vmp2
/
vmprofiler-cli
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

applied clang format to main.cpp

Browse Source
merge-requests/1/head
_xeroxz 4 years ago
parent ee73d2fb29
commit ee622bd97b
1 changed files with 126 additions and 136 deletions
Show Stats Download Patch File Download Diff File

262
src/main.cpp
Unescape View File

@ -1,145 +1,135 @@
#include <iostream>
#include <Windows.h> #include <Windows.h>
#include <fstream>
#include <filesystem> #include <filesystem>
#include <fstream>
#include <iostream>
#include <cli-parser.hpp>
#include <vmp2.hpp> #include <vmp2.hpp>
#include <vmprofiler.hpp> #include <vmprofiler.hpp>
#include <cli-parser.hpp>
#include <xtils.hpp> #include <xtils.hpp>
int __cdecl main(int argc, const char* argv[]) int __cdecl main( int argc, const char *argv[] )
{ {
argparse::argument_parser_t parser( argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator" );
"vmprofiler-cli", "virtual instruction pseudo code generator");
parser.add_argument()
parser.add_argument() .names( { "--bin", "--vmpbin" } )
.names({ "--bin", "--vmpbin" }) .description( "unpacked binary protected with VMProtect 2" )
.description("unpacked binary protected with VMProtect 2") .required( true );
.required(true);
parser.add_argument()
parser.add_argument() .names( { "--vmentry", "--entry" } )
.names({ "--vmentry", "--entry" }) .description( "rva to push prior to a vm_entry" )
.description("rva to push prior to a vm_entry") .required( true );
.required(true);
parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." );
parser.add_argument()
.name("--showhandlers") parser.enable_help();
.description("show all vm handlers..."); auto err = parser.parse( argc, argv );
parser.enable_help(); if ( err )
auto err = parser.parse(argc, argv); {
std::cout << err << std::endl;
if (err) return -1;
{ }
std::cout << err << std::endl;
return -1; if ( parser.exists( "help" ) )
} {
parser.print_help();
if (parser.exists("help")) return 0;
{ }
parser.print_help();
return 0; const auto module_base = reinterpret_cast< std::uintptr_t >(
} LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) );
const auto module_base = const auto vm_entry_ptr =
reinterpret_cast<std::uintptr_t>( module_base + std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 );
LoadLibraryExA(parser.get<std::string>("bin").c_str(),
NULL, DONT_RESOLVE_DLL_REFERENCES)); const auto image_base = xtils::um_t::get_instance()->image_base( parser.get< std::string >( "bin" ).c_str() );
const auto vm_entry_ptr = zydis_routine_t vm_entry;
module_base + std::strtoull( std::printf( "> vm entry start = 0x%p\n", vm_entry_ptr );
parser.get<std::string>("vmentry").c_str(), nullptr, 16);
if ( !vm::util::flatten( vm_entry, vm_entry_ptr ) )
const auto image_base = {
xtils::um_t::get_instance()->image_base( std::printf( "> failed to flatten vm entry...\n" );
parser.get<std::string>("bin").c_str()); return -1;
}
zydis_routine_t vm_entry;
std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); vm::util::deobfuscate( vm_entry );
std::printf( "> flattened vm entry...\n" );
if (!vm::util::flatten(vm_entry, vm_entry_ptr)) std::printf( "> deobfuscated vm entry...\n" );
{ std::printf( "==================================================================================\n" );
std::printf("> failed to flatten vm entry...\n"); vm::util::print( vm_entry );
return -1;
} const auto vm_handler_table = vm::handler::table::get( vm_entry );
vm::util::deobfuscate(vm_entry); if ( !vm_handler_table )
std::printf("> flattened vm entry...\n"); {
std::printf("> deobfuscated vm entry...\n"); std::printf( "> failed to locate vm handler table...\n" );
std::printf("==================================================================================\n"); return -1;
vm::util::print(vm_entry); }
const auto vm_handler_table = std::printf( "==================================================================================\n" );
vm::handler::table::get(vm_entry); std::printf( "> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table,
( reinterpret_cast< std::uintptr_t >( vm_handler_table ) - module_base ) + image_base );
if (!vm_handler_table)
{ zydis_decoded_instr_t vm_handler_transform;
std::printf("> failed to locate vm handler table...\n"); if ( !vm::handler::table::get_transform( vm_entry, &vm_handler_transform ) )
return -1; {
} std::printf( "[!] failed to locate vm handler table entry transformation...\n" );
return -1;
std::printf("==================================================================================\n"); }
std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table,
(reinterpret_cast<std::uintptr_t>(vm_handler_table) - module_base) + image_base); std::printf( "> vm handler table entries decrypted with = " );
vm::util::print( vm_handler_transform );
zydis_decoded_instr_t vm_handler_transform;
if (!vm::handler::table::get_transform(vm_entry, &vm_handler_transform)) vm_handler_transform.mnemonic = vm::transform::inverse[ vm_handler_transform.mnemonic ];
{ std::printf( "> vm handler table entries encrypted with = " );
std::printf("[!] failed to locate vm handler table entry transformation...\n"); vm::util::print( vm_handler_transform );
return -1;
} std::printf( "==================================================================================\n" );
std::vector< zydis_decoded_instr_t > vinstr_rva_decrypt_instrs;
std::printf("> vm handler table entries decrypted with = "); if ( !vm::instrs::get_rva_decrypt( vm_entry, vinstr_rva_decrypt_instrs ) )
vm::util::print(vm_handler_transform); {
std::printf( "[!] failed to get virtual instruction rva decrypt transformations...\n" );
vm_handler_transform.mnemonic = vm::transform::inverse[vm_handler_transform.mnemonic]; return -1;
std::printf("> vm handler table entries encrypted with = "); }
vm::util::print(vm_handler_transform);
std::printf( "> virtual instruction rva decryption instructions:\n" );
std::printf("==================================================================================\n"); for ( auto &transform : vinstr_rva_decrypt_instrs )
std::vector<zydis_decoded_instr_t> vinstr_rva_decrypt_instrs; {
if (!vm::instrs::get_rva_decrypt(vm_entry, vinstr_rva_decrypt_instrs)) std::printf( "\t" );
{ vm::util::print( transform );
std::printf("[!] failed to get virtual instruction rva decrypt transformations...\n"); }
return -1;
} std::vector< vm::handler::handler_t > vm_handlers;
if ( !vm::handler::get_all( module_base, image_base, vm_entry, vm_handler_table, vm_handlers ) )
std::printf("> virtual instruction rva decryption instructions:\n"); {
for (auto& transform : vinstr_rva_decrypt_instrs) std::printf( "> failed to get all vm handler meta data...\n" );
{ return -1;
std::printf("\t"); }
vm::util::print(transform);
} if ( parser.exists( "showhandlers" ) )
{
std::vector<vm::handler::handler_t> vm_handlers; for ( auto idx = 0u; idx < vm_handlers.size(); ++idx )
if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) {
{ auto vm_handler = vm_handlers[ idx ];
std::printf("> failed to get all vm handler meta data...\n"); std::printf( "==========[vm handler %s, idx = %d, imm size = %d]========\n",
return -1; vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.imm_size );
}
std::printf( "================[vm handler instructions]==============\n" );
if (parser.exists("showhandlers")) vm::util::print( vm_handler.instrs );
{
for (auto idx = 0u; idx < vm_handlers.size(); ++idx) if ( vm_handler.imm_size )
{ {
auto vm_handler = vm_handlers[idx]; std::printf( "=================[vm handler transforms]===============\n" );
std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", for ( const auto &[ transform_type, transform ] : vm_handler.transforms )
vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm::util::print( transform );
vm_handler.imm_size); }
std::printf("================[vm handler instructions]==============\n"); std::printf( "=======================================================\n\n" );
vm::util::print(vm_handler.instrs); }
}
if (vm_handler.imm_size) std::printf( "> finished...\n" );
{
std::printf("=================[vm handler transforms]===============\n");
for (const auto& [transform_type, transform] : vm_handler.transforms)
vm::util::print(transform);
}
std::printf("=======================================================\n\n");
}
}
std::printf("> finished...\n");
} }
Write Preview
Loading…
Cancel
Save