diff --git a/include/vmprofiler.hpp b/include/vmprofiler.hpp index 46ebe24..2e9838d 100644 --- a/include/vmprofiler.hpp +++ b/include/vmprofiler.hpp @@ -53,6 +53,7 @@ namespace vm LCONSTWSXQ, LCONSTWSXDW, LCONSTDW, + LCONSTW, READQ, READDW, @@ -134,6 +135,7 @@ namespace vm extern vm::handler::profile_t lconstq; extern vm::handler::profile_t lconstdw; + extern vm::handler::profile_t lconstw; extern vm::handler::profile_t lconstbzxw; extern vm::handler::profile_t lconstbsxdw; @@ -170,13 +172,14 @@ namespace vm extern vm::handler::profile_t vmexit; inline std::vector< vm::handler::profile_t * > all = { - &sregq, &sregdw, &sregw, &lregq, &lregdw, &lconstq, &lconstbzxw, &lconstbsxdw, - &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstwsxdw, &lconstdw, &addq, &adddw, &addw, + &sregq, &sregdw, &sregw, &lregq, &lregdw, &lconstq, &lconstbzxw, + &lconstbsxdw, &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstwsxdw, &lconstdw, &lconstw, + &addq, &adddw, &addw, - &shlq, &shldw, &writeq, &writedw, &writeb, &nandq, &nanddw, + &shlq, &shldw, &writeq, &writedw, &writeb, &nandq, &nanddw, - &shrq, &shrw, &readq, &readdw, &mulq, &pushvsp, &divq, &jmp, - &vmexit, &call }; + &shrq, &shrw, &readq, &readdw, &mulq, &pushvsp, &divq, + &jmp, &vmexit, &call }; } // namespace profile } // namespace handler } // namespace vm \ No newline at end of file diff --git a/src/vmprofiles/lconst.cpp b/src/vmprofiles/lconst.cpp index fca5536..9b7bbca 100644 --- a/src/vmprofiles/lconst.cpp +++ b/src/vmprofiles/lconst.cpp @@ -30,6 +30,52 @@ namespace vm instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX; } } } }; + vm::handler::profile_t lconstdw = { + // SUB RBP, 4 + // MOV [RBP], EAX + "LCONSTDW", + LCONSTDW, + 32, + { { // SUB RBP, 4 + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_SUB && + instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP && + instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE && + instr.operands[ 1 ].imm.value.u == 0x4; + }, + // MOV [RBP], EAX + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_MOV && + instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY && + instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP && + instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX; + } } } }; + + vm::handler::profile_t lconstw = { + // SUB RBP, 2 + // MOV [RBP], AX + "LCONSTW", + LCONSTW, + 16, + { { // SUB RBP, 2 + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_SUB && + instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP && + instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE && + instr.operands[ 1 ].imm.value.u == 0x2; + }, + // MOV [RBP], AX + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_MOV && + instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY && + instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP && + instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX; + } } } }; + vm::handler::profile_t lconstbzxw = { // MOV AL, [RSI] // SUB RBP, 2 @@ -188,29 +234,6 @@ namespace vm instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX; } } }, vm::handler::extention_t::sign_extend }; - - vm::handler::profile_t lconstdw = { - // SUB RBP, 4 - // MOV [RBP], EAX - "LCONSTDW", - LCONSTDW, - 32, - { { // SUB RBP, 4 - []( const zydis_decoded_instr_t &instr ) -> bool { - return instr.mnemonic == ZYDIS_MNEMONIC_SUB && - instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER && - instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP && - instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE && - instr.operands[ 1 ].imm.value.u == 0x4; - }, - // MOV [RBP], EAX - []( const zydis_decoded_instr_t &instr ) -> bool { - return instr.mnemonic == ZYDIS_MNEMONIC_MOV && - instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY && - instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP && - instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER && - instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX; - } } } }; } // namespace profile } // namespace handler } // namespace vm \ No newline at end of file