From e4373894cf6d639ad70db68d44452fdeeb3081b5 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Thu, 10 Jun 2021 13:37:40 -0700 Subject: [PATCH] testing new vmprofiler & vtil... --- dependencies/vmprofiler | 2 +- src/main.cpp | 132 ++++++---------------------------------- 2 files changed, 20 insertions(+), 114 deletions(-) diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index 1fad857..9e26605 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit 1fad85707785843ec96b7d052a601aad69b47213 +Subproject commit 9e26605601f03af41cef95aba8c6603c2c213e63 diff --git a/src/main.cpp b/src/main.cpp index bc818df..1db974b 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -3,11 +3,11 @@ #include #include +#include #include #include #include #include -#include int __cdecl main( int argc, const char *argv[] ) { @@ -24,6 +24,12 @@ int __cdecl main( int argc, const char *argv[] ) .required( true ); parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." ); + parser.add_argument().name( "--vmp2file" ).description( "path to .vmp2 file..." ); + parser.add_argument().name( "--showblockinfo" ).description( "provide a block address to view its information..." ); + parser.add_argument() + .name( "--showblockinstrs" ) + .description( "show the virtual instructions of a specific code block..." ); + parser.add_argument().name( "--showallblocks" ).description( "shows all information for all code blocks..." ); parser.enable_help(); auto err = parser.parse( argc, argv ); @@ -43,125 +49,25 @@ int __cdecl main( int argc, const char *argv[] ) const auto module_base = reinterpret_cast< std::uintptr_t >( LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) ); - const auto vm_entry_ptr = - module_base + std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); + const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); const auto image_base = xtils::um_t::get_instance()->image_base( parser.get< std::string >( "bin" ).c_str() ); - zydis_routine_t vm_entry, calc_jmp; - std::printf( "> vm entry start = 0x%p\n", vm_entry_ptr ); - - if ( !vm::util::flatten( vm_entry, vm_entry_ptr ) ) - { - std::printf( "> failed to flatten vm entry...\n" ); - return -1; - } - - vm::util::deobfuscate( vm_entry ); - std::printf( "> flattened vm entry...\n" ); - std::printf( "> deobfuscated vm entry...\n" ); - std::printf( "==================================================================================\n" ); - vm::util::print( vm_entry ); - - if ( !vm::calc_jmp::get( vm_entry, calc_jmp ) ) - { - std::printf( "> failed to extract calc_jmp from vm_entry...\n" ); - return -1; - } - - vm::util::deobfuscate( calc_jmp ); - std::printf( "> calc_jmp extracted from vm_entry... calc_jmp:\n" ); - std::printf( "==================================================================================\n" ); - vm::util::print( calc_jmp ); - std::printf( "==================================================================================\n" ); + const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; - const auto vm_handler_table = vm::handler::table::get( vm_entry ); + std::printf( "> module base = 0x%p, image base = 0x%p, image size = 0x%p\n", module_base, image_base, image_size ); + vm::ctx_t vmctx( module_base, image_base, image_size, vm_entry_rva ); - if ( !vm_handler_table ) + if ( !vmctx.init() ) { - std::printf( "> failed to locate vm handler table...\n" ); + std::printf( "[!] failed to init vm::ctx_t... make sure all cli arguments are correct!\n" ); return -1; } - auto advancement = vm::calc_jmp::get_advancement( calc_jmp ); - if ( advancement.has_value() ) - std::printf( "> virtual instruction pointer advancement: %s\n", - advancement == vmp2::exec_type_t::forward ? "forward" : "backward" ); - else - std::printf( "> virtual instruction pointer advancement was unable to be parsed!\n" ); - - std::printf( "> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, - ( reinterpret_cast< std::uintptr_t >( vm_handler_table ) - module_base ) + image_base ); - - zydis_decoded_instr_t vm_handler_transform; - if ( !vm::handler::table::get_transform( vm_entry, &vm_handler_transform ) ) - { - std::printf( "[!] failed to locate vm handler table entry transformation...\n" ); - return -1; - } - - std::printf( "> vm handler table entries decrypted with = " ); - vm::util::print( vm_handler_transform ); - - vm_handler_transform.mnemonic = vm::transform::inverse[ vm_handler_transform.mnemonic ]; - std::printf( "> vm handler table entries encrypted with = " ); - vm::util::print( vm_handler_transform ); - - std::printf( "==================================================================================\n" ); - std::vector< zydis_decoded_instr_t > vinstr_rva_decrypt_instrs; - if ( !vm::instrs::get_rva_decrypt( vm_entry, vinstr_rva_decrypt_instrs ) ) - { - std::printf( "[!] failed to get virtual instruction rva decrypt transformations...\n" ); - return -1; - } - - std::printf( "> virtual instruction rva decryption instructions:\n" ); - for ( auto &transform : vinstr_rva_decrypt_instrs ) - { - std::printf( "\t" ); - vm::util::print( transform ); - } - std::printf( "> virtual instruction rva encryption instructions:\n" ); - if (!vm::transform::inverse_transforms(vinstr_rva_decrypt_instrs)) - { - std::printf( "> failed to inverse rva encryption instructions...\n" ); - return -1; - } - - for ( auto &transform : vinstr_rva_decrypt_instrs ) - { - std::printf( "\t" ); - vm::util::print( transform ); - } - std::printf( "==================================================================================\n" ); - - std::vector< vm::handler::handler_t > vm_handlers; - if ( !vm::handler::get_all( module_base, image_base, vm_entry, vm_handler_table, vm_handlers ) ) - { - std::printf( "> failed to get all vm handler meta data...\n" ); - return -1; - } - - if ( parser.exists( "showhandlers" ) ) - { - for ( auto idx = 0u; idx < vm_handlers.size(); ++idx ) - { - auto vm_handler = vm_handlers[ idx ]; - std::printf( "==========[vm handler %s, idx = %d, imm size = %d]========\n", - vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.imm_size ); - - std::printf( "================[vm handler instructions]==============\n" ); - vm::util::print( vm_handler.instrs ); - - if ( vm_handler.imm_size ) - { - std::printf( "=================[vm handler transforms]===============\n" ); - for ( const auto &[ transform_type, transform ] : vm_handler.transforms ) - vm::util::print( transform ); - } - - std::printf( "=======================================================\n\n" ); - } - } - std::printf( "> finished...\n" ); + std::puts( "======================== [vm entry] ========================\n" ); + vm::util::print( vmctx.vm_entry ); + std::puts( "======================== [calc jmp] ========================\n" ); + vm::util::print( vmctx.calc_jmp ); + std::puts( "============================================================\n" ); + std::printf( "> vip advancement = %s\n", vmctx.exec_type == vmp2::exec_type_t::forward ? "forward" : "backward" ); } \ No newline at end of file