src/vmemu_t.cpp
Unescape View File

@ -1,83 +1,111 @@
#include "vmemu_t.hpp" #include "vmemu_t.hpp"
namespace vm namespace vm {
{
emu_t::emu_t(vm::ctx_t *vm_ctx) emu_t::emu_t(vm::ctx_t *vm_ctx)
: g_vm_ctx( vm_ctx ), uc_ctx( nullptr ), img_base( vm_ctx->image_base ), img_size( vm_ctx->image_size ) : g_vm_ctx(vm_ctx),
{ uc_ctx(nullptr),
} img_base(vm_ctx->image_base),
img_size(vm_ctx->image_size) {}
emu_t::~emu_t() emu_t::~emu_t() {
{ if (uc_ctx) uc_close(uc_ctx);
if ( uc_ctx )
uc_close( uc_ctx );
} }
bool emu_t::init() bool emu_t::init() {
{
uc_err err; uc_err err;
if ( ( err = uc_open( UC_ARCH_X86, UC_MODE_64, &uc_ctx ) ) ) if ((err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc_ctx))) {
{
std::printf("> uc_open err = %d\n", err); std::printf("> uc_open err = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_map( uc_ctx, STACK_BASE, STACK_SIZE, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, STACK_BASE, STACK_SIZE, UC_PROT_ALL))) {
{
std::printf("> uc_mem_map stack err, reason = %d\n", err); std::printf("> uc_mem_map stack err, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_map( uc_ctx, g_vm_ctx->module_base, img_size, UC_PROT_ALL ) ) ) if ((err = uc_mem_map(uc_ctx, IAT_VECTOR_TABLE, PAGE_4KB, UC_PROT_ALL))) {
std::printf("> uc_mem_map iat vector table err = %d\n", err);
return false;
}
// init iat vector table full of 'ret' instructions...
auto c3_page = malloc(PAGE_4KB);
{ {
memset(c3_page, 0xC3, PAGE_4KB);
if ((err = uc_mem_write(uc_ctx, IAT_VECTOR_TABLE, c3_page, PAGE_4KB))) {
std::printf("> failed to init iat vector table...\n");
free(c3_page);
return false;
}
}
free(c3_page);
auto win_img = reinterpret_cast<win::image_t<> *>(g_vm_ctx->module_base);
// iat hook all imports to return...
for (auto import_dir = reinterpret_cast<win::import_directory_t *>(
win_img->get_directory(win::directory_id::directory_entry_import)
->rva +
g_vm_ctx->module_base);
import_dir->rva_name; ++import_dir) {
for (auto iat_thunk = reinterpret_cast<win::image_thunk_data_t<> *>(
import_dir->rva_first_thunk + g_vm_ctx->module_base);
iat_thunk->address; ++iat_thunk) {
if (iat_thunk->is_ordinal) continue;
iat_thunk->function = IAT_VECTOR_TABLE;
}
}
if ((err =
uc_mem_map(uc_ctx, g_vm_ctx->module_base, img_size, UC_PROT_ALL))) {
std::printf("> map memory failed, reason = %d\n", err); std::printf("> map memory failed, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_mem_write( uc_ctx, g_vm_ctx->module_base, reinterpret_cast< void * >( g_vm_ctx->module_base ), if ((err = uc_mem_write(uc_ctx, g_vm_ctx->module_base,
img_size ) ) ) reinterpret_cast<void *>(g_vm_ctx->module_base),
{ img_size))) {
std::printf("> failed to write memory... reason = %d\n", err); std::printf("> failed to write memory... reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_hook_add( uc_ctx, &code_exec_hook, UC_HOOK_CODE, &vm::emu_t::code_exec_callback, this, if ((err = uc_hook_add(uc_ctx, &code_exec_hook, UC_HOOK_CODE,
g_vm_ctx->module_base, g_vm_ctx->module_base + img_size ) ) ) (void *)&vm::emu_t::code_exec_callback, this,
{ g_vm_ctx->module_base,
g_vm_ctx->module_base + img_size))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_hook_add( uc_ctx, &int_hook, UC_HOOK_INTR, &vm::emu_t::int_callback, this, 0ull, 0ull ) ) ) if ((err = uc_hook_add(uc_ctx, &int_hook, UC_HOOK_INTR,
{ (void *)&vm::emu_t::int_callback, this, 0ull, 0ull))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_hook_add( uc_ctx, &invalid_mem_hook, if ((err =
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_FETCH_UNMAPPED | uc_hook_add(uc_ctx, &invalid_mem_hook,
UC_HOOK_INSN_INVALID, UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED |
&vm::emu_t::invalid_mem, this, true, false ) ) ) UC_HOOK_MEM_FETCH_UNMAPPED,
{ (void *)&vm::emu_t::invalid_mem, this, true, false))) {
std::printf("> uc_hook_add error, reason = %d\n", err); std::printf("> uc_hook_add error, reason = %d\n", err);
return false; return false;
} }
return true; return true;
} }
bool emu_t::get_trace( std::vector< vm::instrs::code_block_t > &entries ) bool emu_t::get_trace(std::vector<vm::instrs::code_block_t> &entries) {
{
uc_err err; uc_err err;
std::uintptr_t rip = g_vm_ctx->vm_entry_rva + g_vm_ctx->module_base, rsp = STACK_BASE + STACK_SIZE - PAGE_4KB; std::uintptr_t rip = g_vm_ctx->vm_entry_rva + g_vm_ctx->module_base,
rsp = STACK_BASE + STACK_SIZE - PAGE_4KB;
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RSP, &rsp ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RSP, &rsp))) {
{
std::printf("> uc_reg_write error, reason = %d\n", err); std::printf("> uc_reg_write error, reason = %d\n", err);
return false; return false;
} }
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RIP, &rip ) ) ) if ((err = uc_reg_write(uc_ctx, UC_X86_REG_RIP, &rip))) {
{
std::printf("> uc_reg_write error, reason = %d\n", err); std::printf("> uc_reg_write error, reason = %d\n", err);
return false; return false;
} }
@ -86,34 +114,29 @@ namespace vm
code_block_data_t code_block{{}, nullptr, nullptr}; code_block_data_t code_block{{}, nullptr, nullptr};
cc_block = &code_block; cc_block = &code_block;
std::printf( "> beginning execution at = 0x%p\n", rip ); std::printf("> beginning execution at = %p\n", rip);
if ( ( err = uc_emu_start( uc_ctx, rip, 0ull, 0ull, 0ull ) ) ) if ((err = uc_emu_start(uc_ctx, rip, 0ull, 0ull, 0ull))) {
{
std::printf("> error starting emu... reason = %d\n", err); std::printf("> error starting emu... reason = %d\n", err);
return false; return false;
} }
if ( cc_block ) if (cc_block) code_blocks.push_back(code_block);
code_blocks.push_back( code_block );
// code_blocks.size() will continue to grow as all branches are traced... // code_blocks.size() will continue to grow as all branches are traced...
// when idx is > code_blocks.size() then we have traced all branches... // when idx is > code_blocks.size() then we have traced all branches...
for ( auto idx = 0u; idx < code_blocks.size(); ++idx ) for (auto idx = 0u; idx < code_blocks.size(); ++idx) {
{
const auto _code_block = code_blocks[idx]; const auto _code_block = code_blocks[idx];
if ( !_code_block.code_block.jcc.has_jcc ) if (!_code_block.code_block.jcc.has_jcc) continue;
continue;
switch ( _code_block.code_block.jcc.type ) switch (_code_block.code_block.jcc.type) {
{ case vm::instrs::jcc_type::branching: {
case vm::instrs::jcc_type::branching: if (std::find(vip_begins.begin(), vip_begins.end(),
{ _code_block.code_block.jcc.block_addr[1]) ==
if ( std::find( vip_begins.begin(), vip_begins.end(), _code_block.code_block.jcc.block_addr[ 1 ] ) == vip_begins.end()) {
vip_begins.end() )
{
std::uintptr_t rbp = 0ull; std::uintptr_t rbp = 0ull;
std::uint32_t branch_rva = std::uint32_t branch_rva = (_code_block.code_block.jcc.block_addr[1] -
( _code_block.code_block.jcc.block_addr[ 1 ] - g_vm_ctx->module_base ) + g_vm_ctx->image_base; g_vm_ctx->module_base) +
g_vm_ctx->image_base;
// setup object globals so that the tracing will work... // setup object globals so that the tracing will work...
code_block_data_t branch_block{{}, nullptr, nullptr}; code_block_data_t branch_block{{}, nullptr, nullptr};
@ -121,36 +144,37 @@ namespace vm
g_vm_ctx = _code_block.g_vm_ctx.get(); g_vm_ctx = _code_block.g_vm_ctx.get();
// restore register values... // restore register values...
if ( ( err = uc_context_restore( uc_ctx, _code_block.cpu_ctx->context ) ) ) if ((err =
{ uc_context_restore(uc_ctx, _code_block.cpu_ctx->context))) {
std::printf( "> failed to restore emu context... reason = %d\n", err ); std::printf("> failed to restore emu context... reason = %d\n",
err);
return false; return false;
} }
// restore stack values... // restore stack values...
if ( ( err = uc_mem_write( uc_ctx, STACK_BASE, _code_block.cpu_ctx->stack, STACK_SIZE ) ) ) if ((err = uc_mem_write(uc_ctx, STACK_BASE,
{ _code_block.cpu_ctx->stack, STACK_SIZE))) {
std::printf("> failed to restore stack... reason = %d\n", err); std::printf("> failed to restore stack... reason = %d\n", err);
return false; return false;
} }
// get the address in rbp (top of vsp)... then patch the branch rva... // get the address in rbp (top of vsp)... then patch the branch rva...
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RBP, &rbp ) ) ) if ((err = uc_reg_read(uc_ctx, UC_X86_REG_RBP, &rbp))) {
{
std::printf("> failed to read rbp... reason = %d\n", err); std::printf("> failed to read rbp... reason = %d\n", err);
return false; return false;
} }
// patch the branch rva... // patch the branch rva...
if ( ( err = uc_mem_write( uc_ctx, rbp, &branch_rva, sizeof branch_rva ) ) ) if ((err =
{ uc_mem_write(uc_ctx, rbp, &branch_rva, sizeof branch_rva))) {
std::printf("> failed to patch branch rva... reason = %d\n", err); std::printf("> failed to patch branch rva... reason = %d\n", err);
return false; return false;
} }
std::printf( "> beginning execution at = 0x%p\n", _code_block.cpu_ctx->rip ); std::printf("> beginning execution at = %p\n",
if ( ( err = uc_emu_start( uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull, 0ull ) ) ) _code_block.cpu_ctx->rip);
{ if ((err = uc_emu_start(uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull,
0ull))) {
std::printf("> error starting emu... reason = %d\n", err); std::printf("> error starting emu... reason = %d\n", err);
return false; return false;
} }
@ -162,15 +186,14 @@ namespace vm
// drop down and execute the absolute case as well since that // drop down and execute the absolute case as well since that
// will trace the first branch... // will trace the first branch...
} }
case vm::instrs::jcc_type::absolute: case vm::instrs::jcc_type::absolute: {
{ if (std::find(vip_begins.begin(), vip_begins.end(),
if ( std::find( vip_begins.begin(), vip_begins.end(), _code_block.code_block.jcc.block_addr[ 0 ] ) == _code_block.code_block.jcc.block_addr[0]) ==
vip_begins.end() ) vip_begins.end()) {
{
std::uintptr_t rbp = 0ull; std::uintptr_t rbp = 0ull;
std::uint32_t branch_rva = std::uint32_t branch_rva = (_code_block.code_block.jcc.block_addr[0] -
( _code_block.code_block.jcc.block_addr[ 0 ] - g_vm_ctx->module_base ) + g_vm_ctx->image_base; g_vm_ctx->module_base) +
g_vm_ctx->image_base;
// setup object globals so that the tracing will work... // setup object globals so that the tracing will work...
code_block_data_t branch_block{{}, nullptr, nullptr}; code_block_data_t branch_block{{}, nullptr, nullptr};
@ -178,36 +201,37 @@ namespace vm
g_vm_ctx = _code_block.g_vm_ctx.get(); g_vm_ctx = _code_block.g_vm_ctx.get();
// restore register values... // restore register values...
if ( ( err = uc_context_restore( uc_ctx, _code_block.cpu_ctx->context ) ) ) if ((err =
{ uc_context_restore(uc_ctx, _code_block.cpu_ctx->context))) {
std::printf( "> failed to restore emu context... reason = %d\n", err ); std::printf("> failed to restore emu context... reason = %d\n",
err);
return false; return false;
} }
// restore stack values... // restore stack values...
if ( ( err = uc_mem_write( uc_ctx, STACK_BASE, _code_block.cpu_ctx->stack, STACK_SIZE ) ) ) if ((err = uc_mem_write(uc_ctx, STACK_BASE,
{ _code_block.cpu_ctx->stack, STACK_SIZE))) {
std::printf("> failed to restore stack... reason = %d\n", err); std::printf("> failed to restore stack... reason = %d\n", err);
return false; return false;
} }
// get the address in rbp (top of vsp)... then patch the branch rva... // get the address in rbp (top of vsp)... then patch the branch rva...
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RBP, &rbp ) ) ) if ((err = uc_reg_read(uc_ctx, UC_X86_REG_RBP, &rbp))) {
{
std::printf("> failed to read rbp... reason = %d\n", err); std::printf("> failed to read rbp... reason = %d\n", err);
return false; return false;
} }
// patch the branch rva... // patch the branch rva...
if ( ( err = uc_mem_write( uc_ctx, rbp, &branch_rva, sizeof branch_rva ) ) ) if ((err =
{ uc_mem_write(uc_ctx, rbp, &branch_rva, sizeof branch_rva))) {
std::printf("> failed to patch branch rva... reason = %d\n", err); std::printf("> failed to patch branch rva... reason = %d\n", err);
return false; return false;
} }
std::printf( "> beginning execution at = 0x%p\n", _code_block.cpu_ctx->rip ); std::printf("> beginning execution at = %p\n",
if ( ( err = uc_emu_start( uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull, 0ull ) ) ) _code_block.cpu_ctx->rip);
{ if ((err = uc_emu_start(uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull,
0ull))) {
std::printf("> error starting emu... reason = %d\n", err); std::printf("> error starting emu... reason = %d\n", err);
return false; return false;
} }
@ -218,17 +242,18 @@ namespace vm
} }
break; break;
} }
case vm::instrs::jcc_type::switch_case: case vm::instrs::jcc_type::switch_case: {
{ for (auto _idx = 0u;
for ( auto _idx = 0u; _idx < _code_block.code_block.jcc.block_addr.size(); ++_idx ) _idx < _code_block.code_block.jcc.block_addr.size(); ++_idx) {
{
if (std::find(vip_begins.begin(), vip_begins.end(), if (std::find(vip_begins.begin(), vip_begins.end(),
_code_block.code_block.jcc.block_addr[ _idx ] ) != vip_begins.end() ) _code_block.code_block.jcc.block_addr[_idx]) !=
vip_begins.end())
continue; continue;
std::uintptr_t rbp = 0ull; std::uintptr_t rbp = 0ull;
std::uint32_t branch_rva = std::uint32_t branch_rva =
( _code_block.code_block.jcc.block_addr[ _idx ] - g_vm_ctx->module_base ) + (_code_block.code_block.jcc.block_addr[_idx] -
g_vm_ctx->module_base) +
g_vm_ctx->image_base; g_vm_ctx->image_base;
// setup object globals so that the tracing will work... // setup object globals so that the tracing will work...
@ -237,36 +262,37 @@ namespace vm
g_vm_ctx = _code_block.g_vm_ctx.get(); g_vm_ctx = _code_block.g_vm_ctx.get();
// restore register values... // restore register values...
if ( ( err = uc_context_restore( uc_ctx, _code_block.cpu_ctx->context ) ) ) if ((err =
{ uc_context_restore(uc_ctx, _code_block.cpu_ctx->context))) {
std::printf( "> failed to restore emu context... reason = %d\n", err ); std::printf("> failed to restore emu context... reason = %d\n",
err);
return false; return false;
} }
// restore stack values... // restore stack values...
if ( ( err = uc_mem_write( uc_ctx, STACK_BASE, _code_block.cpu_ctx->stack, STACK_SIZE ) ) ) if ((err = uc_mem_write(uc_ctx, STACK_BASE,
{ _code_block.cpu_ctx->stack, STACK_SIZE))) {
std::printf("> failed to restore stack... reason = %d\n", err); std::printf("> failed to restore stack... reason = %d\n", err);
return false; return false;
} }
// get the address in rbp (top of vsp)... then patch the branch rva... // get the address in rbp (top of vsp)... then patch the branch rva...
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RBP, &rbp ) ) ) if ((err = uc_reg_read(uc_ctx, UC_X86_REG_RBP, &rbp))) {
{
std::printf("> failed to read rbp... reason = %d\n", err); std::printf("> failed to read rbp... reason = %d\n", err);
return false; return false;
} }
// patch the branch rva... // patch the branch rva...
if ( ( err = uc_mem_write( uc_ctx, rbp, &branch_rva, sizeof branch_rva ) ) ) if ((err =
{ uc_mem_write(uc_ctx, rbp, &branch_rva, sizeof branch_rva))) {
std::printf("> failed to patch branch rva... reason = %d\n", err); std::printf("> failed to patch branch rva... reason = %d\n", err);
return false; return false;
} }
std::printf( "> beginning execution at = 0x%p\n", _code_block.cpu_ctx->rip ); std::printf("> beginning execution at = %p\n",
if ( ( err = uc_emu_start( uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull, 0ull ) ) ) _code_block.cpu_ctx->rip);
{ if ((err = uc_emu_start(uc_ctx, _code_block.cpu_ctx->rip, 0ull, 0ull,
0ull))) {
std::printf("> error starting emu... reason = %d\n", err); std::printf("> error starting emu... reason = %d\n", err);
return false; return false;
} }
@ -280,30 +306,28 @@ namespace vm
} }
} }
for ( auto &[ code_block, cpu_ctx, vm_ctx ] : code_blocks ) for (auto &[code_block, cpu_ctx, vm_ctx] : code_blocks) {
{
// convert linear virtual addresses to image based addresses... // convert linear virtual addresses to image based addresses...
code_block.vip_begin = ( code_block.vip_begin - g_vm_ctx->module_base ) + g_vm_ctx->image_base; code_block.vip_begin =
if ( code_block.jcc.has_jcc ) (code_block.vip_begin - g_vm_ctx->module_base) + g_vm_ctx->image_base;
{ if (code_block.jcc.has_jcc) {
switch ( code_block.jcc.type ) switch (code_block.jcc.type) {
{ case vm::instrs::jcc_type::branching: {
case vm::instrs::jcc_type::branching:
{
code_block.jcc.block_addr[1] = code_block.jcc.block_addr[1] =
( code_block.jcc.block_addr[ 1 ] - g_vm_ctx->module_base ) + g_vm_ctx->image_base; (code_block.jcc.block_addr[1] - g_vm_ctx->module_base) +
g_vm_ctx->image_base;
} }
case vm::instrs::jcc_type::absolute: case vm::instrs::jcc_type::absolute: {
{
code_block.jcc.block_addr[0] = code_block.jcc.block_addr[0] =
( code_block.jcc.block_addr[ 0 ] - g_vm_ctx->module_base ) + g_vm_ctx->image_base; (code_block.jcc.block_addr[0] - g_vm_ctx->module_base) +
g_vm_ctx->image_base;
break; break;
} }
case vm::instrs::jcc_type::switch_case: case vm::instrs::jcc_type::switch_case: {
{
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx) for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
code_block.jcc.block_addr[idx] = code_block.jcc.block_addr[idx] =
( code_block.jcc.block_addr[ idx ] - g_vm_ctx->module_base ) + g_vm_ctx->image_base; (code_block.jcc.block_addr[idx] - g_vm_ctx->module_base) +
g_vm_ctx->image_base;
break; break;
} }
} }
@ -314,8 +338,7 @@ namespace vm
return true; return true;
} }
uc_err emu_t::create_entry( vmp2::v2::entry_t *entry ) uc_err emu_t::create_entry(vmp2::v2::entry_t *entry) {
{
uc_reg_read(uc_ctx, UC_X86_REG_R15, &entry->regs.r15); uc_reg_read(uc_ctx, UC_X86_REG_R15, &entry->regs.r15);
uc_reg_read(uc_ctx, UC_X86_REG_R14, &entry->regs.r14); uc_reg_read(uc_ctx, UC_X86_REG_R14, &entry->regs.r14);
uc_reg_read(uc_ctx, UC_X86_REG_R13, &entry->regs.r13); uc_reg_read(uc_ctx, UC_X86_REG_R13, &entry->regs.r13);
@ -338,20 +361,22 @@ namespace vm
entry->decrypt_key = entry->regs.rbx; entry->decrypt_key = entry->regs.rbx;
uc_err err; uc_err err;
if ( ( err = uc_mem_read( uc_ctx, entry->regs.rdi, entry->vregs.raw, sizeof entry->vregs.raw ) ) ) if ((err = uc_mem_read(uc_ctx, entry->regs.rdi, entry->vregs.raw,
sizeof entry->vregs.raw)))
return err; return err;
// copy virtual stack values... // copy virtual stack values...
for (auto idx = 0u; idx < sizeof(entry->vsp) / 8; ++idx) for (auto idx = 0u; idx < sizeof(entry->vsp) / 8; ++idx)
if ( ( err = uc_mem_read( uc_ctx, entry->regs.rbp + ( idx * 8 ), &entry->vsp.qword[ idx ], if ((err =
sizeof entry->vsp.qword[ idx ] ) ) ) uc_mem_read(uc_ctx, entry->regs.rbp + (idx * 8),
&entry->vsp.qword[idx], sizeof entry->vsp.qword[idx])))
return err; return err;
return UC_ERR_OK; return UC_ERR_OK;
} }
bool emu_t::code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, emu_t *obj ) bool emu_t::code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
{ emu_t *obj) {
uc_err err; uc_err err;
vmp2::v2::entry_t vinstr_entry; vmp2::v2::entry_t vinstr_entry;
std::uint8_t vm_handler_table_idx = 0u; std::uint8_t vm_handler_table_idx = 0u;
@ -360,49 +385,39 @@ namespace vm
static std::shared_ptr<vm::ctx_t> _jmp_ctx; static std::shared_ptr<vm::ctx_t> _jmp_ctx;
static zydis_routine_t _jmp_stream; static zydis_routine_t _jmp_stream;
static auto inst_cnt = 0ull; static auto inst_cnt = 0ull;
static ZydisDecoder decoder;
static ZydisFormatter formatter;
static ZydisDecodedInstruction instr; static ZydisDecodedInstruction instr;
if ( static std::atomic< bool > once{ false }; !once.exchange( true ) ) if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(vm::util::g_decoder.get(),
{ reinterpret_cast<void *>(address),
ZydisDecoderInit( &decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64 ); PAGE_4KB, &instr))) {
ZydisFormatterInit( &formatter, ZYDIS_FORMATTER_STYLE_INTEL );
}
if ( !ZYAN_SUCCESS(
ZydisDecoderDecodeBuffer( &decoder, reinterpret_cast< void * >( address ), PAGE_4KB, &instr ) ) )
{
std::printf("> failed to decode instruction at = 0x%p\n", address); std::printf("> failed to decode instruction at = 0x%p\n", address);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
return false; return false;
} }
if ( instr.mnemonic == ZYDIS_MNEMONIC_INVALID ) if (instr.mnemonic == ZYDIS_MNEMONIC_INVALID) {
{
obj->cc_block = nullptr; obj->cc_block = nullptr;
uc_emu_stop(uc); uc_emu_stop(uc);
return false; return false;
} }
// if there are over 4k instructions executed before a JMP is found then we are gunna stop emulation // if there are over 4k instructions executed before a JMP is found then we
// this is a sanity check to prevent inf loops... // are gunna stop emulation this is a sanity check to prevent inf loops...
if ( ++inst_cnt > 0x1000 ) if (++inst_cnt > 0x1000) {
{
obj->cc_block = nullptr, inst_cnt = 0ull; obj->cc_block = nullptr, inst_cnt = 0ull;
uc_emu_stop(uc); uc_emu_stop(uc);
return false; return false;
} }
// if the native instruction is a jmp rcx/rdx... then AL will contain the vm handler // if the native instruction is a jmp rcx/rdx... then AL will contain the vm
// table index of the vm handler that the emulator is about to jmp too... // handler table index of the vm handler that the emulator is about to jmp
if ( !( instr.mnemonic == ZYDIS_MNEMONIC_JMP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER && // too...
if (!(instr.mnemonic == ZYDIS_MNEMONIC_JMP &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
(instr.operands[0].reg.value == ZYDIS_REGISTER_RCX || (instr.operands[0].reg.value == ZYDIS_REGISTER_RCX ||
instr.operands[0].reg.value == ZYDIS_REGISTER_RDX))) instr.operands[0].reg.value == ZYDIS_REGISTER_RDX)))
return true; return true;
@ -411,27 +426,24 @@ namespace vm
inst_cnt = 0ull; inst_cnt = 0ull;
// extract address of vm handler table... // extract address of vm handler table...
switch ( instr.operands[ 0 ].reg.value ) switch (instr.operands[0].reg.value) {
{
case ZYDIS_REGISTER_RCX: case ZYDIS_REGISTER_RCX:
if ( ( err = uc_reg_read( uc, UC_X86_REG_RCX, &vm_handler_addr ) ) ) if ((err = uc_reg_read(uc, UC_X86_REG_RCX, &vm_handler_addr))) {
{
std::printf("> failed to read rcx... reason = %d\n", err); std::printf("> failed to read rcx... reason = %d\n", err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
return false; return false;
} }
break; break;
case ZYDIS_REGISTER_RDX: case ZYDIS_REGISTER_RDX:
if ( ( err = uc_reg_read( uc, UC_X86_REG_RDX, &vm_handler_addr ) ) ) if ((err = uc_reg_read(uc, UC_X86_REG_RDX, &vm_handler_addr))) {
{
std::printf("> failed to read rdx... reason = %d\n", err); std::printf("> failed to read rdx... reason = %d\n", err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
return false; return false;
@ -439,11 +451,9 @@ namespace vm
break; break;
} }
if ( ( err = uc_reg_read( obj->uc_ctx, UC_X86_REG_AL, &vm_handler_table_idx ) ) ) if ((err = uc_reg_read(obj->uc_ctx, UC_X86_REG_AL, &vm_handler_table_idx))) {
{
std::printf("> failed to read register... reason = %d\n", err); std::printf("> failed to read register... reason = %d\n", err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
@ -452,28 +462,27 @@ namespace vm
auto &vm_handler = obj->g_vm_ctx->vm_handlers[vm_handler_table_idx]; auto &vm_handler = obj->g_vm_ctx->vm_handlers[vm_handler_table_idx];
if ( ( err = obj->create_entry( &vinstr_entry ) ) ) if ((err = obj->create_entry(&vinstr_entry))) {
{
std::printf("> failed to create vinstr entry... reason = %d\n", err); std::printf("> failed to create vinstr entry... reason = %d\n", err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
return false; return false;
} }
// quick check to ensure sanity... things can get crazy so this is good to check... // quick check to ensure sanity... things can get crazy so this is good to
// check...
if (vm_handler.address != vm_handler_addr || if (vm_handler.address != vm_handler_addr ||
vinstr_entry.vip >= obj->g_vm_ctx->module_base + obj->g_vm_ctx->image_size || vinstr_entry.vip >=
vinstr_entry.vip < obj->g_vm_ctx->module_base ) obj->g_vm_ctx->module_base + obj->g_vm_ctx->image_size ||
{ vinstr_entry.vip < obj->g_vm_ctx->module_base) {
std::printf( "> vm handler index (%d) does not match vm handler address (%p)...\n", vm_handler_table_idx, std::printf(
vm_handler_addr ); "> vm handler index (%d) does not match vm handler address (%p)...\n",
vm_handler_table_idx, vm_handler_addr);
obj->cc_block = nullptr; obj->cc_block = nullptr;
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
@ -481,28 +490,24 @@ namespace vm
return false; return false;
} }
if ( !vm_handler.profile ) if (!vm_handler.profile) {
{ if (!g_force_emu) obj->cc_block = nullptr;
if ( !g_force_emu )
obj->cc_block = nullptr;
std::printf( "> please define virtual machine handler (0x%p): \n\n", std::printf("> please define virtual machine handler (%p): \n\n",
( vm_handler_addr - obj->g_vm_ctx->module_base ) + obj->g_vm_ctx->image_base ); (vm_handler_addr - obj->g_vm_ctx->module_base) +
obj->g_vm_ctx->image_base);
vm::util::print(vm_handler.instrs); vm::util::print(vm_handler.instrs);
std::printf("\n\n"); std::printf("\n\n");
if ( !g_force_emu ) if (!g_force_emu) exit(0);
exit( 0 );
} }
auto vinstr = vm::instrs::get(*obj->g_vm_ctx, vinstr_entry); auto vinstr = vm::instrs::get(*obj->g_vm_ctx, vinstr_entry);
if ( !vinstr.has_value() ) if (!vinstr.has_value()) {
{
std::printf("> failed to decode virtual instruction...\n"); std::printf("> failed to decode virtual instruction...\n");
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
@ -510,57 +515,58 @@ namespace vm
} }
// log this virtual blocks vip_begin... // log this virtual blocks vip_begin...
if ( obj->cc_block->code_block.vinstrs.empty() ) if (obj->cc_block->code_block.vinstrs.empty()) {
{
obj->cc_block->code_block.vip_begin = obj->cc_block->code_block.vip_begin =
obj->g_vm_ctx->exec_type == vmp2::exec_type_t::forward ? vinstr_entry.vip - 1 : vinstr_entry.vip + 1; obj->g_vm_ctx->exec_type == vmp2::exec_type_t::forward
? vinstr_entry.vip - 1
: vinstr_entry.vip + 1;
obj->vip_begins.push_back(obj->cc_block->code_block.vip_begin); obj->vip_begins.push_back(obj->cc_block->code_block.vip_begin);
} }
vinstr.value().trace_data.vm_handler_rva = ( vm_handler_addr - obj->g_vm_ctx->module_base ); vinstr.value().trace_data.vm_handler_rva =
(vm_handler_addr - obj->g_vm_ctx->module_base);
obj->cc_block->code_block.vinstrs.push_back(vinstr.value()); obj->cc_block->code_block.vinstrs.push_back(vinstr.value());
if ( vm_handler.profile ) if (vm_handler.profile) {
{ switch (vm_handler.profile->mnemonic) {
switch ( vm_handler.profile->mnemonic ) case vm::handler::VMEXIT: {
{
case vm::handler::VMEXIT:
{
obj->cc_block->code_block.jcc.has_jcc = false; obj->cc_block->code_block.jcc.has_jcc = false;
obj->cc_block->code_block.jcc.type = vm::instrs::jcc_type::none; obj->cc_block->code_block.jcc.type = vm::instrs::jcc_type::none;
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
break; break;
} }
case vm::handler::JMP: case vm::handler::JMP: {
{ // get jcc data about the virtual instruction code block that was just
// get jcc data about the virtual instruction code block that was just emulated... // emulated...
auto jcc_data = vm::instrs::get_jcc_data( *obj->g_vm_ctx, obj->cc_block->code_block ); auto jcc_data =
vm::instrs::get_jcc_data(*obj->g_vm_ctx, obj->cc_block->code_block);
obj->cc_block->code_block.jcc = jcc_data.value(); obj->cc_block->code_block.jcc = jcc_data.value();
// allocate space for the cpu context and stack... // allocate space for the cpu context and stack...
auto new_cpu_ctx = std::make_shared<vm::emu_t::cpu_ctx_t>(); auto new_cpu_ctx = std::make_shared<vm::emu_t::cpu_ctx_t>();
// optimize so that we dont need to create a new vm::ctx_t every single virtual JMP... // optimize so that we dont need to create a new vm::ctx_t every single
if ( obj->vm_ctxs.find( vm_handler_addr ) == obj->vm_ctxs.end() ) // virtual JMP...
{ if (obj->vm_ctxs.find(vm_handler_addr) == obj->vm_ctxs.end()) {
obj->vm_ctxs[ vm_handler_addr ] = obj->vm_ctxs[vm_handler_addr] = std::make_shared<vm::ctx_t>(
std::make_shared< vm::ctx_t >( obj->g_vm_ctx->module_base, obj->img_base, obj->img_size, obj->g_vm_ctx->module_base, obj->img_base, obj->img_size,
vm_handler_addr - obj->g_vm_ctx->module_base); vm_handler_addr - obj->g_vm_ctx->module_base);
if ( !obj->vm_ctxs[ vm_handler_addr ]->init() ) if (!obj->vm_ctxs[vm_handler_addr]->init()) {
{ std::printf(
std::printf( "> failed to init vm::ctx_t for virtual jmp... vip = 0x%p, jmp handler = 0x%p\n", "> failed to init vm::ctx_t for virtual jmp... vip = 0x%p, jmp "
"handler = 0x%p\n",
vinstr_entry.vip, vm_handler_addr); vinstr_entry.vip, vm_handler_addr);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf(
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); "> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
return false; return false;
@ -568,12 +574,12 @@ namespace vm
} }
_jmp_ctx = obj->vm_ctxs[vm_handler_addr]; _jmp_ctx = obj->vm_ctxs[vm_handler_addr];
if ( ( err = uc_context_alloc( uc, &new_cpu_ctx->context ) ) ) if ((err = uc_context_alloc(uc, &new_cpu_ctx->context))) {
{ std::printf("> failed to allocate a unicorn context... reason = %d\n",
std::printf( "> failed to allocate a unicorn context... reason = %d\n", err ); err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
return false; return false;
@ -581,32 +587,32 @@ namespace vm
// save the cpu's registers... // save the cpu's registers...
new_cpu_ctx->rip = vm_handler_addr; new_cpu_ctx->rip = vm_handler_addr;
if ( ( err = uc_context_save( uc, new_cpu_ctx->context ) ) ) if ((err = uc_context_save(uc, new_cpu_ctx->context))) {
{ std::printf("> failed to save emulator context... reason = %d\n",
std::printf( "> failed to save emulator context... reason = %d\n", err ); err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
return false; return false;
} }
// save the entire stack... // save the entire stack...
if ( ( err = uc_mem_read( uc, STACK_BASE, new_cpu_ctx->stack, STACK_SIZE ) ) ) if ((err =
{ uc_mem_read(uc, STACK_BASE, new_cpu_ctx->stack, STACK_SIZE))) {
std::printf("> failed to read stack... reason = %d\n", err); std::printf("> failed to read stack... reason = %d\n", err);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
return false; return false;
} }
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{ std::printf("> failed to stop emulation, exiting... reason = %d\n",
std::printf( "> failed to stop emulation, exiting... reason = %d\n", err ); err);
exit(0); exit(0);
} }
@ -621,29 +627,26 @@ namespace vm
return true; return true;
} }
void emu_t::int_callback( uc_engine *uc, std::uint32_t intno, emu_t *obj ) void emu_t::int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj) {
{
uc_err err; uc_err err;
std::uintptr_t rip = 0ull; std::uintptr_t rip = 0ull;
static ZydisDecoder decoder; static ZydisDecoder decoder;
static ZydisDecodedInstruction instr; static ZydisDecodedInstruction instr;
if (static std::atomic<bool> once{false}; !once.exchange(true)) if (static std::atomic<bool> once{false}; !once.exchange(true))
ZydisDecoderInit( &decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64 ); ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64,
ZYDIS_ADDRESS_WIDTH_64);
if ( ( err = uc_reg_read( uc, UC_X86_REG_RIP, &rip ) ) ) if ((err = uc_reg_read(uc, UC_X86_REG_RIP, &rip))) {
{
std::printf("> failed to read rip... reason = %d\n", err); std::printf("> failed to read rip... reason = %d\n", err);
return; return;
} }
if ( !ZYAN_SUCCESS( if (!ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(
ZydisDecoderDecodeBuffer( &decoder, reinterpret_cast< void * >( rip ), PAGE_4KB, &instr ) ) ) &decoder, reinterpret_cast<void *>(rip), PAGE_4KB, &instr))) {
{
std::printf("> failed to decode instruction at = 0x%p\n", rip); std::printf("> failed to decode instruction at = 0x%p\n", rip);
if ( ( err = uc_emu_stop( uc ) ) ) if ((err = uc_emu_stop(uc))) {
{
std::printf("> failed to stop emulation, exiting... reason = %d\n", err); std::printf("> failed to stop emulation, exiting... reason = %d\n", err);
exit(0); exit(0);
} }
@ -653,33 +656,40 @@ namespace vm
// advance rip over the instruction that caused the exception... // advance rip over the instruction that caused the exception...
rip += instr.length; rip += instr.length;
if ( ( err = uc_reg_write( uc, UC_X86_REG_RIP, &rip ) ) ) if ((err = uc_reg_write(uc, UC_X86_REG_RIP, &rip))) {
{
std::printf("> failed to write rip... reason = %d\n", err); std::printf("> failed to write rip... reason = %d\n", err);
return; return;
} }
} }
void emu_t::invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, emu_t *obj ) void emu_t::invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
{ int size, int64_t value, emu_t *obj) {
switch ( type ) switch (type) {
{ case UC_MEM_READ_UNMAPPED: {
case UC_MEM_READ_UNMAPPED:
{
uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL); uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);
std::printf( ">>> reading invalid memory at address = 0x%p, size = 0x%x\n", address, size ); std::printf(">>> reading invalid memory at address = %p, size = 0x%x\n",
address, size);
break; break;
} }
case UC_MEM_WRITE_UNMAPPED: case UC_MEM_WRITE_UNMAPPED: {
{
uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL); uc_mem_map(uc, address & ~0xFFFull, PAGE_4KB, UC_PROT_ALL);
std::printf( ">>> writing invalid memory at address = 0x%p, size = 0x%x, val = 0x%x\n", address, size, std::printf(
value ); ">>> writing invalid memory at address = %p, size = 0x%x, val = "
"0x%x\n",
address, size, value);
break; break;
} }
case UC_MEM_FETCH_UNMAPPED: case UC_MEM_FETCH_UNMAPPED: {
{ std::printf(">>> fetching invalid instructions at address = %p\n",
std::printf( ">>> fetching invalid instructions at address = 0x%p\n", address ); address);
std::uintptr_t rip, rsp;
uc_reg_read(uc, UC_X86_REG_RSP, &rsp);
uc_mem_read(uc, rsp, &rip, sizeof rip);
rsp += 8;
uc_reg_write(uc, UC_X86_REG_RSP, &rsp);
uc_reg_write(uc, UC_X86_REG_RIP, &rip);
std::printf(">>> injecting return to try and recover... rip = %p\n", rip);
break; break;
} }
default: default:

Write Preview
Loading…
Cancel
Save