parent
5e0e7ab06b
commit
2e7281f900
@ -0,0 +1,42 @@
|
|||||||
|
#pragma once
|
||||||
|
#include <transform.hpp>
|
||||||
|
#include <vmp2.hpp>
|
||||||
|
|
||||||
|
namespace vm {
|
||||||
|
/// <summary>
|
||||||
|
/// vm::ctx_t class is used to auto generate vm_entry, calc_jmp, and other
|
||||||
|
/// per-vm entry information... creating a vm::ctx_t object can make it easier
|
||||||
|
/// to pass around information pertaining to a given vm entry...
|
||||||
|
/// </summary>
|
||||||
|
class ctx_t {
|
||||||
|
public:
|
||||||
|
/// <summary>
|
||||||
|
/// default constructor for vm::ctx_t... all information for a given vm entry
|
||||||
|
/// must be provided...
|
||||||
|
/// </summary>
|
||||||
|
/// <param name="module_base">the linear virtual address of the module
|
||||||
|
/// base...</param> <param name="image_base">image base from optional nt
|
||||||
|
/// header... <a
|
||||||
|
/// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
|
||||||
|
/// <param name="image_size">image size from optional nt header... <a
|
||||||
|
/// href="https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_optional_header64">IMAGE_OPTIONAL_HEADER64</a>...</param>
|
||||||
|
/// <param name="vm_entry_rva">relative virtual address from the module base
|
||||||
|
/// address to the first push prior to a vm entry...</param>
|
||||||
|
explicit ctx_t(std::uintptr_t module_base, std::uintptr_t image_base,
|
||||||
|
std::uintptr_t image_size, std::uintptr_t vm_entry_rva);
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// init all per-vm entry data such as vm_entry, calc_jmp, and vm handlers...
|
||||||
|
/// </summary>
|
||||||
|
/// <returns>returns true if no errors...</returns>
|
||||||
|
bool init();
|
||||||
|
|
||||||
|
const std::uintptr_t module_base, image_base, vm_entry_rva, image_size;
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// the order in which VIP advances...
|
||||||
|
/// </summary>
|
||||||
|
vmp2::exec_type_t exec_type;
|
||||||
|
zydis_routine_t vm_entry;
|
||||||
|
};
|
||||||
|
} // namespace vm
|
@ -0,0 +1,19 @@
|
|||||||
|
#include <vmctx.hpp>
|
||||||
|
|
||||||
|
namespace vm
|
||||||
|
{
|
||||||
|
ctx_t::ctx_t( std::uintptr_t module_base, std::uintptr_t image_base, std::uintptr_t image_size,
|
||||||
|
std::uintptr_t vm_entry_rva )
|
||||||
|
: module_base( module_base ), image_base( image_base ), image_size( image_size ), vm_entry_rva( vm_entry_rva )
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
bool ctx_t::init()
|
||||||
|
{
|
||||||
|
if ( !vm::util::flatten( vm_entry, vm_entry_rva + module_base ) )
|
||||||
|
return false;
|
||||||
|
|
||||||
|
vm::util::deobfuscate( vm_entry );
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
} // namespace vm
|
Loading…
Reference in new issue