#include #include #include #include #include #include #include int __cdecl main( int argc, const char *argv[] ) { argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator" ); parser.add_argument().names( { "--bin", "--vmpbin" } ).description( "unpacked binary protected with VMProtect 2" ); parser.add_argument().names( { "--vmentry", "--entry" } ).description( "rva to push prior to a vm_entry" ); parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." ); parser.add_argument().name( "--showhandler" ).description( "show a specific vm handler given its index..." ); parser.add_argument().name( "--vmp2file" ).description( "path to .vmp2 file..." ); parser.add_argument() .name( "--indexes" ) .description( "displays vm handler table indexes for a given vm handler name such as 'READQ', or 'WRITEQ'..." ); parser.add_argument() .name( "--scanfortables" ) .description( "scans all executable sections for vm handler tables..." ); parser.add_argument() .name( "--showblockinstrs" ) .description( "show the virtual instructions of a specific code block..." ); parser.add_argument().name( "--showallblocks" ).description( "shows all information for all code blocks..." ); parser.enable_help(); auto err = parser.parse( argc, argv ); const auto umtils = xtils::um_t::get_instance(); if ( err ) { std::cout << err << std::endl; return -1; } if ( parser.exists( "help" ) ) { parser.print_help(); return 0; } if ( parser.exists( "bin" ) && parser.exists( "scanfortables" ) ) { if ( !std::filesystem::exists( parser.get< std::string >( "bin" ) ) ) { std::printf( "> path to protected file is invalid... check your cli args...\n" ); return -1; } const auto module_base = reinterpret_cast< std::uintptr_t >( LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) ); auto result = vm::locate::all_handler_tables( module_base ); std::vector< std::uint32_t > handler_table_rvas; std::for_each( result.begin(), result.end(), [ & ]( const vm::locate::vm_handler_table_info_t &data ) { if ( std::find( handler_table_rvas.begin(), handler_table_rvas.end(), data.rva ) == handler_table_rvas.end() ) handler_table_rvas.push_back( data.rva ); } ); std::printf( "{\n" ); for ( auto &table_rva : handler_table_rvas ) std::printf( "\t0x%x,\n", table_rva ); std::printf( "}\n" ); } if ( parser.exists( "bin" ) && parser.exists( "vmentry" ) ) { if ( !std::filesystem::exists( parser.get< std::string >( "bin" ) ) ) { std::printf( "> path to protected file is invalid... check your cli args...\n" ); return -1; } const auto module_base = reinterpret_cast< std::uintptr_t >( LoadLibraryExA( parser.get< std::string >( "bin" ).c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES ) ); const auto vm_entry_rva = std::strtoull( parser.get< std::string >( "vmentry" ).c_str(), nullptr, 16 ); const auto image_base = umtils->image_base( parser.get< std::string >( "bin" ).c_str() ); const auto image_size = NT_HEADER( module_base )->OptionalHeader.SizeOfImage; std::printf( "> module base = 0x%p, image base = 0x%p, image size = 0x%p\n", module_base, image_base, image_size ); vm::ctx_t vmctx( module_base, image_base, image_size, vm_entry_rva ); if ( !vmctx.init() ) { std::printf( "[!] failed to init vm::ctx_t... make sure all cli arguments are correct!\n" ); return -1; } std::puts( "======================== [vm entry] ========================\n" ); vm::util::print( vmctx.vm_entry ); std::puts( "======================== [calc jmp] ========================\n" ); vm::util::print( vmctx.calc_jmp ); std::puts( "============================================================\n" ); std::printf( "> vip advancement = %s\n\n", vmctx.exec_type == vmp2::exec_type_t::forward ? "forward" : "backward" ); if ( parser.exists( "showhandlers" ) ) { for ( auto idx = 0u; idx < vmctx.vm_handlers.size(); ++idx ) { std::printf( "======================== [%s #%d] ========================\n", vmctx.vm_handlers[ idx ].profile ? vmctx.vm_handlers[ idx ].profile->name : "UNK", idx ); vm::util::print( vmctx.vm_handlers[ idx ].instrs ); // if there is no imm then there are no transforms... if ( !vmctx.vm_handlers[ idx ].imm_size ) { std::puts( "\n" ); continue; } std::puts( "======================== [transforms] ========================\n" ); for ( auto &[ mnemonic, instr ] : vmctx.vm_handlers[ idx ].transforms ) { if ( instr.mnemonic == ZYDIS_MNEMONIC_INVALID ) continue; vm::util::print( instr ); } std::puts( "\n" ); } } else if ( parser.exists( "showhandler" ) ) { const auto vm_handler_idx = std::strtoul( parser.get< std::string >( "showhandler" ).c_str(), nullptr, 10 ); if ( vm_handler_idx > 256 ) { std::printf( "> invalid vm handler index... too large...\n" ); return -1; } std::printf( "======================== [%s #%d] ========================\n", vmctx.vm_handlers[ vm_handler_idx ].profile ? vmctx.vm_handlers[ vm_handler_idx ].profile->name : "UNK", vm_handler_idx ); vm::util::print( vmctx.vm_handlers[ vm_handler_idx ].instrs ); // if there is no imm then there are no transforms... if ( !vmctx.vm_handlers[ vm_handler_idx ].imm_size ) { std::puts( "\n" ); return {}; } std::puts( "======================== [transforms] ========================\n" ); for ( auto &[ mnemonic, instr ] : vmctx.vm_handlers[ vm_handler_idx ].transforms ) { if ( instr.mnemonic == ZYDIS_MNEMONIC_INVALID ) continue; vm::util::print( instr ); } std::puts( "\n" ); } else if ( parser.exists( "indexes" ) ) { const auto handler_name = parser.get< std::string >( "indexes" ); std::printf( "{\n" ); for ( auto idx = 0u; idx < vmctx.vm_handlers.size(); ++idx ) if ( vmctx.vm_handlers[ idx ].profile && !strcmp( vmctx.vm_handlers[ idx ].profile->name, handler_name.c_str() ) ) std::printf( "\t0x%x,\n", idx ); std::printf( "}\n" ); } } if ( !parser.exists( "vmp2file" ) ) return {}; std::vector< std::uint8_t > vmp2file; if ( !umtils->open_binary_file( parser.get< std::string >( "vmp2file" ), vmp2file ) ) { std::printf( "[!] failed to open vmp2 file...\n" ); return -1; } const auto file_header = reinterpret_cast< vmp2::v3::file_header * >( vmp2file.data() ); if ( file_header->version != vmp2::version_t::v3 ) { std::printf( "[!] invalid vmp2 file version... this build uses v3...\n" ); return -1; } auto first_block = reinterpret_cast< vmp2::v3::code_block_t * >( reinterpret_cast< std::uintptr_t >( file_header ) + file_header->code_block_offset ); if ( parser.exists( "showallblocks" ) ) { for ( auto [ code_block, code_block_num ] = std::tuple{ first_block, 0u }; code_block_num < file_header->code_block_count; code_block = reinterpret_cast< vmp2::v3::code_block_t * >( reinterpret_cast< std::uintptr_t >( code_block ) + code_block->next_block_offset ), ++code_block_num ) { std::printf( "[code block #%d] begin = 0x%p, virtual instruction count = %d\n", code_block_num, ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ), code_block->vinstr_count ); if ( code_block->jcc.has_jcc ) std::printf( "\tcode block branches to 0x%p and 0x%p\n", ABS_TO_IMG( code_block->jcc.block_addr[ 0 ], file_header->module_base, file_header->image_base ), ABS_TO_IMG( code_block->jcc.block_addr[ 1 ], file_header->module_base, file_header->image_base ) ); } } if ( parser.exists( "showblockinstrs" ) ) { const auto block_img_addr = parser.get< std::string >( "showblockinstrs" ); for ( auto [ code_block, code_block_num ] = std::tuple{ first_block, 0u }; code_block_num < file_header->code_block_count; code_block = reinterpret_cast< vmp2::v3::code_block_t * >( reinterpret_cast< std::uintptr_t >( code_block ) + code_block->next_block_offset ), ++code_block_num ) { if ( ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ) == std::strtoull( block_img_addr.c_str(), nullptr, 16 ) ) { std::printf( "[code block #%d] begin = 0x%p, virtual instruction count = %d\n", code_block_num, ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ), code_block->vinstr_count ); std::printf( "> -----------------------------------------------------------------------\n" ); std::printf( "> opcode | virtual instructions | virtual instruction pointer\n" ); std::printf( "> -----------------------------------------------------------------------\n" ); for ( auto idx = 0u; idx < code_block->vinstr_count; ++idx ) { const auto vinstr = &code_block->vinstr[ idx ]; const auto vm_profile = vm::handler::get_profile( vinstr->mnemonic_t ); if ( vinstr->operand.has_imm ) { std::printf( "> %-6x | %-15s %-15p | 0x%p\n", vinstr->opcode, vm_profile ? vm_profile->name : "UNK", vinstr->operand.imm.u, ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base, file_header->image_base ) ); } else { std::printf( "> %-6x | %-32s | 0x%p\n", vinstr->opcode, vm_profile ? vm_profile->name : "UNK", ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base, file_header->image_base ) ); } } break; } } } }