You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
vmprofiler/include/vmprofiles.hpp

247 lines
6.6 KiB

#pragma once
#include <transform.hpp>
/// <summary>
/// contains all information pertaining to vm handler identification...
/// </summary>
namespace vm::handler
{
/// <summary>
/// vm handler mnemonic... so you dont need to compare strings!
/// </summary>
enum mnemonic_t
{
INVALID,
LRFLAGS,
PUSHVSP,
MULQ,
DIVQ,
CALL,
JMP,
VMEXIT,
LVSP,
SREGQ,
SREGDW,
SREGW,
LREGQ,
LREGDW,
LCONSTQ,
LCONSTBZXW,
LCONSTBSXQ,
LCONSTBSXDW,
LCONSTDWSXQ,
LCONSTWSXQ,
LCONSTWSXDW,
LCONSTDW,
LCONSTW,
READQ,
READDW,
READW,
WRITEQ,
WRITEDW,
WRITEW,
WRITEB,
ADDQ,
ADDDW,
ADDW,
SHLQ,
SHLDW,
SHRQ,
SHRW,
NANDQ,
NANDDW,
NANDW
};
/// <summary>
/// zydis callback lambda used to pattern match native instructions...
/// </summary>
using zydis_callback_t = std::function< bool( const zydis_decoded_instr_t &instr ) >;
/// <summary>
/// how sign extention is handled...
/// </summary>
enum extention_t
{
none,
sign_extend,
zero_extend
};
/// <summary>
/// pre defined vm handler profile containing all compiled time known information about a vm handler...
/// </summary>
struct profile_t
{
/// <summary>
/// name of the vm handler, such as JMP or LCONST...
/// </summary>
const char *name;
/// <summary>
/// the mnemonic of the vm handler... so you dont need to compare strings...
/// </summary>
mnemonic_t mnemonic;
/// <summary>
/// size, in bits, of the operand (imm)... if there is none then this will be zero...
/// </summary>
u8 imm_size;
/// <summary>
/// a vector of signatures used to compare native instructions against zydis aided signatures...
/// </summary>
std::vector< zydis_callback_t > signature;
/// <summary>
/// how sign extention of operands are handled...
/// </summary>
extention_t extention;
};
/// <summary>
/// contains all profiles defined, as well as a vector of all of the defined profiles...
/// </summary>
namespace profile
{
extern vm::handler::profile_t sregq;
extern vm::handler::profile_t sregdw;
extern vm::handler::profile_t sregw;
extern vm::handler::profile_t lregq;
extern vm::handler::profile_t lregdw;
/// <summary>
/// mov rax, [rsi]
/// xor rax, rbx ; transformation
/// bswap rax ; transformation
/// lea rsi, [rsi+8] ; advance VIP<49>
/// rol rax, 0Ch ; transformation
/// inc rax ; transformation
/// xor rbx, rax ; transformation (update rolling decrypt key)
/// sub rbp, 8
/// mov [rbp+0], rax
/// </summary>
extern vm::handler::profile_t lconstq;
/// <summary>
/// mov eax, [rsi-0x04]
/// bswap eax
/// add eax, ebx
/// dec eax
/// neg eax
/// xor eax, 0x2FFD187C
/// push rbx
/// add [rsp], eax
/// pop rbx
/// sub rbp, 0x04
/// mov [rbp], eax
/// add rsi, 0xFFFFFFFFFFFFFFFC
/// </summary>
extern vm::handler::profile_t lconstdw;
extern vm::handler::profile_t lconstw;
extern vm::handler::profile_t lconstbzxw;
extern vm::handler::profile_t lconstbsxdw;
extern vm::handler::profile_t lconstbsxq;
extern vm::handler::profile_t lconstdwsxq;
extern vm::handler::profile_t lconstwsxq;
extern vm::handler::profile_t lconstwsxdw;
/// <summary>
/// mov rax, [rbp+0]
/// add [rbp+8], rax
/// pushfq
/// pop qword ptr [rbp+0]
/// </summary>
extern vm::handler::profile_t addq;
/// <summary>
/// mov ax, [rbp]
/// sub rbp, 0x06
/// add [rbp+0x08], ax
/// pushfq
/// pop [rbp]
/// </summary>
extern vm::handler::profile_t adddw;
extern vm::handler::profile_t addw;
extern vm::handler::profile_t shlq;
extern vm::handler::profile_t shldw;
extern vm::handler::profile_t nandq;
extern vm::handler::profile_t nanddw;
extern vm::handler::profile_t nandw;
extern vm::handler::profile_t writeq;
extern vm::handler::profile_t writedw;
extern vm::handler::profile_t writeb;
extern vm::handler::profile_t readq;
extern vm::handler::profile_t readdw;
extern vm::handler::profile_t shrq;
extern vm::handler::profile_t shrw;
extern vm::handler::profile_t lrflags;
/// <summary>
/// mov rdx, [rbp]
/// add rbp, 0x08
/// call rdx
/// </summary>
extern vm::handler::profile_t call;
extern vm::handler::profile_t pushvsp;
extern vm::handler::profile_t mulq;
/// <summary>
/// mov rdx, [rbp]
/// mov rax, [rbp+0x08]
/// div [rbp+0x10]
/// mov [rbp+0x08], rdx
/// mov [rbp+0x10], rax
/// pushfq
/// pop [rbp]
/// </summary>
extern vm::handler::profile_t divq;
/// <summary>
/// mov esi, [rbp]
/// add rbp, 0x08
/// lea r12, [0x0000000000048F29]
/// mov rax, 0x00 ; image base bytes above 32bits...
/// add rsi, rax
/// mov rbx, rsi ; update decrypt key
/// add rsi, [rbp] ; add module base address
/// </summary>
extern vm::handler::profile_t jmp;
/// <summary>
/// mov rbp [rbp+0]
/// </summary>
extern vm::handler::profile_t lvsp;
extern vm::handler::profile_t vmexit;
/// <summary>
/// a vector of pointers to all defined vm handler profiles...
/// </summary>
inline std::vector< vm::handler::profile_t * > all = {
&sregq, &sregdw, &sregw, &lregq, &lregdw, &lconstq, &lconstbzxw, &lconstbsxdw,
&lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstwsxdw, &lconstdw, &lconstw, &addq, &adddw,
&addw, &lvsp,
&shlq, &shldw, &writeq, &writedw, &writeb, &nandq, &nanddw, &nandw,
&shrq, &shrw, &readq, &readdw, &mulq, &pushvsp, &divq, &jmp,
&lrflags, &vmexit, &call };
} // namespace profile
} // namespace vm::handler