feat: Update README and Code Comments
- Updating README.md. - Commenting on the code for explain the scope of RyujinMBAObfuscationPass.
This commit is contained in:
@@ -20,7 +20,7 @@
|
|||||||
- Anti-Dump
|
- Anti-Dump
|
||||||
- Anti-Disassembly + Anti-Decompiler
|
- Anti-Disassembly + Anti-Decompiler
|
||||||
- Memory Protection(CRC32)
|
- Memory Protection(CRC32)
|
||||||
- Custom Passes
|
- Custom Passes(MBA Obfuscation Pass and Custom Passes from Ryujin Community)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@@ -98,7 +98,7 @@ auto main(int argc, char* argv[]) -> int {
|
|||||||
|
|
||||||
// Registering a new custom pass for invocation via callback
|
// Registering a new custom pass for invocation via callback
|
||||||
config.RegisterCallback(RyujinCustomPasses::RyujinCustomPassDemo);
|
config.RegisterCallback(RyujinCustomPasses::RyujinCustomPassDemo);
|
||||||
|
// Registering MBA Obfuscation Custom Pass
|
||||||
config.RegisterCallback(RyujinCustomPasses::RyujinMBAObfuscationPass);
|
config.RegisterCallback(RyujinCustomPasses::RyujinMBAObfuscationPass);
|
||||||
|
|
||||||
if (has_flag(args, "--procs")) {
|
if (has_flag(args, "--procs")) {
|
||||||
|
|||||||
@@ -49,6 +49,14 @@ namespace RyujinCustomPasses {
|
|||||||
|
|
||||||
void RyujinMBAObfuscationPass(RyujinProcedure* proc) {
|
void RyujinMBAObfuscationPass(RyujinProcedure* proc) {
|
||||||
|
|
||||||
|
/*
|
||||||
|
This is a custom obfuscation pass callback that adds MBA-Linear support to the Ryujin Core, allowing
|
||||||
|
mathematical operators in certain procedures with the "mba_" prefix to be obfuscated. This ensures
|
||||||
|
equivalence between the original and obfuscated expressions, increasing analysis difficulty without
|
||||||
|
breaking the core execution logic. SMT SOLVER - Z3-C
|
||||||
|
|
||||||
|
Currently supports the following linear equivalence instructions: SUB, ADD, XOR, AND, and OR.
|
||||||
|
*/
|
||||||
// Translating Zydis registers to ASMJIT registers
|
// Translating Zydis registers to ASMJIT registers
|
||||||
auto get_asm_reg_64 = [&](ZydisRegister z_reg) -> asmjit::x86::Gp {
|
auto get_asm_reg_64 = [&](ZydisRegister z_reg) -> asmjit::x86::Gp {
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user