diff --git a/README.md b/README.md index fb4321c..168582e 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ - Anti-Dump - Anti-Disassembly + Anti-Decompiler - Memory Protection(CRC32) -- Custom Passes +- Custom Passes(MBA Obfuscation Pass and Custom Passes from Ryujin Community) --- diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.cc b/RyujinConsole/RyujinConsole/RyujinConsole.cc index 63fe942..9a66307 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.cc +++ b/RyujinConsole/RyujinConsole/RyujinConsole.cc @@ -98,7 +98,7 @@ auto main(int argc, char* argv[]) -> int { // Registering a new custom pass for invocation via callback config.RegisterCallback(RyujinCustomPasses::RyujinCustomPassDemo); - + // Registering MBA Obfuscation Custom Pass config.RegisterCallback(RyujinCustomPasses::RyujinMBAObfuscationPass); if (has_flag(args, "--procs")) { diff --git a/RyujinConsole/RyujinConsole/RyujinCustomPasses.hh b/RyujinConsole/RyujinConsole/RyujinCustomPasses.hh index 32f814d..c22f196 100644 --- a/RyujinConsole/RyujinConsole/RyujinCustomPasses.hh +++ b/RyujinConsole/RyujinConsole/RyujinCustomPasses.hh @@ -49,6 +49,14 @@ namespace RyujinCustomPasses { void RyujinMBAObfuscationPass(RyujinProcedure* proc) { + /* + This is a custom obfuscation pass callback that adds MBA-Linear support to the Ryujin Core, allowing + mathematical operators in certain procedures with the "mba_" prefix to be obfuscated. This ensures + equivalence between the original and obfuscated expressions, increasing analysis difficulty without + breaking the core execution logic. SMT SOLVER - Z3-C + + Currently supports the following linear equivalence instructions: SUB, ADD, XOR, AND, and OR. + */ // Translating Zydis registers to ASMJIT registers auto get_asm_reg_64 = [&](ZydisRegister z_reg) -> asmjit::x86::Gp {