From e3eee4b02dd8f8f39b31207d79e8c7ec938d0fab Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Sun, 23 May 2021 18:29:57 -0700 Subject: [PATCH 1/5] testing new vmprofiler code... --- dependencies/vmprofiler | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index 05ba2cc..05c8f77 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit 05ba2cc84ba94e1d526168ad686fc2e167ad2eab +Subproject commit 05c8f779d0848d4853a62f9fe169a2708628f29e From 0a8a67a311b42dbda6d00caec0b9de15623c44be Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 31 May 2021 21:12:00 -0700 Subject: [PATCH 2/5] completely reconfigured vmprofiler cpp files... --- .gitmodules | 3 + dependencies/vmprofiler | 2 +- dependencies/xtils | 1 + src/main.cpp | 89 +++++++++++++++++++++--------- src/vmprofiler-cli.vcxproj | 5 +- src/vmprofiler-cli.vcxproj.filters | 3 + 6 files changed, 73 insertions(+), 30 deletions(-) create mode 160000 dependencies/xtils diff --git a/.gitmodules b/.gitmodules index 5947c6a..0d92ff0 100644 --- a/.gitmodules +++ b/.gitmodules @@ -7,3 +7,6 @@ [submodule "dependencies/cli-parser"] path = dependencies/cli-parser url = https://githacks.org/_xeroxz/cli-parser.git +[submodule "dependencies/xtils"] + path = dependencies/xtils + url = https://githacks.org/_xeroxz/xtils.git diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index 05c8f77..b9dc252 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit 05c8f779d0848d4853a62f9fe169a2708628f29e +Subproject commit b9dc2520fea397d1ff110cabb71786db3375b787 diff --git a/dependencies/xtils b/dependencies/xtils new file mode 160000 index 0000000..7c32517 --- /dev/null +++ b/dependencies/xtils @@ -0,0 +1 @@ +Subproject commit 7c32517322c29a866cbb1e67fb9051efa2e05553 diff --git a/src/main.cpp b/src/main.cpp index 8b5ff2e..d20db11 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -2,10 +2,12 @@ #include #include #include + #include #include -#include +#include #include +#include int __cdecl main(int argc, const char* argv[]) { @@ -22,15 +24,14 @@ int __cdecl main(int argc, const char* argv[]) .description("rva to push prior to a vm_entry") .required(true); - parser.add_argument() - .names({ "--imagebase", "--base" }) - .description("image base from OptionalHeader::ImageBase") - .required(true); - parser.add_argument() .names({ "--vmtrace", "--trace" }) .description("a vmp2 file generated by a vmtracer"); + parser.add_argument() + .name("--show-vm-handlers") + .description("show all vm handlers..."); + parser.enable_help(); auto err = parser.parse(argc, argv); @@ -55,8 +56,9 @@ int __cdecl main(int argc, const char* argv[]) module_base + std::strtoull( parser.get("vmentry").c_str(), nullptr, 16); - const auto image_base = std::strtoull( - parser.get("imagebase").c_str(), nullptr, 16); + const auto image_base = + xtils::um_t::get_instance()->image_base( + parser.get("bin").c_str()); zydis_routine_t vm_entry; std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); @@ -70,9 +72,11 @@ int __cdecl main(int argc, const char* argv[]) vm::util::deobfuscate(vm_entry); std::printf("> flattened vm entry...\n"); std::printf("> deobfuscated vm entry...\n"); + std::printf("==================================================================================\n"); vm::util::print(vm_entry); - const auto vm_handler_table = vm::handler::table::get(vm_entry); + const auto vm_handler_table = + vm::handler::table::get(vm_entry); if (!vm_handler_table) { @@ -80,34 +84,67 @@ int __cdecl main(int argc, const char* argv[]) return -1; } + std::printf("==================================================================================\n"); std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, (reinterpret_cast(vm_handler_table) - module_base) + image_base); - std::vector vm_handlers; - if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) + zydis_decoded_instr_t vm_handler_transform; + if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform)) { - std::printf("> failed to get all vm handler meta data...\n"); + std::printf("[!] failed to locate vm handler table entry transformation...\n"); return -1; } - for (auto idx = 0u; idx < vm_handlers.size(); ++idx) + std::printf("> vm handler table entries decrypted with = "); + vm::util::print(vm_handler_transform); + + vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic]; + std::printf("> vm handler table entries encrypted with = "); + vm::util::print(vm_handler_transform); + + std::printf("==================================================================================\n"); + std::vector vinstr_rva_decrypt_instrs; + if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs)) { - auto vm_handler = vm_handlers[idx]; - std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", - vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, - vm_handler.imm_size); + std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n"); + return -1; + } - std::printf("================[vm handler instructions]==============\n"); - vm::util::print(vm_handler.instrs); + std::printf("> virtual instruction rva decryption instructions:\n"); + for (auto& transform : vinstr_rva_decrypt_instrs) + { + std::printf("\t"); + vm::util::print(transform); + } - if (vm_handler.imm_size) + std::vector vm_handlers; + if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) + { + std::printf("> failed to get all vm handler meta data...\n"); + return -1; + } + + if (parser.exists("show-vm-handlers")) + { + for (auto idx = 0u; idx < vm_handlers.size(); ++idx) { - std::printf("=================[vm handler transforms]===============\n"); - for (const auto& [transform_type, transform] : vm_handler.transforms) - vm::util::print(transform); + auto vm_handler = vm_handlers[idx]; + std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", + vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, + vm_handler.imm_size); + + std::printf("================[vm handler instructions]==============\n"); + vm::util::print(vm_handler.instrs); + + if (vm_handler.imm_size) + { + std::printf("=================[vm handler transforms]===============\n"); + for (const auto& [transform_type, transform] : vm_handler.transforms) + vm::util::print(transform); + } + + std::printf("=======================================================\n\n"); } - - std::printf("=======================================================\n\n"); } if (parser.exists("vmtrace")) @@ -144,7 +181,5 @@ int __cdecl main(int argc, const char* argv[]) std::tie(virt_instr, log_entry) = vmctx.step()) std::printf("> %s\n", virt_instr.c_str()); } - std::printf("> finished...\n"); - std::getchar(); } \ No newline at end of file diff --git a/src/vmprofiler-cli.vcxproj b/src/vmprofiler-cli.vcxproj index 3dbff7b..ed393c7 100644 --- a/src/vmprofiler-cli.vcxproj +++ b/src/vmprofiler-cli.vcxproj @@ -33,7 +33,7 @@ false - $(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(IncludePath) + $(ProjectDir)..\dependencies\vmprofiler\include\;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\include;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\msvc;$(ProjectDir)..\dependencies\vmprofiler\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\dependencies\cli-parser\;$(ProjectDir)..\dependencies\xtils\;$(IncludePath) @@ -41,7 +41,7 @@ true true true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) true stdcpplatest Disabled @@ -114,6 +114,7 @@ + diff --git a/src/vmprofiler-cli.vcxproj.filters b/src/vmprofiler-cli.vcxproj.filters index 4e22b05..766213f 100644 --- a/src/vmprofiler-cli.vcxproj.filters +++ b/src/vmprofiler-cli.vcxproj.filters @@ -194,5 +194,8 @@ Header Files + + Header Files + \ No newline at end of file From ee73d2fb29593e6b1d15ca71d7d951f95a4d20bf Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 31 May 2021 23:58:16 -0700 Subject: [PATCH 3/5] added clang format, updated main.cpp and removed vmctx deps --- .clang-format | 18 ++++++++++++ dependencies/vmprofiler | 2 +- src/main.cpp | 44 ++---------------------------- src/vmprofiler-cli.vcxproj | 3 ++ src/vmprofiler-cli.vcxproj.filters | 5 ++++ 5 files changed, 29 insertions(+), 43 deletions(-) create mode 100644 .clang-format diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..8063c5e --- /dev/null +++ b/.clang-format @@ -0,0 +1,18 @@ +--- +BasedOnStyle: Microsoft +AlignAfterOpenBracket: Align +AllowAllArgumentsOnNextLine: 'true' +AllowAllParametersOfDeclarationOnNextLine: 'true' +AllowShortIfStatementsOnASingleLine: Never +BreakBeforeBraces: Allman +IndentWidth: '4' +Language: Cpp +NamespaceIndentation: All +SpacesInAngles: 'true' +SpacesInCStyleCastParentheses: 'true' +SpacesInContainerLiterals: 'true' +SpacesInParentheses: 'true' +SpacesInSquareBrackets: 'true' +UseTab: Never + +... diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index b9dc252..4832530 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit b9dc2520fea397d1ff110cabb71786db3375b787 +Subproject commit 4832530dfb2ef7522ed960d3393d44906c42eb74 diff --git a/src/main.cpp b/src/main.cpp index d20db11..01a7f8b 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -4,7 +4,6 @@ #include #include -#include #include #include #include @@ -25,11 +24,7 @@ int __cdecl main(int argc, const char* argv[]) .required(true); parser.add_argument() - .names({ "--vmtrace", "--trace" }) - .description("a vmp2 file generated by a vmtracer"); - - parser.add_argument() - .name("--show-vm-handlers") + .name("--showhandlers") .description("show all vm handlers..."); parser.enable_help(); @@ -124,7 +119,7 @@ int __cdecl main(int argc, const char* argv[]) return -1; } - if (parser.exists("show-vm-handlers")) + if (parser.exists("showhandlers")) { for (auto idx = 0u; idx < vm_handlers.size(); ++idx) { @@ -146,40 +141,5 @@ int __cdecl main(int argc, const char* argv[]) std::printf("=======================================================\n\n"); } } - - if (parser.exists("vmtrace")) - { - std::ifstream vmp2_file( - parser.get("vmtrace").c_str(), std::ios::binary); - - const auto file_size = - std::filesystem::file_size( - parser.get("vmtrace").c_str()); - - const auto file_header = - reinterpret_cast(malloc(file_size)); - - vmp2_file.read((char*)file_header, file_size); - - const auto entry_list = - reinterpret_cast( - reinterpret_cast( - file_header) + file_header->entry_offset); - - std::printf("> module base = 0x%p\n", file_header->module_base); - std::getchar(); - - vm::vmctx_t vmctx( - file_header, - entry_list, - vm_handlers, - module_base, - image_base - ); - - for (auto [virt_instr, log_entry] = vmctx.step(); log_entry && !virt_instr.empty(); - std::tie(virt_instr, log_entry) = vmctx.step()) - std::printf("> %s\n", virt_instr.c_str()); - } std::printf("> finished...\n"); } \ No newline at end of file diff --git a/src/vmprofiler-cli.vcxproj b/src/vmprofiler-cli.vcxproj index ed393c7..3bf9779 100644 --- a/src/vmprofiler-cli.vcxproj +++ b/src/vmprofiler-cli.vcxproj @@ -124,6 +124,9 @@ {d0b6092a-9944-4f24-9486-4b7dae372619} + + + diff --git a/src/vmprofiler-cli.vcxproj.filters b/src/vmprofiler-cli.vcxproj.filters index 766213f..e9bbc2c 100644 --- a/src/vmprofiler-cli.vcxproj.filters +++ b/src/vmprofiler-cli.vcxproj.filters @@ -198,4 +198,9 @@ Header Files + + + Resource Files + + \ No newline at end of file From ee622bd97be8d2dec07036665bfa89b7ea6bb997 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Mon, 31 May 2021 23:59:25 -0700 Subject: [PATCH 4/5] applied clang format to main.cpp --- src/main.cpp | 262 +++++++++++++++++++++++++-------------------------- 1 file changed, 126 insertions(+), 136 deletions(-) diff --git a/src/main.cpp b/src/main.cpp index 01a7f8b..63f9355 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -1,145 +1,135 @@ -#include #include -#include #include +#include +#include +#include #include #include -#include #include -int __cdecl main(int argc, const char* argv[]) +int __cdecl main( int argc, const char *argv[] ) { - argparse::argument_parser_t parser( - "vmprofiler-cli", "virtual instruction pseudo code generator"); - - parser.add_argument() - .names({ "--bin", "--vmpbin" }) - .description("unpacked binary protected with VMProtect 2") - .required(true); - - parser.add_argument() - .names({ "--vmentry", "--entry" }) - .description("rva to push prior to a vm_entry") - .required(true); - - parser.add_argument() - .name("--showhandlers") - .description("show all vm handlers..."); - - parser.enable_help(); - auto err = parser.parse(argc, argv); - - if (err) - { - std::cout << err << std::endl; - return -1; - } - - if (parser.exists("help")) - { - parser.print_help(); - return 0; - } - - const auto module_base = - reinterpret_cast( - LoadLibraryExA(parser.get("bin").c_str(), - NULL, DONT_RESOLVE_DLL_REFERENCES)); - - const auto vm_entry_ptr = - module_base + std::strtoull( - parser.get("vmentry").c_str(), nullptr, 16); - - const auto image_base = - xtils::um_t::get_instance()->image_base( - parser.get("bin").c_str()); - - zydis_routine_t vm_entry; - std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); - - if (!vm::util::flatten(vm_entry, vm_entry_ptr)) - { - std::printf("> failed to flatten vm entry...\n"); - return -1; - } - - vm::util::deobfuscate(vm_entry); - std::printf("> flattened vm entry...\n"); - std::printf("> deobfuscated vm entry...\n"); - std::printf("==================================================================================\n"); - vm::util::print(vm_entry); - - const auto vm_handler_table = - vm::handler::table::get(vm_entry); - - if (!vm_handler_table) - { - std::printf("> failed to locate vm handler table...\n"); - return -1; - } - - std::printf("==================================================================================\n"); - std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, - (reinterpret_cast(vm_handler_table) - module_base) + image_base); - - zydis_decoded_instr_t vm_handler_transform; - if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform)) - { - std::printf("[!] failed to locate vm handler table entry transformation...\n"); - return -1; - } - - std::printf("> vm handler table entries decrypted with = "); - vm::util::print(vm_handler_transform); - - vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic]; - std::printf("> vm handler table entries encrypted with = "); - vm::util::print(vm_handler_transform); - - std::printf("==================================================================================\n"); - std::vector vinstr_rva_decrypt_instrs; - if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs)) - { - std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n"); - return -1; - } - - std::printf("> virtual instruction rva decryption instructions:\n"); - for (auto& transform : vinstr_rva_decrypt_instrs) - { - std::printf("\t"); - vm::util::print(transform); - } - - std::vector vm_handlers; - if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) - { - std::printf("> failed to get all vm handler meta data...\n"); - return -1; - } - - if (parser.exists("showhandlers")) - { - for (auto idx = 0u; idx < vm_handlers.size(); ++idx) - { - auto vm_handler = vm_handlers[idx]; - std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", - vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, - vm_handler.imm_size); - - std::printf("================[vm handler instructions]==============\n"); - vm::util::print(vm_handler.instrs); - - if (vm_handler.imm_size) - { - std::printf("=================[vm handler transforms]===============\n"); - for (const auto& [transform_type, transform] : vm_handler.transforms) - vm::util::print(transform); - } - - std::printf("=======================================================\n\n"); - } - } - std::printf("> finished...\n"); + argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator" ); + + parser.add_argument() + .names( { "--bin", "--vmpbin" } ) + .description( "unpacked binary protected with VMProtect 2" ) + .required( true ); + + parser.add_argument() + .names( { "--vmentry", "--entry" } ) + .description( "rva to push prior to a vm_entry" ) + .required( true ); + + parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." ); + + parser.enable_help(); + auto err = parser.parse( argc, argv ); + + if ( err ) + { + std::cout << err << std::endl; + return -1; + } + + if ( parser.exists( "help" ) ) + { + parser.print_help(); + return 0; + } + + const auto module_base = reinterpret_cast< std::uintptr_t >( + LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) ); + + const auto vm_entry_ptr = + module_base + std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); + + const auto image_base = xtils::um_t::get_instance()->image_base( parser.get< std::string >( "bin" ).c_str() ); + + zydis_routine_t vm_entry; + std::printf( "> vm entry start = 0x%p\n", vm_entry_ptr ); + + if ( !vm::util::flatten( vm_entry, vm_entry_ptr ) ) + { + std::printf( "> failed to flatten vm entry...\n" ); + return -1; + } + + vm::util::deobfuscate( vm_entry ); + std::printf( "> flattened vm entry...\n" ); + std::printf( "> deobfuscated vm entry...\n" ); + std::printf( "==================================================================================\n" ); + vm::util::print( vm_entry ); + + const auto vm_handler_table = vm::handler::table::get( vm_entry ); + + if ( !vm_handler_table ) + { + std::printf( "> failed to locate vm handler table...\n" ); + return -1; + } + + std::printf( "==================================================================================\n" ); + std::printf( "> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, + ( reinterpret_cast< std::uintptr_t >( vm_handler_table ) - module_base ) + image_base ); + + zydis_decoded_instr_t vm_handler_transform; + if ( !vm::handler::table::get_transform( vm_entry, &vm_handler_transform ) ) + { + std::printf( "[!] failed to locate vm handler table entry transformation...\n" ); + return -1; + } + + std::printf( "> vm handler table entries decrypted with = " ); + vm::util::print( vm_handler_transform ); + + vm_handler_transform.mnemonic = vm::transform::inverse[ vm_handler_transform.mnemonic ]; + std::printf( "> vm handler table entries encrypted with = " ); + vm::util::print( vm_handler_transform ); + + std::printf( "==================================================================================\n" ); + std::vector< zydis_decoded_instr_t > vinstr_rva_decrypt_instrs; + if ( !vm::instrs::get_rva_decrypt( vm_entry, vinstr_rva_decrypt_instrs ) ) + { + std::printf( "[!] failed to get virtual instruction rva decrypt transformations...\n" ); + return -1; + } + + std::printf( "> virtual instruction rva decryption instructions:\n" ); + for ( auto &transform : vinstr_rva_decrypt_instrs ) + { + std::printf( "\t" ); + vm::util::print( transform ); + } + + std::vector< vm::handler::handler_t > vm_handlers; + if ( !vm::handler::get_all( module_base, image_base, vm_entry, vm_handler_table, vm_handlers ) ) + { + std::printf( "> failed to get all vm handler meta data...\n" ); + return -1; + } + + if ( parser.exists( "showhandlers" ) ) + { + for ( auto idx = 0u; idx < vm_handlers.size(); ++idx ) + { + auto vm_handler = vm_handlers[ idx ]; + std::printf( "==========[vm handler %s, idx = %d, imm size = %d]========\n", + vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.imm_size ); + + std::printf( "================[vm handler instructions]==============\n" ); + vm::util::print( vm_handler.instrs ); + + if ( vm_handler.imm_size ) + { + std::printf( "=================[vm handler transforms]===============\n" ); + for ( const auto &[ transform_type, transform ] : vm_handler.transforms ) + vm::util::print( transform ); + } + + std::printf( "=======================================================\n\n" ); + } + } + std::printf( "> finished...\n" ); } \ No newline at end of file From f2c9983e95ee0f31cecf924a93d89dd6169ef1ea Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Tue, 1 Jun 2021 00:14:51 -0700 Subject: [PATCH 5/5] changed build to static so i dont need the zydis dll anymore --- src/main.cpp | 1 + src/vmprofiler-cli.vcxproj | 91 +++++++------- src/vmprofiler-cli.vcxproj.filters | 191 ++++++++++++++--------------- 3 files changed, 136 insertions(+), 147 deletions(-) diff --git a/src/main.cpp b/src/main.cpp index 63f9355..f4d740b 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -7,6 +7,7 @@ #include #include #include +#include int __cdecl main( int argc, const char *argv[] ) { diff --git a/src/vmprofiler-cli.vcxproj b/src/vmprofiler-cli.vcxproj index 3bf9779..7a9e323 100644 --- a/src/vmprofiler-cli.vcxproj +++ b/src/vmprofiler-cli.vcxproj @@ -41,7 +41,7 @@ true true true - NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;ZYDIS_STATIC_DEFINE;%(PreprocessorDefinitions) true stdcpplatest Disabled @@ -64,56 +64,53 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/src/vmprofiler-cli.vcxproj.filters b/src/vmprofiler-cli.vcxproj.filters index e9bbc2c..a866b8a 100644 --- a/src/vmprofiler-cli.vcxproj.filters +++ b/src/vmprofiler-cli.vcxproj.filters @@ -13,19 +13,19 @@ {faf4cf50-0bc3-4674-80ff-fec015d82127} - {4e807ab2-7dfc-48a3-a092-039f09dd57f4} - - - {a10f8ff1-7349-4a48-9061-facf5a836ee4} + {ab5cf1fc-f056-4d4c-b00f-d111109aa610} - {82afe7a2-4ff1-4e12-806d-297e714bad9c} + {9bd82e24-4e3f-4444-b5df-98d02537beea} + + + {a9886b41-1872-4765-ad66-e61c999d61fc} - {a8d11bd2-d945-406f-aeb4-c28feb79a31d} + {ef756627-8757-4365-9367-e9f880b6af45} - {94c3a376-8f65-450f-9b11-740f95bef4d6} + {b21444ff-896e-4fad-931e-306b139b5b47} @@ -44,158 +44,149 @@ - - Header Files\Zycore - - - Header Files\Zycore - - - Header Files\Zycore - - - Header Files\Zycore + + Header Files - - Header Files\Zycore + + Header Files - - Header Files\Zycore + + Header Files - - Header Files\Zycore + + Header Files - - Header Files\Zycore + + Header Files - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore + + Header Files\Zydis\Internal - - Header Files\Zycore\API + + Header Files\Zydis\Generated - - Header Files\Zycore\API + + Header Files\Zydis\Generated - - Header Files\Zycore\API + + Header Files\Zydis\Generated - - Header Files\Zycore\API + + Header Files\Zydis\Generated - - Header Files\Zycore\API + + Header Files\Zydis\Generated - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - + Header Files\Zydis - - Header Files\Zydis\Generated + + Header Files - - Header Files\Zydis\Generated + + Header Files - - Header Files\Zydis\Generated + + Header Files\Zycore - - Header Files\Zydis\Generated + + Header Files\Zycore - - Header Files\Zydis\Generated + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files\Zydis\Internal + + Header Files\Zycore - - Header Files + + Header Files\Zycore - - Header Files + + Header Files\Zycore - - Header Files + + Header Files\Zycore - - Header Files + + Header Files\Zycore - - Header Files + + Header Files\Zycore - - Header Files + + Header Files\Zycore\API - - Header Files + + Header Files\Zycore\API - - Header Files + + Header Files\Zycore\API - - Header Files + + Header Files\Zycore\API