vmp2
/
vmprofiler-cli
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

applied clang format to main.cpp

Browse Source
merge-requests/1/head
_xeroxz 4 years ago
parent ee73d2fb29
commit ee622bd97b
1 changed files with 126 additions and 136 deletions
Show Stats Download Patch File Download Diff File

138
src/main.cpp
Unescape View File

@ -1,145 +1,135 @@
#include <iostream>
#include <Windows.h> #include <Windows.h>
#include <fstream>
#include <filesystem> #include <filesystem>
#include <fstream>
#include <iostream>
#include <cli-parser.hpp>
#include <vmp2.hpp> #include <vmp2.hpp>
#include <vmprofiler.hpp> #include <vmprofiler.hpp>
#include <cli-parser.hpp>
#include <xtils.hpp> #include <xtils.hpp>
int __cdecl main(int argc, const char* argv[]) int __cdecl main( int argc, const char *argv[] )
{ {
argparse::argument_parser_t parser( argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator" );
"vmprofiler-cli", "virtual instruction pseudo code generator");
parser.add_argument() parser.add_argument()
.names({ "--bin", "--vmpbin" }) .names( { "--bin", "--vmpbin" } )
.description("unpacked binary protected with VMProtect 2") .description( "unpacked binary protected with VMProtect 2" )
.required(true); .required( true );
parser.add_argument() parser.add_argument()
.names({ "--vmentry", "--entry" }) .names( { "--vmentry", "--entry" } )
.description("rva to push prior to a vm_entry") .description( "rva to push prior to a vm_entry" )
.required(true); .required( true );
parser.add_argument() parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." );
.name("--showhandlers")
.description("show all vm handlers...");
parser.enable_help(); parser.enable_help();
auto err = parser.parse(argc, argv); auto err = parser.parse( argc, argv );
if (err) if ( err )
{ {
std::cout << err << std::endl; std::cout << err << std::endl;
return -1; return -1;
} }
if (parser.exists("help")) if ( parser.exists( "help" ) )
{ {
parser.print_help(); parser.print_help();
return 0; return 0;
} }
const auto module_base = const auto module_base = reinterpret_cast< std::uintptr_t >(
reinterpret_cast<std::uintptr_t>( LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
LoadLibraryExA(parser.get<std::string>("bin").c_str(),
NULL, DONT_RESOLVE_DLL_REFERENCES));
const auto vm_entry_ptr = const auto vm_entry_ptr =
module_base + std::strtoull( module_base + std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 );
parser.get<std::string>("vmentry").c_str(), nullptr, 16);
const auto image_base = const auto image_base = xtils::um_t::get_instance()->image_base( parser.get< std::string >( "bin" ).c_str() );
xtils::um_t::get_instance()->image_base(
parser.get<std::string>("bin").c_str());
zydis_routine_t vm_entry; zydis_routine_t vm_entry;
std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); std::printf( "> vm entry start = 0x%p\n", vm_entry_ptr );
if (!vm::util::flatten(vm_entry, vm_entry_ptr)) if ( !vm::util::flatten( vm_entry, vm_entry_ptr ) )
{ {
std::printf("> failed to flatten vm entry...\n"); std::printf( "> failed to flatten vm entry...\n" );
return -1; return -1;
} }
vm::util::deobfuscate(vm_entry); vm::util::deobfuscate( vm_entry );
std::printf("> flattened vm entry...\n"); std::printf( "> flattened vm entry...\n" );
std::printf("> deobfuscated vm entry...\n"); std::printf( "> deobfuscated vm entry...\n" );
std::printf("==================================================================================\n"); std::printf( "==================================================================================\n" );
vm::util::print(vm_entry); vm::util::print( vm_entry );
const auto vm_handler_table = const auto vm_handler_table = vm::handler::table::get( vm_entry );
vm::handler::table::get(vm_entry);
if (!vm_handler_table) if ( !vm_handler_table )
{ {
std::printf("> failed to locate vm handler table...\n"); std::printf( "> failed to locate vm handler table...\n" );
return -1; return -1;
} }
std::printf("==================================================================================\n"); std::printf( "==================================================================================\n" );
std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, std::printf( "> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table,
(reinterpret_cast<std::uintptr_t>(vm_handler_table) - module_base) + image_base); ( reinterpret_cast< std::uintptr_t >( vm_handler_table ) - module_base ) + image_base );
zydis_decoded_instr_t vm_handler_transform; zydis_decoded_instr_t vm_handler_transform;
if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform)) if ( !vm::handler::table::get_transform( vm_entry, &vm_handler_transform ) )
{ {
std::printf("[!] failed to locate vm handler table entry transformation...\n"); std::printf( "[!] failed to locate vm handler table entry transformation...\n" );
return -1; return -1;
} }
std::printf("> vm handler table entries decrypted with = "); std::printf( "> vm handler table entries decrypted with = " );
vm::util::print(vm_handler_transform); vm::util::print( vm_handler_transform );
vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic]; vm_handler_transform.mnemonic = vm::transform::inverse[ vm_handler_transform.mnemonic ];
std::printf("> vm handler table entries encrypted with = "); std::printf( "> vm handler table entries encrypted with = " );
vm::util::print(vm_handler_transform); vm::util::print( vm_handler_transform );
std::printf("==================================================================================\n"); std::printf( "==================================================================================\n" );
std::vector<zydis_decoded_instr_t> vinstr_rva_decrypt_instrs; std::vector< zydis_decoded_instr_t > vinstr_rva_decrypt_instrs;
if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs)) if ( !vm::instrs::get_rva_decrypt( vm_entry, vinstr_rva_decrypt_instrs ) )
{ {
std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n"); std::printf( "[!] failed to get virtual instruction rva decrypt transformations...\n" );
return -1; return -1;
} }
std::printf("> virtual instruction rva decryption instructions:\n"); std::printf( "> virtual instruction rva decryption instructions:\n" );
for (auto& transform : vinstr_rva_decrypt_instrs) for ( auto &transform : vinstr_rva_decrypt_instrs )
{ {
std::printf("\t"); std::printf( "\t" );
vm::util::print(transform); vm::util::print( transform );
} }
std::vector<vm::handler::handler_t> vm_handlers; std::vector< vm::handler::handler_t > vm_handlers;
if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) if ( !vm::handler::get_all( module_base, image_base, vm_entry, vm_handler_table, vm_handlers ) )
{ {
std::printf("> failed to get all vm handler meta data...\n"); std::printf( "> failed to get all vm handler meta data...\n" );
return -1; return -1;
} }
if (parser.exists("showhandlers")) if ( parser.exists( "showhandlers" ) )
{ {
for (auto idx = 0u; idx < vm_handlers.size(); ++idx) for ( auto idx = 0u; idx < vm_handlers.size(); ++idx )
{ {
auto vm_handler = vm_handlers[idx]; auto vm_handler = vm_handlers[ idx ];
std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", std::printf( "==========[vm handler %s, idx = %d, imm size = %d]========\n",
vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.imm_size );
vm_handler.imm_size);
std::printf("================[vm handler instructions]==============\n"); std::printf( "================[vm handler instructions]==============\n" );
vm::util::print(vm_handler.instrs); vm::util::print( vm_handler.instrs );
if (vm_handler.imm_size) if ( vm_handler.imm_size )
{ {
std::printf("=================[vm handler transforms]===============\n"); std::printf( "=================[vm handler transforms]===============\n" );
for (const auto& [transform_type, transform] : vm_handler.transforms) for ( const auto &[ transform_type, transform ] : vm_handler.transforms )
vm::util::print(transform); vm::util::print( transform );
} }
std::printf("=======================================================\n\n"); std::printf( "=======================================================\n\n" );
} }
} }
std::printf("> finished...\n"); std::printf( "> finished...\n" );
} }
Write Preview
Loading…
Cancel
Save