diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..8063c5e --- /dev/null +++ b/.clang-format @@ -0,0 +1,18 @@ +--- +BasedOnStyle: Microsoft +AlignAfterOpenBracket: Align +AllowAllArgumentsOnNextLine: 'true' +AllowAllParametersOfDeclarationOnNextLine: 'true' +AllowShortIfStatementsOnASingleLine: Never +BreakBeforeBraces: Allman +IndentWidth: '4' +Language: Cpp +NamespaceIndentation: All +SpacesInAngles: 'true' +SpacesInCStyleCastParentheses: 'true' +SpacesInContainerLiterals: 'true' +SpacesInParentheses: 'true' +SpacesInSquareBrackets: 'true' +UseTab: Never + +... diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index 05ba2cc..5129d39 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit 05ba2cc84ba94e1d526168ad686fc2e167ad2eab +Subproject commit 5129d39eb726e32a80417165ec37b597357664d4 diff --git a/src/QVMProfiler.h b/src/QVMProfiler.h index 412f104..0ab2500 100644 --- a/src/QVMProfiler.h +++ b/src/QVMProfiler.h @@ -6,10 +6,10 @@ #include #include #include +#include #include "ui_QVMProfiler.h" #include "vmp2.hpp" -#include "vm.h" #include "vmctx.h" #include "ia32.hpp" @@ -36,7 +36,7 @@ private: QString VMProtectedFilePath; std::uint64_t ImageBase, VMEntryRva, ModuleBase; - std::vector VMHandlers; + std::vector VMHandlers; zydis_routine_t VMEntry; std::uintptr_t* VMHandlerTable; diff --git a/src/vmctx.cpp b/src/vmctx.cpp new file mode 100644 index 0000000..4eed1ea --- /dev/null +++ b/src/vmctx.cpp @@ -0,0 +1,87 @@ +#include "vmctx.h" + +namespace vm +{ + vmctx_t::vmctx_t( vmp2::file_header *file_header, vmp2::entry_t *entry_list, + std::vector< vm::handler::handler_t > &vm_handlers, std::uintptr_t module_base, std::uintptr_t image_base ) + : module_base( module_base ), image_base( image_base ), entry_list( entry_list ), file_header( file_header ), + vm_handlers( vm_handlers ), idx( 0 ) + {} + + std::pair< std::string, const vmp2::entry_t * > vmctx_t::step() const + { + if ( idx >= file_header->entry_count ) + return {}; + + auto vm_handler = vm_handlers[ entry_list[ idx ].handler_idx ]; + + if ( vm_handler.imm_size ) + { + const auto operand = get_imm( file_header->advancement, entry_list[ idx ].vip, vm_handler.imm_size / 8 ); + + auto [ decrypted_operand, rolling_key ] = + vm::instrs::decrypt_operand( vm_handler.transforms, operand, entry_list[ idx ].decrypt_key ); + + if ( vm_handler.profile ) + { + if ( vm_handler.profile->extention == vm::handler::extention_t::sign_extend ) + { + switch ( vm_handler.imm_size ) + { + case 8: + if ( ( u8 )( decrypted_operand >> 7 ) ) + decrypted_operand += ~0xFFull; + break; + case 16: + if ( ( u16 )( decrypted_operand >> 15 ) ) + decrypted_operand += ~0xFFFFull; + break; + case 32: + if ( ( u32 )( decrypted_operand >> 31 ) ) + decrypted_operand += ~0xFFFFFFFFull; + break; + default: + throw std::invalid_argument( "invalid imm size for sign extention...\n" ); + } + } + } + + char buff[ 256 ]; + if ( vm_handler.profile ) + snprintf( buff, sizeof buff, "%s 0x%p", vm_handler.profile->name, decrypted_operand ); + else + snprintf( buff, sizeof buff, "UNK(%d) 0x%p", entry_list[ idx ].handler_idx, decrypted_operand ); + + return { buff, &entry_list[ idx++ ] }; + } + + if ( vm_handler.profile ) + return { vm_handler.profile->name, &entry_list[ idx++ ] }; + + char buff[ 256 ]; + snprintf( buff, sizeof buff, "UNK(%d)", entry_list[ idx ].handler_idx ); + return { buff, &entry_list[ idx++ ] }; + } + + std::uintptr_t vmctx_t::get_imm( vmp2::exec_type_t exec_type_t, std::uint32_t vip_offset, + std::uint8_t imm_size ) const + { + std::uintptr_t operand = 0u; + if ( file_header->advancement == vmp2::exec_type_t::forward ) + { + const auto operand_ptr = + reinterpret_cast< void * >( ( entry_list[ idx ].vip - file_header->module_base ) + module_base ); + + memcpy( &operand, operand_ptr, imm_size ); + } + else + { + const auto operand_ptr = reinterpret_cast< void * >( + ( ( entry_list[ idx ].vip - file_header->module_base ) + module_base ) - imm_size ); + + memcpy( &operand, operand_ptr, imm_size ); + } + + return operand; + } +} // namespace vm \ No newline at end of file diff --git a/src/vmctx.h b/src/vmctx.h new file mode 100644 index 0000000..5dca2ab --- /dev/null +++ b/src/vmctx.h @@ -0,0 +1,24 @@ +#pragma once +#include + +namespace vm +{ + class vmctx_t + { + public: + explicit vmctx_t( vmp2::file_header *file_header, vmp2::entry_t *entry_list, + std::vector< vm::handler::handler_t > &vm_handlers, std::uintptr_t module_base, + std::uintptr_t image_base ); + + std::pair< std::string, const vmp2::entry_t * > step() const; + + private: + std::uintptr_t get_imm( vmp2::exec_type_t exec_type_t, std::uint32_t vip_offset, std::uint8_t imm_size ) const; + + mutable std::uint32_t idx; + const std::uintptr_t image_base, module_base; + const vmp2::entry_t *entry_list; + const vmp2::file_header *file_header; + std::vector< vm::handler::handler_t > vm_handlers; + }; +} // namespace vm \ No newline at end of file diff --git a/src/vmprofiler-qt.vcxproj b/src/vmprofiler-qt.vcxproj index 4fcb51d..69d425e 100644 --- a/src/vmprofiler-qt.vcxproj +++ b/src/vmprofiler-qt.vcxproj @@ -63,14 +63,17 @@ stdcpp17 + ZYDIS_STATIC_DEFINE;%(PreprocessorDefinitions) $(ProjectDir)..\libs\*;%(AdditionalDependencies) + true stdcpp17 + %(PreprocessorDefinitions) @@ -82,7 +85,7 @@ MultiThreadedDebugDLL - Windows + Console true @@ -91,15 +94,16 @@ true true None - MaxSpeed + Disabled MultiThreadedDLL Windows - false + true + @@ -113,6 +117,7 @@ + diff --git a/src/vmprofiler-qt.vcxproj.filters b/src/vmprofiler-qt.vcxproj.filters index 378cf16..117d426 100644 --- a/src/vmprofiler-qt.vcxproj.filters +++ b/src/vmprofiler-qt.vcxproj.filters @@ -16,6 +16,9 @@ Source Files\DarkStyle + + Source Files + @@ -242,6 +245,9 @@ Header Files + + Header Files + diff --git a/vmprofiler-qt.sln b/vmprofiler-qt.sln index 72529a1..ca079c3 100644 --- a/vmprofiler-qt.sln +++ b/vmprofiler-qt.sln @@ -89,8 +89,8 @@ Global {A0485AE3-1965-4BE3-A2C4-A8257337C271}.Release|x64.ActiveCfg = Release|x64 {A0485AE3-1965-4BE3-A2C4-A8257337C271}.Release|x64.Build.0 = Release|x64 {A0485AE3-1965-4BE3-A2C4-A8257337C271}.Release|x86.ActiveCfg = Release|x64 - {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.ActiveCfg = Debug MT|x64 - {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.Build.0 = Debug MT|x64 + {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.ActiveCfg = Debug MT DLL|x64 + {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x64.Build.0 = Debug MT DLL|x64 {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x86.ActiveCfg = Debug MT|Win32 {88A23124-5640-35A0-B890-311D7A67A7D2}.DBG|x86.Build.0 = Debug MT|Win32 {88A23124-5640-35A0-B890-311D7A67A7D2}.Debug Kernel|x64.ActiveCfg = Debug Kernel|x64