completely reconfigured vmprofiler cpp files...

merge-requests/1/head
_xeroxz 4 years ago
parent e3eee4b02d
commit 0a8a67a311

3
.gitmodules vendored

@ -7,3 +7,6 @@
[submodule "dependencies/cli-parser"] [submodule "dependencies/cli-parser"]
path = dependencies/cli-parser path = dependencies/cli-parser
url = https://githacks.org/_xeroxz/cli-parser.git url = https://githacks.org/_xeroxz/cli-parser.git
[submodule "dependencies/xtils"]
path = dependencies/xtils
url = https://githacks.org/_xeroxz/xtils.git

@ -1 +1 @@
Subproject commit 05c8f779d0848d4853a62f9fe169a2708628f29e Subproject commit b9dc2520fea397d1ff110cabb71786db3375b787

@ -0,0 +1 @@
Subproject commit 7c32517322c29a866cbb1e67fb9051efa2e05553

@ -2,10 +2,12 @@
#include <Windows.h> #include <Windows.h>
#include <fstream> #include <fstream>
#include <filesystem> #include <filesystem>
#include <vmp2.hpp> #include <vmp2.hpp>
#include <vmctx.h> #include <vmctx.h>
#include <vm.h> #include <vmprofiler.hpp>
#include <cli-parser.hpp> #include <cli-parser.hpp>
#include <xtils.hpp>
int __cdecl main(int argc, const char* argv[]) int __cdecl main(int argc, const char* argv[])
{ {
@ -22,15 +24,14 @@ int __cdecl main(int argc, const char* argv[])
.description("rva to push prior to a vm_entry") .description("rva to push prior to a vm_entry")
.required(true); .required(true);
parser.add_argument()
.names({ "--imagebase", "--base" })
.description("image base from OptionalHeader::ImageBase")
.required(true);
parser.add_argument() parser.add_argument()
.names({ "--vmtrace", "--trace" }) .names({ "--vmtrace", "--trace" })
.description("a vmp2 file generated by a vmtracer"); .description("a vmp2 file generated by a vmtracer");
parser.add_argument()
.name("--show-vm-handlers")
.description("show all vm handlers...");
parser.enable_help(); parser.enable_help();
auto err = parser.parse(argc, argv); auto err = parser.parse(argc, argv);
@ -55,8 +56,9 @@ int __cdecl main(int argc, const char* argv[])
module_base + std::strtoull( module_base + std::strtoull(
parser.get<std::string>("vmentry").c_str(), nullptr, 16); parser.get<std::string>("vmentry").c_str(), nullptr, 16);
const auto image_base = std::strtoull( const auto image_base =
parser.get<std::string>("imagebase").c_str(), nullptr, 16); xtils::um_t::get_instance()->image_base(
parser.get<std::string>("bin").c_str());
zydis_routine_t vm_entry; zydis_routine_t vm_entry;
std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); std::printf("> vm entry start = 0x%p\n", vm_entry_ptr);
@ -70,9 +72,11 @@ int __cdecl main(int argc, const char* argv[])
vm::util::deobfuscate(vm_entry); vm::util::deobfuscate(vm_entry);
std::printf("> flattened vm entry...\n"); std::printf("> flattened vm entry...\n");
std::printf("> deobfuscated vm entry...\n"); std::printf("> deobfuscated vm entry...\n");
std::printf("==================================================================================\n");
vm::util::print(vm_entry); vm::util::print(vm_entry);
const auto vm_handler_table = vm::handler::table::get(vm_entry); const auto vm_handler_table =
vm::handler::table::get(vm_entry);
if (!vm_handler_table) if (!vm_handler_table)
{ {
@ -80,16 +84,48 @@ int __cdecl main(int argc, const char* argv[])
return -1; return -1;
} }
std::printf("==================================================================================\n");
std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table,
(reinterpret_cast<std::uintptr_t>(vm_handler_table) - module_base) + image_base); (reinterpret_cast<std::uintptr_t>(vm_handler_table) - module_base) + image_base);
std::vector<vm::handler_t> vm_handlers; zydis_decoded_instr_t vm_handler_transform;
if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform))
{
std::printf("[!] failed to locate vm handler table entry transformation...\n");
return -1;
}
std::printf("> vm handler table entries decrypted with = ");
vm::util::print(vm_handler_transform);
vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic];
std::printf("> vm handler table entries encrypted with = ");
vm::util::print(vm_handler_transform);
std::printf("==================================================================================\n");
std::vector<zydis_decoded_instr_t> vinstr_rva_decrypt_instrs;
if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs))
{
std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n");
return -1;
}
std::printf("> virtual instruction rva decryption instructions:\n");
for (auto& transform : vinstr_rva_decrypt_instrs)
{
std::printf("\t");
vm::util::print(transform);
}
std::vector<vm::handler::handler_t> vm_handlers;
if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers))
{ {
std::printf("> failed to get all vm handler meta data...\n"); std::printf("> failed to get all vm handler meta data...\n");
return -1; return -1;
} }
if (parser.exists("show-vm-handlers"))
{
for (auto idx = 0u; idx < vm_handlers.size(); ++idx) for (auto idx = 0u; idx < vm_handlers.size(); ++idx)
{ {
auto vm_handler = vm_handlers[idx]; auto vm_handler = vm_handlers[idx];
@ -109,6 +145,7 @@ int __cdecl main(int argc, const char* argv[])
std::printf("=======================================================\n\n"); std::printf("=======================================================\n\n");
} }
}
if (parser.exists("vmtrace")) if (parser.exists("vmtrace"))
{ {
@ -144,7 +181,5 @@ int __cdecl main(int argc, const char* argv[])
std::tie(virt_instr, log_entry) = vmctx.step()) std::tie(virt_instr, log_entry) = vmctx.step())
std::printf("> %s\n", virt_instr.c_str()); std::printf("> %s\n", virt_instr.c_str());
} }
std::printf("> finished...\n"); std::printf("> finished...\n");
std::getchar();
} }

@ -33,7 +33,7 @@
<PropertyGroup Label="UserMacros" /> <PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental> <LinkIncremental>false</LinkIncremental>
<IncludePath>$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(IncludePath)</IncludePath> <IncludePath>$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\xtils\;$(IncludePath)</IncludePath>
</PropertyGroup> </PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile> <ClCompile>
@ -41,7 +41,7 @@
<FunctionLevelLinking>true</FunctionLevelLinking> <FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions> <IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck> <SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> <PreprocessorDefinitions>NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode> <ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpplatest</LanguageStandard> <LanguageStandard>stdcpplatest</LanguageStandard>
<Optimization>Disabled</Optimization> <Optimization>Disabled</Optimization>
@ -114,6 +114,7 @@
<ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Status.h" /> <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Status.h" />
<ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Utils.h" /> <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Utils.h" />
<ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Zydis.h" /> <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Zydis.h" />
<ClInclude Include="..\dependencies\xtils\xtils.hpp" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj"> <ProjectReference Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj">

@ -194,5 +194,8 @@
<ClInclude Include="..\dependencies\vmprofiler\include\ZydisExportConfig.h"> <ClInclude Include="..\dependencies\vmprofiler\include\ZydisExportConfig.h">
<Filter>Header Files</Filter> <Filter>Header Files</Filter>
</ClInclude> </ClInclude>
<ClInclude Include="..\dependencies\xtils\xtils.hpp">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup> </ItemGroup>
</Project> </Project>
Loading…
Cancel
Save