diff --git a/include/vmutils.hpp b/include/vmutils.hpp index 4212a64..7ca8423 100644 --- a/include/vmutils.hpp +++ b/include/vmutils.hpp @@ -5,7 +5,9 @@ #include #include +#include #include +#include #include #ifdef _MSC_VER @@ -79,8 +81,8 @@ using zydis_routine_t = std::vector; /// namespace vm::util { -inline std::shared_ptr g_decoder = nullptr; -inline std::shared_ptr g_formatter = nullptr; +inline thread_local std::shared_ptr g_decoder = nullptr; +inline thread_local std::shared_ptr g_formatter = nullptr; inline void init() { if (!vm::util::g_decoder && !vm::util::g_formatter) { diff --git a/src/vmutils.cpp b/src/vmutils.cpp index 8670a0d..745f97a 100644 --- a/src/vmutils.cpp +++ b/src/vmutils.cpp @@ -169,21 +169,21 @@ void deobfuscate(zydis_routine_t &routine) { }; std::uint32_t last_size = 0u; + static const std::vector blacklist = { + ZYDIS_MNEMONIC_CLC, ZYDIS_MNEMONIC_BT, ZYDIS_MNEMONIC_TEST, + ZYDIS_MNEMONIC_CMP, ZYDIS_MNEMONIC_CMC, ZYDIS_MNEMONIC_STC}; + + static const std::vector whitelist = { + ZYDIS_MNEMONIC_PUSH, ZYDIS_MNEMONIC_POP, ZYDIS_MNEMONIC_CALL, + ZYDIS_MNEMONIC_DIV}; do { last_size = routine.size(); - for (auto itr = routine.begin(); itr != routine.end(); ++itr) { - // dont remove these... at all... - if (itr->instr.mnemonic == ZYDIS_MNEMONIC_PUSH || - itr->instr.mnemonic == ZYDIS_MNEMONIC_POP || - itr->instr.mnemonic == ZYDIS_MNEMONIC_CALL) + if (std::find(whitelist.begin(), whitelist.end(), itr->instr.mnemonic) != + whitelist.end()) continue; - static const std::vector blacklist = { - ZYDIS_MNEMONIC_CLC, ZYDIS_MNEMONIC_BT, ZYDIS_MNEMONIC_TEST, - ZYDIS_MNEMONIC_CMP, ZYDIS_MNEMONIC_CMC, ZYDIS_MNEMONIC_STC}; - if (std::find(blacklist.begin(), blacklist.end(), itr->instr.mnemonic) != blacklist.end()) { routine.erase(itr);