vmp2
/
vmemu
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'linux-port' into 'master'

Browse Source 
porting project to support linux...

See merge request vmp2/vmemu!14
merge-requests/15/merge
_xeroxz 2 years ago
parent 1385a7cfe2 c798e736d2
commit e0d756c252
6 changed files with 1712 additions and 1560 deletions
Show Stats Download Patch File Download Diff File

2
dependencies/vmprofiler vendored

@ -1 +1 @@
Subproject commit 1b6875d18825529907289bc87990fed5d99e7f96 Subproject commit dd7d3777ad10373d0eeb23c118e4bdcfc7464494

125
include/unpacker.hpp
Unescape View File

@ -1,15 +1,16 @@
#pragma once #pragma once
#include <functional> #include <Zydis/Zydis.h>
#include <unicorn/unicorn.h> #include <unicorn/unicorn.h>
#include <Zydis/Zydis.h>
#include <atomic> #include <atomic>
#include <fstream> #include <fstream>
#include <functional>
#include <map> #include <map>
#include <nt/image.hpp> #include <nt/image.hpp>
#include <vector> #include <vector>
#include <xtils.hpp> #include <vmprofiler.hpp>
#define PACKED_FILE_HANDLE 0x69420
#define PAGE_4KB 0x1000 #define PAGE_4KB 0x1000
#define STACK_SIZE PAGE_4KB * 512 #define STACK_SIZE PAGE_4KB * 512
@ -23,50 +24,82 @@
#define LOCAL_FREE_VECTOR 3 #define LOCAL_FREE_VECTOR 3
#define LOAD_LIBRARY_VECTOR 4 #define LOAD_LIBRARY_VECTOR 4
#define NT_QUERY_SYSTEM_INFO_VECTOR 5 #define NT_QUERY_SYSTEM_INFO_VECTOR 5
#define GET_MODULE_FILE_NAME_W_VECTOR 6
#define CREATE_FILE_W_VECTOR 7
#define GET_FILE_SIZE_VECTOR 8
#define CREATE_FILE_MAPPING_VECTOR 9
#define MAP_VIEW_OF_FILE_VECTOR 10
#define UNMAP_VIEW_OF_FILE_VECTOR 11
#define CLOSE_HANDLE_VECTOR 12
#define VIRTUAL_PROTECT_VECTOR 13
#define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00" #define MOV_RAX_0_SIG "\x48\xB8\x00\x00\x00\x00\x00\x00\x00\x00"
#define MOV_RAX_0_MASK "xxxxxxxxxx" #define MOV_RAX_0_MASK "xxxxxxxxxx"
static_assert( sizeof MOV_RAX_0_SIG == sizeof MOV_RAX_0_MASK, "signature and mask sizes are wrong..." ); static_assert(sizeof MOV_RAX_0_SIG == sizeof MOV_RAX_0_MASK,
"signature and mask sizes are wrong...");
namespace engine
{ namespace engine {
class unpack_t class unpack_t {
{ public:
public: explicit unpack_t(const std::string &module_name,
explicit unpack_t( const std::vector< std::uint8_t > &bin ); const std::vector<std::uint8_t> &bin);
~unpack_t( void ); ~unpack_t(void);
bool init( void ); bool init(void);
bool unpack( std::vector< std::uint8_t > &output ); bool unpack(std::vector<std::uint8_t> &output);
private: private:
using iat_hook_t = std::function< void( uc_engine *, unpack_t * ) >; using iat_hook_t = std::function<void(uc_engine *, unpack_t *)>;
uc_engine *uc_ctx; uc_engine *uc_ctx;
std::vector< uint8_t > bin, map_bin; std::vector<uint8_t> bin, map_bin;
std::vector< uc_hook * > uc_hooks; std::vector<uc_hook *> uc_hooks;
std::string module_name;
std::uintptr_t img_base, img_size, heap_offset, pack_section_offset;
win::image_t<> *win_img; std::uintptr_t img_base, img_size, heap_offset, pack_section_offset;
win::image_t<> *win_img;
static void local_alloc_hook( uc_engine *, unpack_t * );
static void local_free_hook( uc_engine *, unpack_t * ); static void local_alloc_hook(uc_engine *, unpack_t *);
static void load_library_hook( uc_engine *, unpack_t * ); static void local_free_hook(uc_engine *, unpack_t *);
static void uc_strcpy( uc_engine *, char *buff, std::uintptr_t addr ); static void load_library_hook(uc_engine *, unpack_t *);
static void get_module_file_name_w_hook(uc_engine *, unpack_t *);
static bool iat_dispatcher( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack ); static void create_file_w_hook(uc_engine *, unpack_t *);
static bool unpack_section_callback( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, static void get_file_size_hook(uc_engine *, unpack_t *);
unpack_t *unpack ); static void create_file_mapping_hook(uc_engine *, unpack_t *);
static void map_view_of_file_hook(uc_engine *, unpack_t *);
static bool code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack ); static void unmap_view_of_file_hook(uc_engine *, unpack_t *);
static void invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, static void close_handle_hook(uc_engine *, unpack_t *);
unpack_t *unpack ); static void virtual_protect_hook(uc_engine *, unpack_t *);
std::vector< std::uintptr_t > loaded_modules; static void uc_strcpy(uc_engine *uc, char *buff, std::uintptr_t addr);
std::map< std::string, std::pair< std::uint32_t, iat_hook_t > > iat_hooks = { static void uc_strcpy(uc_engine *uc, std::uintptr_t addr, char *buff);
{ "LocalAlloc", { LOCAL_ALLOC_VECTOR, &local_alloc_hook } },
{ "LocalFree", { LOCAL_FREE_VECTOR, &local_free_hook } }, static bool iat_dispatcher(uc_engine *uc, uint64_t address, uint32_t size,
{ "LoadLibraryA", { LOAD_LIBRARY_VECTOR, &load_library_hook } } }; unpack_t *unpack);
};
} // namespace engine static bool unpack_section_callback(uc_engine *uc, uc_mem_type type,
uint64_t address, int size, int64_t value,
unpack_t *unpack);
static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
int size, int64_t value, unpack_t *unpack);
std::map<std::string, std::uintptr_t> loaded_modules;
std::map<std::string, std::pair<std::uint32_t, iat_hook_t> > iat_hooks = {
{"LocalAlloc", {LOCAL_ALLOC_VECTOR, &local_alloc_hook}},
{"LocalFree", {LOCAL_FREE_VECTOR, &local_free_hook}},
{"LoadLibraryA", {LOAD_LIBRARY_VECTOR, &load_library_hook}},
{"GetModuleFileNameW",
{GET_MODULE_FILE_NAME_W_VECTOR, &get_module_file_name_w_hook}},
{"CreateFileW", {CREATE_FILE_W_VECTOR, &create_file_w_hook}},
{"GetFileSize", {GET_FILE_SIZE_VECTOR, &get_file_size_hook}},
{"CreateFileMappingW",
{CREATE_FILE_MAPPING_VECTOR, &create_file_mapping_hook}},
{"MapViewOfFile", {MAP_VIEW_OF_FILE_VECTOR, &map_view_of_file_hook}},
{"UnmapViewOfFile",
{UNMAP_VIEW_OF_FILE_VECTOR, &unmap_view_of_file_hook}},
{"CloseHandle", {CLOSE_HANDLE_VECTOR, &close_handle_hook}},
{"VirtualProtect", {VIRTUAL_PROTECT_VECTOR, &virtual_protect_hook}}};
};
} // namespace engine

90
include/vmemu_t.hpp
Unescape View File

@ -1,6 +1,7 @@
#pragma once #pragma once
#include <unicorn/unicorn.h> #include <unicorn/unicorn.h>
#include <atomic>
#include <nt/image.hpp> #include <nt/image.hpp>
#include <vmprofiler.hpp> #include <vmprofiler.hpp>
@ -10,49 +11,46 @@
#define STACK_BASE 0xFFFF000000000000 #define STACK_BASE 0xFFFF000000000000
#define IAT_VECTOR_TABLE 0xFFFFF00000000000 #define IAT_VECTOR_TABLE 0xFFFFF00000000000
namespace vm namespace vm {
{ inline bool g_force_emu = false;
inline bool g_force_emu = false;
class emu_t {
class emu_t struct cpu_ctx_t {
{ std::uintptr_t rip;
struct cpu_ctx_t uc_context *context;
{ std::uint8_t stack[STACK_SIZE];
std::uintptr_t rip; };
uc_context *context;
std::uint8_t stack[ STACK_SIZE ]; struct code_block_data_t {
}; vm::instrs::code_block_t code_block;
std::shared_ptr<cpu_ctx_t> cpu_ctx;
struct code_block_data_t std::shared_ptr<vm::ctx_t> g_vm_ctx;
{ };
vm::instrs::code_block_t code_block;
std::shared_ptr< cpu_ctx_t > cpu_ctx; public:
std::shared_ptr< vm::ctx_t > g_vm_ctx; explicit emu_t(vm::ctx_t *vm_ctx);
}; ~emu_t();
public: bool init();
explicit emu_t( vm::ctx_t *vm_ctx ); bool get_trace(std::vector<vm::instrs::code_block_t> &code_blocks);
~emu_t();
private:
bool init(); std::uintptr_t img_base, img_size;
bool get_trace( std::vector< vm::instrs::code_block_t > &code_blocks ); uc_hook code_exec_hook, invalid_mem_hook, int_hook;
private: uc_engine *uc_ctx;
std::uintptr_t img_base, img_size; vm::ctx_t *g_vm_ctx;
uc_hook code_exec_hook, invalid_mem_hook, int_hook; code_block_data_t *cc_block;
uc_engine *uc_ctx; std::vector<std::uintptr_t> vip_begins;
vm::ctx_t *g_vm_ctx; std::vector<code_block_data_t> code_blocks;
code_block_data_t *cc_block; std::map<std::uintptr_t, std::shared_ptr<vm::ctx_t> > vm_ctxs;
std::vector< std::uintptr_t > vip_begins; uc_err create_entry(vmp2::v2::entry_t *entry);
std::vector< code_block_data_t > code_blocks; static void int_callback(uc_engine *uc, std::uint32_t intno, emu_t *obj);
std::map< std::uintptr_t, std::shared_ptr< vm::ctx_t > > vm_ctxs; static bool code_exec_callback(uc_engine *uc, uint64_t address, uint32_t size,
emu_t *obj);
uc_err create_entry( vmp2::v2::entry_t *entry ); static void invalid_mem(uc_engine *uc, uc_mem_type type, uint64_t address,
static void int_callback( uc_engine *uc, std::uint32_t intno, emu_t *obj ); int size, int64_t value, emu_t *obj);
static bool code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, emu_t *obj ); };
static void invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value, } // namespace vm
emu_t *obj );
};
} // namespace vm

739
src/main.cpp
Unescape View File

@ -1,402 +1,399 @@
#include "unpacker.hpp"
#include "vmemu_t.hpp"
#include <cli-parser.hpp> #include <cli-parser.hpp>
#include <fstream> #include <fstream>
#include <iostream> #include <iostream>
#include <xtils.hpp>
int __cdecl main( int argc, const char *argv[] )
{
argparse::argument_parser_t parser( "VMEmu", "VMProtect 2 VM Handler Emulator" );
parser.add_argument().name( "--vmentry" ).description( "relative virtual address to a vm entry..." );
parser.add_argument().name( "--bin" ).description( "path to unpacked virtualized binary..." );
parser.add_argument().name( "--out" ).description( "output file name..." );
parser.add_argument().name( "--unpack" ).description( "unpack a vmp2 binary..." );
parser.add_argument().names( { "-f", "--force" } ).description( "force emulation of unknown vm handlers...\n" );
parser.add_argument()
.name( "--emuall" )
.description( "scan for all vm enters and trace all of them... this may take a few minutes..." );
parser.add_argument()
.name( "--locateconst" )
.description( "scan all vm enters for a specific constant value...\n" );
parser.enable_help();
auto result = parser.parse( argc, argv );
if ( result )
{
std::printf( "[!] error parsing commandline arguments... reason = %s\n", result.what().c_str() );
return -1;
}
if ( parser.exists( "help" ) ) #include "unpacker.hpp"
{ #include "vmemu_t.hpp"
parser.print_help();
return 0;
}
auto umtils = xtils::um_t::get_instance(); int __cdecl main(int argc, const char *argv[]) {
vm::g_force_emu = parser.exists( "force" ); argparse::argument_parser_t parser("VMEmu",
"VMProtect 2 VM Handler Emulator");
parser.add_argument()
.name("--vmentry")
.description("relative virtual address to a vm entry...");
parser.add_argument()
.name("--bin")
.description("path to unpacked virtualized binary...")
.required(true);
parser.add_argument()
.name("--out")
.description("output file name...")
.required(true);
parser.add_argument().name("--unpack").description("unpack a vmp2 binary...");
parser.add_argument()
.names({"-f", "--force"})
.description("force emulation of unknown vm handlers...");
parser.add_argument()
.name("--emuall")
.description(
"scan for all vm enters and trace all of them... this may take a few "
"minutes...");
parser.enable_help();
auto result = parser.parse(argc, argv);
if (result) {
std::printf("[!] error parsing commandline arguments... reason = %s\n",
result.what().c_str());
return -1;
}
if (parser.exists("help")) {
parser.print_help();
return 0;
}
vm::util::init();
vm::g_force_emu = parser.exists("force");
std::vector<std::uint8_t> module_data, tmp, unpacked_bin;
if (!vm::util::open_binary_file(parser.get<std::string>("bin"),
module_data)) {
std::printf("[!] failed to open binary file...\n");
return -1;
}
auto img = reinterpret_cast<win::image_t<> *>(module_data.data());
auto image_size = img->get_nt_headers()->optional_header.size_image;
const auto image_base = img->get_nt_headers()->optional_header.image_base;
// page align the vector allocation so that unicorn-engine is happy girl...
tmp.resize(image_size + PAGE_4KB);
const std::uintptr_t module_base =
reinterpret_cast<std::uintptr_t>(tmp.data()) +
(PAGE_4KB - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull));
std::memcpy((void *)module_base, module_data.data(), 0x1000);
std::for_each(img->get_nt_headers()->get_sections(),
img->get_nt_headers()->get_sections() +
img->get_nt_headers()->file_header.num_sections,
[&](const auto &section_header) {
std::memcpy(
(void *)(module_base + section_header.virtual_address),
module_data.data() + section_header.ptr_raw_data,
section_header.size_raw_data);
});
auto win_img = reinterpret_cast<win::image_t<> *>(module_base);
auto basereloc_dir =
win_img->get_directory(win::directory_id::directory_entry_basereloc);
auto reloc_dir = reinterpret_cast<win::reloc_directory_t *>(
basereloc_dir->rva + module_base);
win::reloc_block_t *reloc_block = &reloc_dir->first_block;
// apply relocations to all sections...
while (reloc_block->base_rva && reloc_block->size_block) {
std::for_each(reloc_block->begin(), reloc_block->end(),
[&](win::reloc_entry_t &entry) {
switch (entry.type) {
case win::reloc_type_id::rel_based_dir64: {
auto reloc_at = reinterpret_cast<std::uintptr_t *>(
entry.offset + reloc_block->base_rva + module_base);
*reloc_at = module_base + ((*reloc_at) - image_base);
break;
}
default:
break;
}
});
if ( !parser.exists( "unpack" ) && parser.exists( "vmentry" ) && parser.exists( "bin" ) && parser.exists( "out" ) ) reloc_block = reloc_block->next();
{ }
const auto module_base = reinterpret_cast< std::uintptr_t >(
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
if ( !module_base ) std::printf("> image base = %p, image size = %p, module base = %p\n",
{ image_base, image_size, module_base);
std::printf( "[!] failed to open binary file...\n" );
return -1;
}
const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); if (!image_base || !image_size || !module_base) {
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() ); std::printf("[!] failed to open binary on disk...\n");
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; return -1;
}
std::printf( "> image base = %p, image size = %p, module base = %p\n", image_base, image_size, module_base ); if (parser.exists("vmentry")) {
const auto vm_entry_rva =
std::strtoull(parser.get<std::string>("vmentry").c_str(), nullptr, 16);
if ( !image_base || !image_size || !module_base ) std::vector<vm::instrs::code_block_t> code_blocks;
{ vm::ctx_t vmctx(module_base, image_base, image_size, vm_entry_rva);
std::printf( "[!] failed to open binary on disk...\n" );
return -1;
}
std::vector< vm::instrs::code_block_t > code_blocks; if (!vmctx.init()) {
vm::ctx_t vmctx( module_base, image_base, image_size, vm_entry_rva ); std::printf(
"[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is "
"unpacked and is"
"protected with VMProtect 2...\n");
return -1;
}
if ( !vmctx.init() ) vm::emu_t emu(&vmctx);
{
std::printf( "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is"
"protected with VMProtect 2...\n" );
return -1;
}
vm::emu_t emu( &vmctx ); if (!emu.init()) {
std::printf("[!] failed to init emulator...\n");
return -1;
}
if ( !emu.init() ) if (!emu.get_trace(code_blocks)) {
{ std::printf(
std::printf( "[!] failed to init emulator...\n" ); "[!] something failed during tracing, review the console for more "
return -1; "information...\n");
} return -1;
}
if ( !emu.get_trace( code_blocks ) ) std::printf("> number of blocks = %d\n", code_blocks.size());
{
std::printf( "[!] something failed during tracing, review the console for more information...\n" ); for (auto &code_block : code_blocks) {
return -1; std::printf("> code block starts at = %p\n", code_block.vip_begin);
std::printf("> number of virtual instructions = %d\n",
code_block.vinstrs.size());
std::printf("> does this code block have a jcc? %s\n",
code_block.jcc.has_jcc ? "yes" : "no");
if (code_block.jcc.has_jcc) {
switch (code_block.jcc.type) {
case vm::instrs::jcc_type::branching: {
std::printf("> branch 1 = %p, branch 2 = %p\n",
code_block.jcc.block_addr[0],
code_block.jcc.block_addr[1]);
break;
}
case vm::instrs::jcc_type::absolute: {
std::printf("> branch 1 = %p\n", code_block.jcc.block_addr[0]);
break;
}
case vm::instrs::jcc_type::switch_case: {
std::printf("> switch case blocks:\n");
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
std::printf(" case block at = 0x%p\n",
code_block.jcc.block_addr[idx]);
break;
}
} }
}
}
std::printf( "> number of blocks = %d\n", code_blocks.size() ); std::printf("> serializing results....\n");
vmp2::v4::file_header file_header;
for ( auto &code_block : code_blocks ) file_header.magic = VMP_MAGIC;
{ file_header.epoch_time = std::time(nullptr);
std::printf( "> code block starts at = %p\n", code_block.vip_begin ); file_header.version = vmp2::version_t::v4;
std::printf( "> number of virtual instructions = %d\n", code_block.vinstrs.size() ); file_header.module_base = module_base;
std::printf( "> does this code block have a jcc? %s\n", code_block.jcc.has_jcc ? "yes" : "no" ); file_header.image_base = image_base;
file_header.vm_entry_rva = vm_entry_rva;
if ( code_block.jcc.has_jcc ) file_header.module_offset = sizeof file_header;
{ file_header.module_size = image_size;
switch ( code_block.jcc.type ) file_header.rtn_count = 1;
{ file_header.rtn_offset = image_size + sizeof file_header;
case vm::instrs::jcc_type::branching:
{ vmp2::v4::rtn_t rtn;
std::printf( "> branch 1 = %p, branch 2 = %p\n", code_block.jcc.block_addr[ 0 ], std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
code_block.jcc.block_addr[ 1 ] ); output.write(reinterpret_cast<const char *>(&file_header),
break; sizeof file_header);
} output.write(reinterpret_cast<const char *>(module_base), image_size);
case vm::instrs::jcc_type::absolute:
{ std::vector<vmp2::v4::code_block_t *> vmp2_blocks;
std::printf( "> branch 1 = %p\n", code_block.jcc.block_addr[ 0 ] ); for (const auto &code_block : code_blocks) {
break; const auto _code_block_size =
} sizeof(vmp2::v4::code_block_t) +
case vm::instrs::jcc_type::switch_case: (code_block.jcc.block_addr.size() * 8) +
{ code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
std::printf( "> switch case blocks:\n" );
for ( auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx ) vmp2::v4::code_block_t *_code_block =
std::printf( " case block at = 0x%p\n", code_block.jcc.block_addr[ idx ] ); reinterpret_cast<vmp2::v4::code_block_t *>(malloc(_code_block_size));
break;
} // serialize block meta data...
} _code_block->vip_begin = code_block.vip_begin;
} _code_block->next_block_offset = _code_block_size;
} _code_block->vinstr_count = code_block.vinstrs.size();
_code_block->has_jcc = code_block.jcc.has_jcc;
_code_block->jcc_type = code_block.jcc.type;
_code_block->num_block_addrs = code_block.jcc.block_addr.size();
// serialize jcc branches...
for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
_code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>(
reinterpret_cast<std::uintptr_t>(_code_block) +
sizeof(vmp2::v4::code_block_t) +
(code_block.jcc.block_addr.size() * 8));
for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx)
block_vinstrs[idx] = code_block.vinstrs[idx];
vmp2_blocks.push_back(_code_block);
}
std::printf( "> serializing results....\n" ); std::size_t code_blocks_size = sizeof(vmp2::v4::rtn_t::size) +
vmp2::v4::file_header file_header; sizeof(vmp2::v4::rtn_t::code_block_count) +
file_header.magic = VMP_MAGIC; sizeof(vmp2::v4::rtn_t::vm_enter_offset);
file_header.epoch_time = std::time( nullptr );
file_header.version = vmp2::version_t::v4; std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
file_header.module_base = module_base; [&](vmp2::v4::code_block_t *vmp2_block) -> void {
file_header.image_base = image_base; code_blocks_size += vmp2_block->next_block_offset;
file_header.vm_entry_rva = vm_entry_rva; });
file_header.module_offset = sizeof file_header;
file_header.module_size = image_size; rtn.size = code_blocks_size;
file_header.rtn_count = 1; rtn.code_block_count = vmp2_blocks.size();
file_header.rtn_offset = image_size + sizeof file_header; rtn.vm_enter_offset = vm_entry_rva;
vmp2::v4::rtn_t rtn; output.write(reinterpret_cast<const char *>(&rtn),
std::ofstream output( parser.get< std::string >( "out" ), std::ios::binary ); sizeof(vmp2::v4::rtn_t::size) +
output.write( reinterpret_cast< const char * >( &file_header ), sizeof file_header ); sizeof(vmp2::v4::rtn_t::code_block_count) +
output.write( reinterpret_cast< const char * >( module_base ), image_size ); sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::vector< vmp2::v4::code_block_t * > vmp2_blocks; std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
for ( const auto &code_block : code_blocks ) [&](vmp2::v4::code_block_t *vmp2_block) -> void {
{ output.write(reinterpret_cast<const char *>(vmp2_block),
const auto _code_block_size = sizeof vmp2::v4::code_block_t + ( code_block.jcc.block_addr.size() * 8 ) + vmp2_block->next_block_offset);
code_block.vinstrs.size() * sizeof vm::instrs::virt_instr_t; free(vmp2_block);
});
vmp2::v4::code_block_t *_code_block = output.close();
reinterpret_cast< vmp2::v4::code_block_t * >( malloc( _code_block_size ) ); } else if (parser.exists("unpack")) {
engine::unpack_t unpacker(parser.get<std::string>("bin"), module_data);
// serialize block meta data...
_code_block->vip_begin = code_block.vip_begin; if (!unpacker.init()) {
_code_block->next_block_offset = _code_block_size; std::printf("> failed to init unpacker...\n");
_code_block->vinstr_count = code_block.vinstrs.size(); return -1;
_code_block->has_jcc = code_block.jcc.has_jcc; }
_code_block->jcc_type = code_block.jcc.type;
_code_block->num_block_addrs = code_block.jcc.block_addr.size();
// serialize jcc branches...
for ( auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx )
_code_block->branch_addr[ idx ] = code_block.jcc.block_addr[ idx ];
auto block_vinstrs = reinterpret_cast< vm::instrs::virt_instr_t * >(
reinterpret_cast< std::uintptr_t >( _code_block ) + sizeof vmp2::v4::code_block_t +
( code_block.jcc.block_addr.size() * 8 ) );
for ( auto idx = 0u; idx < code_block.vinstrs.size(); ++idx )
block_vinstrs[ idx ] = code_block.vinstrs[ idx ];
vmp2_blocks.push_back( _code_block );
}
std::size_t code_blocks_size = sizeof( vmp2::v4::rtn_t::size ) + sizeof( vmp2::v4::rtn_t::code_block_count ) + if (!unpacker.unpack(unpacked_bin)) {
sizeof( vmp2::v4::rtn_t::vm_enter_offset ); std::printf("> failed to unpack binary... refer to log above...\n");
return -1;
}
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::printf("> writing result to = %s\n",
code_blocks_size += vmp2_block->next_block_offset; parser.get<std::string>("out").c_str());
} );
rtn.size = code_blocks_size; std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
rtn.code_block_count = vmp2_blocks.size(); output.write(reinterpret_cast<char *>(unpacked_bin.data()),
rtn.vm_enter_offset = vm_entry_rva; unpacked_bin.size());
output.write( reinterpret_cast< const char * >( &rtn ), sizeof( vmp2::v4::rtn_t::size ) + output.close();
sizeof( vmp2::v4::rtn_t::code_block_count ) + } else if (parser.exists("emuall")) {
sizeof( vmp2::v4::rtn_t::vm_enter_offset ) ); auto entries = vm::locate::get_vm_entries(module_base, image_size);
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void { std::vector<
output.write( reinterpret_cast< const char * >( vmp2_block ), vmp2_block->next_block_offset ); std::pair<std::uintptr_t, std::vector<vm::instrs::code_block_t> > >
free( vmp2_block ); virt_rtns;
} );
output.close();
}
else if ( parser.exists( "unpack" ) && parser.exists( "out" ) )
{
std::vector< std::uint8_t > packed_bin, unpacked_bin;
if ( !umtils->open_binary_file( parser.get< std::string >( "unpack" ), packed_bin ) )
{
std::printf( "> failed to read bin off disk...\n" );
return -1;
}
engine::unpack_t unpacker( packed_bin ); for (const auto &[vm_enter_offset, encrypted_rva, hndlr_tble] : entries) {
std::printf("> emulating vm enter at rva = 0x%x\n", vm_enter_offset);
vm::ctx_t vm_ctx(module_base, image_base, image_size, vm_enter_offset);
if ( !unpacker.init() ) if (!vm_ctx.init()) {
{ std::printf(
std::printf( "> failed to init unpacker...\n" ); "[!] failed to init vmctx... this can be for many reasons..."
return -1; " try validating your vm entry rva... make sure the binary is "
} "unpacked and is"
"protected with VMProtect 2...\n");
return -1;
}
if ( !unpacker.unpack( unpacked_bin ) ) vm::emu_t emu(&vm_ctx);
{
std::printf( "> failed to unpack binary... refer to log above...\n" );
return -1;
}
std::printf( "> writing result to = %s\n", parser.get< std::string >( "out" ).c_str() ); if (!emu.init()) {
std::ofstream output( parser.get< std::string >( "out" ), std::ios::binary ); std::printf("[!] failed to init emulator...\n");
output.write( reinterpret_cast< char * >( unpacked_bin.data() ), unpacked_bin.size() ); return -1;
output.close(); }
}
else if ( parser.exists( "bin" ) && parser.exists( "emuall" ) && parser.exists( "out" ) )
{
const auto module_base = reinterpret_cast< std::uintptr_t >(
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() );
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage;
auto vm_handler_tables = vm::locate::all_handler_tables( module_base );
auto vm_enters = vm::locate::all_vm_enters( module_base, vm_handler_tables );
std::vector< std::pair< std::uintptr_t, std::vector< vm::instrs::code_block_t > > > virt_rtns;
for ( const auto &[ vm_enter_offset, encrypted_rva ] : vm_enters )
{
std::printf( "> emulating vm enter at rva = 0x%x\n", vm_enter_offset );
vm::ctx_t vm_ctx( module_base, image_base, image_size, vm_enter_offset );
if ( !vm_ctx.init() )
{
std::printf( "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is"
"protected with VMProtect 2...\n" );
return -1;
}
vm::emu_t emu( &vm_ctx );
if ( !emu.init() )
{
std::printf( "[!] failed to init emulator...\n" );
return -1;
}
std::vector< vm::instrs::code_block_t > code_blocks;
if ( !emu.get_trace( code_blocks ) )
{
std::printf( "[!] something failed during tracing, review the console for more information...\n" );
continue;
}
std::printf( "> number of blocks = %d\n", code_blocks.size() );
virt_rtns.push_back( { vm_enter_offset, code_blocks } );
}
std::printf( "> traced %d virtual routines...\n", virt_rtns.size() ); std::vector<vm::instrs::code_block_t> code_blocks;
std::printf( "> serializing results....\n" );
if (!emu.get_trace(code_blocks)) {
vmp2::v4::file_header file_header; std::printf(
file_header.magic = VMP_MAGIC; "[!] something failed during tracing, review the console for more "
file_header.epoch_time = std::time( nullptr ); "information...\n");
file_header.version = vmp2::version_t::v4; continue;
file_header.module_base = module_base; }
file_header.image_base = image_base;
file_header.vm_entry_rva = 0ull; std::printf("> number of blocks = %d\n", code_blocks.size());
file_header.module_offset = sizeof file_header; virt_rtns.push_back({vm_enter_offset, code_blocks});
file_header.module_size = image_size;
file_header.rtn_count = virt_rtns.size();
file_header.rtn_offset = image_size + sizeof file_header;
std::ofstream output( parser.get< std::string >( "out" ), std::ios::binary );
output.write( reinterpret_cast< const char * >( &file_header ), sizeof file_header );
output.write( reinterpret_cast< const char * >( module_base ), image_size );
for ( auto &[ vm_enter_offset, virt_rtn ] : virt_rtns )
{
vmp2::v4::rtn_t rtn{ virt_rtn.size() };
std::vector< vmp2::v4::code_block_t * > vmp2_blocks;
for ( const auto &code_block : virt_rtn )
{
const auto _code_block_size = sizeof vmp2::v4::code_block_t + ( code_block.jcc.block_addr.size() * 8 ) +
code_block.vinstrs.size() * sizeof vm::instrs::virt_instr_t;
vmp2::v4::code_block_t *_code_block =
reinterpret_cast< vmp2::v4::code_block_t * >( malloc( _code_block_size ) );
// serialize block meta data...
_code_block->vip_begin = code_block.vip_begin;
_code_block->next_block_offset = _code_block_size;
_code_block->vinstr_count = code_block.vinstrs.size();
_code_block->has_jcc = code_block.jcc.has_jcc;
_code_block->jcc_type = code_block.jcc.type;
_code_block->num_block_addrs = code_block.jcc.block_addr.size();
// serialize jcc branches...
for ( auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx )
_code_block->branch_addr[ idx ] = code_block.jcc.block_addr[ idx ];
auto block_vinstrs = reinterpret_cast< vm::instrs::virt_instr_t * >(
reinterpret_cast< std::uintptr_t >( _code_block ) + sizeof vmp2::v4::code_block_t +
( code_block.jcc.block_addr.size() * 8 ) );
for ( auto idx = 0u; idx < code_block.vinstrs.size(); ++idx )
block_vinstrs[ idx ] = code_block.vinstrs[ idx ];
vmp2_blocks.push_back( _code_block );
}
std::size_t code_blocks_size = sizeof( vmp2::v4::rtn_t::size ) +
sizeof( vmp2::v4::rtn_t::vm_enter_offset ) +
sizeof( vmp2::v4::rtn_t::code_block_count );
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void {
code_blocks_size += vmp2_block->next_block_offset;
} );
rtn.size = code_blocks_size;
rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_enter_offset;
output.write( reinterpret_cast< const char * >( &rtn ), sizeof( vmp2::v4::rtn_t::size ) +
sizeof( vmp2::v4::rtn_t::code_block_count ) +
sizeof( vmp2::v4::rtn_t::vm_enter_offset ) );
std::for_each( vmp2_blocks.begin(), vmp2_blocks.end(), [ & ]( vmp2::v4::code_block_t *vmp2_block ) -> void {
output.write( reinterpret_cast< const char * >( vmp2_block ), vmp2_block->next_block_offset );
free( vmp2_block );
} );
}
output.close();
} }
else if ( parser.exists( "bin" ) && parser.exists( "locateconst" ) )
{ std::printf("> traced %d virtual routines...\n", virt_rtns.size());
const auto module_base = reinterpret_cast< std::uintptr_t >( std::printf("> serializing results....\n");
LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
vmp2::v4::file_header file_header;
const auto const_val = std::strtoull( parser.get< std::string >( "locateconst" ).c_str(), nullptr, 16 ); file_header.magic = VMP_MAGIC;
const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() ); file_header.epoch_time = std::time(nullptr);
const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; file_header.version = vmp2::version_t::v4;
file_header.module_base = module_base;
auto vm_handler_tables = vm::locate::all_handler_tables( module_base ); file_header.image_base = image_base;
auto vm_enters = vm::locate::all_vm_enters( module_base, vm_handler_tables ); file_header.vm_entry_rva = 0ull;
file_header.module_offset = sizeof file_header;
std::printf( "> number of vm enters = %d\n", vm_enters.size() ); file_header.module_size = image_size;
for ( const auto &[ vm_enter_offset, encrypted_rva ] : vm_enters ) file_header.rtn_count = virt_rtns.size();
{ file_header.rtn_offset = image_size + sizeof file_header;
std::printf( "> emulating vm enter at rva = 0x%x\n", vm_enter_offset );
vm::ctx_t vm_ctx( module_base, image_base, image_size, vm_enter_offset ); std::ofstream output(parser.get<std::string>("out"), std::ios::binary);
output.write(reinterpret_cast<const char *>(&file_header),
if ( !vm_ctx.init() ) sizeof file_header);
{ output.write(reinterpret_cast<const char *>(module_base), image_size);
std::printf( "[!] failed to init vmctx... this can be for many reasons..."
" try validating your vm entry rva... make sure the binary is unpacked and is" for (auto &[vm_enter_offset, virt_rtn] : virt_rtns) {
"protected with VMProtect 2...\n" ); vmp2::v4::rtn_t rtn{(u32)virt_rtn.size()};
return -1; std::vector<vmp2::v4::code_block_t *> vmp2_blocks;
}
for (const auto &code_block : virt_rtn) {
vm::emu_t emu( &vm_ctx ); const auto _code_block_size =
sizeof(vmp2::v4::code_block_t) +
if ( !emu.init() ) (code_block.jcc.block_addr.size() * 8) +
{ code_block.vinstrs.size() * sizeof(vm::instrs::virt_instr_t);
std::printf( "[!] failed to init emulator...\n" );
return -1; vmp2::v4::code_block_t *_code_block =
} reinterpret_cast<vmp2::v4::code_block_t *>(
malloc(_code_block_size));
std::vector< vm::instrs::code_block_t > code_blocks;
// serialize block meta data...
if ( !emu.get_trace( code_blocks ) ) _code_block->vip_begin = code_block.vip_begin;
{ _code_block->next_block_offset = _code_block_size;
std::printf( "[!] something failed during tracing, review the console for more information...\n" ); _code_block->vinstr_count = code_block.vinstrs.size();
return -1; _code_block->has_jcc = code_block.jcc.has_jcc;
} _code_block->jcc_type = code_block.jcc.type;
_code_block->num_block_addrs = code_block.jcc.block_addr.size();
std::printf( "> number of blocks = %d\n", code_blocks.size() );
// serialize jcc branches...
for ( auto &code_block : code_blocks ) for (auto idx = 0u; idx < code_block.jcc.block_addr.size(); ++idx)
{ _code_block->branch_addr[idx] = code_block.jcc.block_addr[idx];
for ( const auto &vinstr : code_block.vinstrs )
{ auto block_vinstrs = reinterpret_cast<vm::instrs::virt_instr_t *>(
if ( vinstr.operand.has_imm && vinstr.operand.imm.u == const_val ) reinterpret_cast<std::uintptr_t>(_code_block) +
{ sizeof(vmp2::v4::code_block_t) +
std::printf( "> found constant in vm enter at = 0x%x\n", vm_enter_offset ); (code_block.jcc.block_addr.size() * 8));
std::getchar();
} for (auto idx = 0u; idx < code_block.vinstrs.size(); ++idx)
} block_vinstrs[idx] = code_block.vinstrs[idx];
}
} vmp2_blocks.push_back(_code_block);
}
std::size_t code_blocks_size = sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset) +
sizeof(vmp2::v4::rtn_t::code_block_count);
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void {
code_blocks_size += vmp2_block->next_block_offset;
});
rtn.size = code_blocks_size;
rtn.code_block_count = vmp2_blocks.size();
rtn.vm_enter_offset = vm_enter_offset;
output.write(reinterpret_cast<const char *>(&rtn),
sizeof(vmp2::v4::rtn_t::size) +
sizeof(vmp2::v4::rtn_t::code_block_count) +
sizeof(vmp2::v4::rtn_t::vm_enter_offset));
std::for_each(vmp2_blocks.begin(), vmp2_blocks.end(),
[&](vmp2::v4::code_block_t *vmp2_block) -> void {
output.write(reinterpret_cast<const char *>(vmp2_block),
vmp2_block->next_block_offset);
free(vmp2_block);
});
} }
output.close();
}
} }

1048
src/unpacker.cpp
View File

File diff suppressed because it is too large Load Diff

1268
src/vmemu_t.cpp
View File

File diff suppressed because it is too large Load Diff
Write Preview
Loading…
Cancel
Save