diff --git a/.gitmodules b/.gitmodules index 5947c6a..0d92ff0 100644 --- a/.gitmodules +++ b/.gitmodules @@ -7,3 +7,6 @@ [submodule "dependencies/cli-parser"] path = dependencies/cli-parser url = https://githacks.org/_xeroxz/cli-parser.git +[submodule "dependencies/xtils"] + path = dependencies/xtils + url = https://githacks.org/_xeroxz/xtils.git diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index 05c8f77..b9dc252 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit 05c8f779d0848d4853a62f9fe169a2708628f29e +Subproject commit b9dc2520fea397d1ff110cabb71786db3375b787 diff --git a/dependencies/xtils b/dependencies/xtils new file mode 160000 index 0000000..7c32517 --- /dev/null +++ b/dependencies/xtils @@ -0,0 +1 @@ +Subproject commit 7c32517322c29a866cbb1e67fb9051efa2e05553 diff --git a/src/main.cpp b/src/main.cpp index 8b5ff2e..d20db11 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -2,10 +2,12 @@ #include #include #include + #include #include -#include +#include #include +#include int __cdecl main(int argc, const char* argv[]) { @@ -22,15 +24,14 @@ int __cdecl main(int argc, const char* argv[]) .description("rva to push prior to a vm_entry") .required(true); - parser.add_argument() - .names({ "--imagebase", "--base" }) - .description("image base from OptionalHeader::ImageBase") - .required(true); - parser.add_argument() .names({ "--vmtrace", "--trace" }) .description("a vmp2 file generated by a vmtracer"); + parser.add_argument() + .name("--show-vm-handlers") + .description("show all vm handlers..."); + parser.enable_help(); auto err = parser.parse(argc, argv); @@ -55,8 +56,9 @@ int __cdecl main(int argc, const char* argv[]) module_base + std::strtoull( parser.get("vmentry").c_str(), nullptr, 16); - const auto image_base = std::strtoull( - parser.get("imagebase").c_str(), nullptr, 16); + const auto image_base = + xtils::um_t::get_instance()->image_base( + parser.get("bin").c_str()); zydis_routine_t vm_entry; std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); @@ -70,9 +72,11 @@ int __cdecl main(int argc, const char* argv[]) vm::util::deobfuscate(vm_entry); std::printf("> flattened vm entry...\n"); std::printf("> deobfuscated vm entry...\n"); + std::printf("==================================================================================\n"); vm::util::print(vm_entry); - const auto vm_handler_table = vm::handler::table::get(vm_entry); + const auto vm_handler_table = + vm::handler::table::get(vm_entry); if (!vm_handler_table) { @@ -80,34 +84,67 @@ int __cdecl main(int argc, const char* argv[]) return -1; } + std::printf("==================================================================================\n"); std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, (reinterpret_cast(vm_handler_table) - module_base) + image_base); - std::vector vm_handlers; - if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) + zydis_decoded_instr_t vm_handler_transform; + if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform)) { - std::printf("> failed to get all vm handler meta data...\n"); + std::printf("[!] failed to locate vm handler table entry transformation...\n"); return -1; } - for (auto idx = 0u; idx < vm_handlers.size(); ++idx) + std::printf("> vm handler table entries decrypted with = "); + vm::util::print(vm_handler_transform); + + vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic]; + std::printf("> vm handler table entries encrypted with = "); + vm::util::print(vm_handler_transform); + + std::printf("==================================================================================\n"); + std::vector vinstr_rva_decrypt_instrs; + if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs)) { - auto vm_handler = vm_handlers[idx]; - std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", - vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, - vm_handler.imm_size); + std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n"); + return -1; + } - std::printf("================[vm handler instructions]==============\n"); - vm::util::print(vm_handler.instrs); + std::printf("> virtual instruction rva decryption instructions:\n"); + for (auto& transform : vinstr_rva_decrypt_instrs) + { + std::printf("\t"); + vm::util::print(transform); + } - if (vm_handler.imm_size) + std::vector vm_handlers; + if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) + { + std::printf("> failed to get all vm handler meta data...\n"); + return -1; + } + + if (parser.exists("show-vm-handlers")) + { + for (auto idx = 0u; idx < vm_handlers.size(); ++idx) { - std::printf("=================[vm handler transforms]===============\n"); - for (const auto& [transform_type, transform] : vm_handler.transforms) - vm::util::print(transform); + auto vm_handler = vm_handlers[idx]; + std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", + vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, + vm_handler.imm_size); + + std::printf("================[vm handler instructions]==============\n"); + vm::util::print(vm_handler.instrs); + + if (vm_handler.imm_size) + { + std::printf("=================[vm handler transforms]===============\n"); + for (const auto& [transform_type, transform] : vm_handler.transforms) + vm::util::print(transform); + } + + std::printf("=======================================================\n\n"); } - - std::printf("=======================================================\n\n"); } if (parser.exists("vmtrace")) @@ -144,7 +181,5 @@ int __cdecl main(int argc, const char* argv[]) std::tie(virt_instr, log_entry) = vmctx.step()) std::printf("> %s\n", virt_instr.c_str()); } - std::printf("> finished...\n"); - std::getchar(); } \ No newline at end of file diff --git a/src/vmprofiler-cli.vcxproj b/src/vmprofiler-cli.vcxproj index 3dbff7b..ed393c7 100644 --- a/src/vmprofiler-cli.vcxproj +++ b/src/vmprofiler-cli.vcxproj @@ -33,7 +33,7 @@ false - $(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(IncludePath) + $(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\xtils\;$(IncludePath) @@ -41,7 +41,7 @@ true true true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) true stdcpplatest Disabled @@ -114,6 +114,7 @@ + diff --git a/src/vmprofiler-cli.vcxproj.filters b/src/vmprofiler-cli.vcxproj.filters index 4e22b05..766213f 100644 --- a/src/vmprofiler-cli.vcxproj.filters +++ b/src/vmprofiler-cli.vcxproj.filters @@ -194,5 +194,8 @@ Header Files + + Header Files + \ No newline at end of file