Feat/semantic handler generation

example.ps1

@@ -46,14 +46,14 @@ switch ($language) {
         $manifest = [Path]::GetFullPath($manifest)
 
         $package = $metadata.packages |
-            Where-Object {
-                [Path]::GetFullPath($_.manifest_path) -eq $manifest
-            } |
-            Select-Object -First 1
+        Where-Object {
+            [Path]::GetFullPath($_.manifest_path) -eq $manifest
+        } |
+        Select-Object -First 1
 
         $target = $package.targets |
-            Where-Object { $_.kind -contains "bin" } |
-            Select-Object -First 1
+        Where-Object { $_.kind -contains "bin" } |
+        Select-Object -First 1
 
         $source = Join-Path `
             $metadata.target_directory `

example.tape

@@ -9,7 +9,7 @@ Type "eco zenburn"
 Enter
 Type "aa"
 Enter
-Sleep 5s
+Sleep 2.5s
 Type "s section..binsafe"
 Enter
 Type "pdui add byte [rax], al~:0..-1"
@@ -24,7 +24,7 @@ Type "eco zenburn"
 Enter
 Type "aa"
 Enter
-Sleep 5s
+Sleep 2.5s
 Type "s section..binsafe"
 Enter
 Type "pdui add byte [rax], al~:0..-1"

logger/src/lib.rs

@@ -54,10 +54,7 @@ pub fn error(fmt: impl fmt::Display) {
 #[macro_export]
 macro_rules! debug {
     ($($arg:tt)*) => {{
-        #[cfg(debug_assertions)]
         $crate::debug(format_args!($($arg)*));
-        #[cfg(not(debug_assertions))]
-        let _ = format_args!($($arg)*);
     }};
 }
 

obfuscator/src/protections/virtualization/attestation/anti_debug.rs

@@ -1,6 +1,5 @@
 use crate::engine::Engine;
 use crate::protections::virtualization::attestation::*;
-use rand::Rng;
 use runtime::runtime::ImportDef;
 use runtime::vm::bytecode::{VMReg, VMSeg, VMWidth};
 use runtime::vm::encoders::Encode;
@@ -22,32 +21,24 @@ const THREAD_HIDE_FROM_DEBUGGER: u64 = 0x11;
 const STATUS_PORT_NOT_SET: u64 = 0xc0000353;
 const STATUS_SUCCESS: u64 = 0;
 
-pub fn generate(
-    engine: &mut Engine,
-    rng: &mut impl Rng,
-    expected: &mut u64,
-) -> Vec<Box<dyn Encode>> {
+pub fn generate(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
     let mut instructions = Vec::<Box<dyn Encode>>::new();
 
     instructions.extend(reserve(0x30));
 
     instructions.extend(set_register(VMReg::Vp0, 0));
 
-    instructions.extend(query_kd_debugger_enabled(engine, rng, expected));
-    instructions.extend(query_process_debug_object_handle(engine, rng, expected));
-    instructions.extend(set_hide_from_debugger(engine, rng, expected));
-    instructions.extend(query_hide_from_debbuger(engine, rng, expected));
+    instructions.extend(query_kd_debugger_enabled(engine, expected));
+    instructions.extend(query_process_debug_object_handle(engine, expected));
+    instructions.extend(set_hide_from_debugger(engine, expected));
+    instructions.extend(query_hide_from_debbuger(engine, expected));
 
     instructions.extend(release(0x30));
 
     instructions
 }
 
-fn query_kd_debugger_enabled(
-    engine: &mut Engine,
-    rng: &mut impl Rng,
-    expected: &mut u64,
-) -> Vec<Box<dyn Encode>> {
+fn query_kd_debugger_enabled(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
     let mut b = Vec::new();
 
     b.extend(load_memory(
@@ -59,7 +50,7 @@ fn query_kd_debugger_enabled(
         VMWidth::Lower8,
     ));
     b.extend(accumulate_immediate(
-        rng,
+        engine,
         VMReg::Vp0,
         None,
         0,
@@ -68,7 +59,7 @@ fn query_kd_debugger_enabled(
 
     b.extend(import(engine, ImportDef::NtQuerySystemInformation));
     b.extend(accumulate_prologue(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rax,
         &NT_QUERY_INFORMATION_PROCESS_PROLOGUE,
@@ -94,16 +85,16 @@ fn query_kd_debugger_enabled(
     b.extend(invoke(VMReg::Rax));
 
     b.extend(accumulate_immediate(
-        rng,
+        engine,
         VMReg::Vp0,
         Some(VMReg::Rax),
         STATUS_SUCCESS,
         expected,
     ));
 
-    // READ KernelDebuggerEnabled + KernelDebuggerNotPresent
+    // KernelDebuggerEnabled + KernelDebuggerNotPresent
     b.extend(accumulate_memory(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rsp,
         0x20,
@@ -117,14 +108,13 @@ fn query_kd_debugger_enabled(
 
 fn query_process_debug_object_handle(
     engine: &mut Engine,
-    rng: &mut impl Rng,
     expected: &mut u64,
 ) -> Vec<Box<dyn Encode>> {
     let mut b = Vec::new();
 
     b.extend(import(engine, ImportDef::NtQueryInformationProcess));
     b.extend(accumulate_prologue(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rax,
         &NT_QUERY_INFORMATION_PROCESS_PROLOGUE,
@@ -152,16 +142,16 @@ fn query_process_debug_object_handle(
     b.extend(invoke(VMReg::Rax));
 
     b.extend(accumulate_immediate(
-        rng,
+        engine,
         VMReg::Vp0,
         Some(VMReg::Rax),
         STATUS_PORT_NOT_SET,
         expected,
     ));
 
-    // READ ProcessDebugObjectHandle
+    // ProcessDebugObjectHandle
     b.extend(accumulate_memory(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rsp,
         0x28,
@@ -173,16 +163,12 @@ fn query_process_debug_object_handle(
     b
 }
 
-fn set_hide_from_debugger(
-    engine: &mut Engine,
-    rng: &mut impl Rng,
-    expected: &mut u64,
-) -> Vec<Box<dyn Encode>> {
+fn set_hide_from_debugger(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
     let mut b = Vec::new();
 
     b.extend(import(engine, ImportDef::NtSetInformationThread));
     b.extend(accumulate_prologue(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rax,
         &NT_SET_INFORMATION_THREAD_PROLOGUE,
@@ -200,7 +186,7 @@ fn set_hide_from_debugger(
     b.extend(invoke(VMReg::Rax));
 
     b.extend(accumulate_immediate(
-        rng,
+        engine,
         VMReg::Vp0,
         Some(VMReg::Rax),
         STATUS_SUCCESS,
@@ -210,16 +196,12 @@ fn set_hide_from_debugger(
     b
 }
 
-fn query_hide_from_debbuger(
-    engine: &mut Engine,
-    rng: &mut impl Rng,
-    expected: &mut u64,
-) -> Vec<Box<dyn Encode>> {
+fn query_hide_from_debbuger(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
     let mut b = Vec::new();
 
     b.extend(import(engine, ImportDef::NtQueryInformationThread));
     b.extend(accumulate_prologue(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rax,
         &NT_QUERY_INFORMATION_THREAD_PROLOGUE,
@@ -248,16 +230,16 @@ fn query_hide_from_debbuger(
     b.extend(invoke(VMReg::Rax));
 
     b.extend(accumulate_immediate(
-        rng,
+        engine,
         VMReg::Vp0,
         Some(VMReg::Rax),
         STATUS_SUCCESS,
         expected,
     ));
 
-    // READ ThreadHideFromDebugger
+    // ThreadHideFromDebugger
     b.extend(accumulate_byte(
-        rng,
+        engine,
         VMReg::Vp0,
         VMReg::Rsp,
         0x28,

obfuscator/src/protections/virtualization/attestation/anti_emulation.rs

@@ -0,0 +1,37 @@
+use crate::engine::Engine;
+use crate::protections::virtualization::attestation::*;
+use runtime::vm::bytecode::{Flag, VMReg};
+use runtime::vm::encoders::Encode;
+
+// CPUID.1:ECX[31]
+const HYPERVISOR_PRESENT_BIT: u64 = 31;
+
+const HYPERVISOR_VENDOR_LEAF: u32 = 0x4000_0000;
+
+pub fn generate(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
+    let mut b = Vec::<Box<dyn Encode>>::new();
+
+    b.extend(cpuid(1, 0));
+    b.extend(discard());
+    b.extend(immediate(HYPERVISOR_PRESENT_BIT));
+    b.extend(shr(None, None));
+    b.extend(store_register(VMReg::R8));
+    b.extend(discard());
+    b.extend(discard());
+
+    b.extend(cpuid(HYPERVISOR_VENDOR_LEAF, 0));
+    b.extend(or(None, None));
+    b.extend(or(None, None));
+    b.extend(or(None, None));
+
+    b.extend(immediate(1));
+    b.extend(sub(None, None));
+    b.extend(discard());
+    b.extend(flag(Flag::Carry));
+
+    b.extend(and(Some(VMReg::R8), None));
+
+    b.extend(accumulate_immediate(engine, VMReg::Vp0, None, 0, expected));
+
+    b
+}

obfuscator/src/protections/virtualization/attestation/anti_tamper.rs

@@ -3,22 +3,13 @@ use std::convert::TryInto;
 use crate::engine::Engine;
 use crate::protections::virtualization::attestation::*;
 use exe::{Buffer, PE, RVA};
-use rand::Rng;
 use runtime::mapper::Mappable;
 use runtime::runtime::{DataDef, FnDef};
 use runtime::vm::bytecode::{VMReg, VMSeg, VMWidth};
 use runtime::vm::encoders::Encode;
 
-pub fn generate(
-    engine: &mut Engine,
-    rng: &mut impl Rng,
-    expected: &mut u64,
-) -> Vec<Box<dyn Encode>> {
-    let operation = Operation::random(rng);
-
-    let seed = engine.rt.keys.initializer;
-
-    let mut hash = seed;
+pub fn generate(engine: &mut Engine, expected: &mut u64) -> Vec<Box<dyn Encode>> {
+    let mut hash = *expected;
 
     for &function in FnDef::VARIANTS.iter() {
         let rva = engine.rt.lookup(engine.rt.function_labels[&function]) as u32;
@@ -31,13 +22,11 @@ pub fn generate(
 
         for chunk in &mut chunks {
             let word = u64::from_le_bytes(chunk.try_into().unwrap());
-            apply_operation(operation, word, &mut hash);
-            hash = apply_lcg(engine, hash);
+            hash = apply_lcg(engine, hash ^ word);
         }
 
         for &byte in chunks.remainder() {
-            apply_operation(operation, byte as u64, &mut hash);
-            hash = apply_lcg(engine, hash);
+            hash = apply_lcg(engine, hash ^ byte as u64);
         }
     }
 
@@ -49,8 +38,6 @@ pub fn generate(
 
     let mut instructions = Vec::<Box<dyn Encode>>::new();
 
-    instructions.extend(set_register(VMReg::Vp1, seed));
-
     instructions.extend(foreach(
         engine,
         VMReg::Rax,
@@ -92,7 +79,7 @@ pub fn generate(
                 |engine| {
                     let mut inner = Vec::<Box<dyn Encode>>::new();
 
-                    inner.extend(load_register(VMReg::Vp1));
+                    inner.extend(load_register(VMReg::Vp0));
                     inner.extend(load_memory(
                         VMReg::Rcx,
                         VMReg::R10,
@@ -101,9 +88,9 @@ pub fn generate(
                         VMSeg::None,
                         VMWidth::Lower64,
                     ));
-                    inner.extend(register_operation(operation, None, None));
+                    inner.extend(xor(None, None));
                     inner.extend(register_lcg(engine, None));
-                    inner.extend(store_register(VMReg::Vp1));
+                    inner.extend(store_register(VMReg::Vp0));
 
                     inner
                 },
@@ -120,7 +107,7 @@ pub fn generate(
                 |engine| {
                     let mut inner = Vec::<Box<dyn Encode>>::new();
 
-                    inner.extend(load_register(VMReg::Vp1));
+                    inner.extend(load_register(VMReg::Vp0));
                     inner.extend(load_memory(
                         VMReg::Rdx,
                         VMReg::R9,
@@ -129,9 +116,9 @@ pub fn generate(
                         VMSeg::None,
                         VMWidth::Lower8,
                     ));
-                    inner.extend(register_operation(operation, None, None));
+                    inner.extend(xor(None, None));
                     inner.extend(register_lcg(engine, None));
-                    inner.extend(store_register(VMReg::Vp1));
+                    inner.extend(store_register(VMReg::Vp0));
 
                     inner
                 },