completely reconfigured vmprofiler cpp files...

.gitmodules

@@ -7,3 +7,6 @@
 [submodule "dependencies/cli-parser"]
 	path = dependencies/cli-parser
 	url = https://githacks.org/_xeroxz/cli-parser.git
+[submodule "dependencies/xtils"]
+	path = dependencies/xtils
+	url = https://githacks.org/_xeroxz/xtils.git

dependencies/vmprofiler

@@ -1 +1 @@
-Subproject commit 05c8f779d0848d4853a62f9fe169a2708628f29e
+Subproject commit b9dc2520fea397d1ff110cabb71786db3375b787

dependencies/xtils

@@ -0,0 +1 @@
+Subproject commit 7c32517322c29a866cbb1e67fb9051efa2e05553

src/main.cpp

@@ -2,10 +2,12 @@
 #include <Windows.h>
 #include <fstream>
 #include <filesystem>
+
 #include <vmp2.hpp>
 #include <vmctx.h>
-#include <vm.h>
+#include <vmprofiler.hpp>
 #include <cli-parser.hpp>
+#include <xtils.hpp>
 
 int __cdecl main(int argc, const char* argv[])
 {
@@ -22,15 +24,14 @@ int __cdecl main(int argc, const char* argv[])
 		.description("rva to push prior to a vm_entry")
 		.required(true);
 
-	parser.add_argument()
-		.names({ "--imagebase", "--base" })
-		.description("image base from OptionalHeader::ImageBase")
-		.required(true);
-
 	parser.add_argument()
 		.names({ "--vmtrace", "--trace" })
 		.description("a vmp2 file generated by a vmtracer");
 
+	parser.add_argument()
+		.name("--show-vm-handlers")
+		.description("show all vm handlers...");
+
 	parser.enable_help();
 	auto err = parser.parse(argc, argv);
 
@@ -55,8 +56,9 @@ int __cdecl main(int argc, const char* argv[])
 		module_base + std::strtoull(
 			parser.get<std::string>("vmentry").c_str(), nullptr, 16);
 
-	const auto image_base = std::strtoull(
+	const auto image_base = 
-		parser.get<std::string>("imagebase").c_str(), nullptr, 16);
+		xtils::um_t::get_instance()->image_base(
+			parser.get<std::string>("bin").c_str());
 
 	zydis_routine_t vm_entry;
 	std::printf("> vm entry start = 0x%p\n", vm_entry_ptr);
@@ -70,9 +72,11 @@ int __cdecl main(int argc, const char* argv[])
 	vm::util::deobfuscate(vm_entry);
 	std::printf("> flattened vm entry...\n");
 	std::printf("> deobfuscated vm entry...\n");
+	std::printf("==================================================================================\n");
 	vm::util::print(vm_entry);
 
-	const auto vm_handler_table = vm::handler::table::get(vm_entry);
+	const auto vm_handler_table = 
+		vm::handler::table::get(vm_entry);
 
 	if (!vm_handler_table)
 	{
@@ -80,34 +84,67 @@ int __cdecl main(int argc, const char* argv[])
 		return -1;
 	}
 
+	std::printf("==================================================================================\n");
 	std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table,
 		(reinterpret_cast<std::uintptr_t>(vm_handler_table) - module_base) + image_base);
 
-	std::vector<vm::handler_t> vm_handlers;
+	zydis_decoded_instr_t vm_handler_transform;
-	if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers))
+	if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform))
 	{
-		std::printf("> failed to get all vm handler meta data...\n");
+		std::printf("[!] failed to locate vm handler table entry transformation...\n");
 		return -1;
 	}
 
-	for (auto idx = 0u; idx < vm_handlers.size(); ++idx)
+	std::printf("> vm handler table entries decrypted with = ");
+	vm::util::print(vm_handler_transform);
+
+	vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic];
+	std::printf("> vm handler table entries encrypted with = ");
+	vm::util::print(vm_handler_transform);
+
+	std::printf("==================================================================================\n");
+	std::vector<zydis_decoded_instr_t> vinstr_rva_decrypt_instrs;
+	if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs))
 	{
-		auto vm_handler = vm_handlers[idx];
+		std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n");
-		std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", 
+		return -1;
-			vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx,
+	}
-			vm_handler.imm_size);
 
-		std::printf("================[vm handler instructions]==============\n");
+	std::printf("> virtual instruction rva decryption instructions:\n");
-		vm::util::print(vm_handler.instrs);
+	for (auto& transform : vinstr_rva_decrypt_instrs)
+	{
+		std::printf("\t");
+		vm::util::print(transform);
+	}
 
-		if (vm_handler.imm_size)
+	std::vector<vm::handler::handler_t> vm_handlers;
+	if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers))
+	{
+		std::printf("> failed to get all vm handler meta data...\n");
+		return -1;
+	}
+
+	if (parser.exists("show-vm-handlers"))
+	{
+		for (auto idx = 0u; idx < vm_handlers.size(); ++idx)
 		{
-			std::printf("=================[vm handler transforms]===============\n");
+			auto vm_handler = vm_handlers[idx];
-			for (const auto& [transform_type, transform] : vm_handler.transforms)
+			std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n",
-				vm::util::print(transform);
+				vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx,
+				vm_handler.imm_size);
+
+			std::printf("================[vm handler instructions]==============\n");
+			vm::util::print(vm_handler.instrs);
+
+			if (vm_handler.imm_size)
+			{
+				std::printf("=================[vm handler transforms]===============\n");
+				for (const auto& [transform_type, transform] : vm_handler.transforms)
+					vm::util::print(transform);
+			}
+
+			std::printf("=======================================================\n\n");
 		}
-
-		std::printf("=======================================================\n\n");
 	}
 
 	if (parser.exists("vmtrace"))
@@ -144,7 +181,5 @@ int __cdecl main(int argc, const char* argv[])
 			std::tie(virt_instr, log_entry) = vmctx.step())
 				std::printf("> %s\n", virt_instr.c_str());
 	}
-
 	std::printf("> finished...\n");
-	std::getchar();
 }

src/vmprofiler-cli.vcxproj

@@ -33,7 +33,7 @@
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <LinkIncremental>false</LinkIncremental>
-    <IncludePath>$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(IncludePath)</IncludePath>
+    <IncludePath>$(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\xtils\;$(IncludePath)</IncludePath>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <ClCompile>
@@ -41,7 +41,7 @@
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
-      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <Optimization>Disabled</Optimization>
@@ -114,6 +114,7 @@
     <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Status.h" />
     <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Utils.h" />
     <ClInclude Include="..\dependencies\vmprofiler\include\Zydis\Zydis.h" />
+    <ClInclude Include="..\dependencies\xtils\xtils.hpp" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\dependencies\vmprofiler\dependencies\zydis\msvc\zydis\Zydis.vcxproj">

src/vmprofiler-cli.vcxproj.filters

@@ -194,5 +194,8 @@
     <ClInclude Include="..\dependencies\vmprofiler\include\ZydisExportConfig.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\dependencies\xtils\xtils.hpp">
+      <Filter>Header Files</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>