feat: MSVC optimization bug fixes, FFI standard support, and Anti-Debug options in RyujinGui
- Fixed a bug related to MSVC optimizations that broke Ryujin's relocation algorithm and its fix-up logic. - Introduced a standardized FFI argument-passing method for Ryujin Core; the legacy method remains compatible. - Ryujin GUI now fully supports the Anti-Debug features. - Various minor bug fixes and improvements to project structure.
This commit is contained in:
@@ -1,18 +1,27 @@
|
||||
#pragma once
|
||||
#include <string>
|
||||
|
||||
#define MAX_PROCEDURES 128
|
||||
#define MAX_PROCEDURE_NAME_LEN 128
|
||||
|
||||
struct RyujinObfuscatorProcs {
|
||||
int procedureCount;
|
||||
char procedures[MAX_PROCEDURES][MAX_PROCEDURE_NAME_LEN];
|
||||
};
|
||||
|
||||
class RyujinObfuscatorConfig {
|
||||
|
||||
public:
|
||||
bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard
|
||||
bool m_isVirtualized; // Virtualize the code [Try as much as possible]
|
||||
bool m_isIatObfuscation; //Process IAT Obfuscation
|
||||
bool m_isJunkCode; // Insert junk code to confuse
|
||||
bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs)
|
||||
bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection
|
||||
bool m_isAntiDebug; // The user wants to avoid debuggers use while running a binary protected by Ryujin
|
||||
bool m_isTrollRerversers; // The user wants to trick and use a special feature to troll reversers when their debugs be detected making they loose all the progress
|
||||
std::vector<std::string> m_strProceduresToObfuscate; // Names of the procedures to obfuscate
|
||||
bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard
|
||||
bool m_isVirtualized; // Virtualize the code [Try as much as possible]
|
||||
bool m_isIatObfuscation; //Process IAT Obfuscation
|
||||
bool m_isJunkCode; // Insert junk code to confuse
|
||||
bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs)
|
||||
bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection
|
||||
bool m_isAntiDebug; // The user wants to avoid debuggers use while running a binary protected by Ryujin
|
||||
bool m_isTrollRerversers; // The user wants to trick and use a special feature to troll reversers when their debugs be detected making they loose all the progress
|
||||
RyujinObfuscatorProcs m_strProceduresToObfuscate; // Names of the procedures to obfuscate - FFI
|
||||
std::vector<std::string> m_strdProceduresToObfuscate; // Names of the procedures to obfuscate
|
||||
// todo: passes
|
||||
|
||||
};
|
||||
@@ -83,7 +83,7 @@ bool Ryujin::run(const RyujinObfuscatorConfig& config) {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (config.m_strProceduresToObfuscate.size() == 0) {
|
||||
if (config.m_strdProceduresToObfuscate.size() == 0) {
|
||||
|
||||
::OutputDebugStringA(
|
||||
|
||||
@@ -98,9 +98,9 @@ bool Ryujin::run(const RyujinObfuscatorConfig& config) {
|
||||
|
||||
for (auto& proc : m_ryujinProcedures) {
|
||||
|
||||
auto it = std::find(config.m_strProceduresToObfuscate.begin(), config.m_strProceduresToObfuscate.end(), proc.name);
|
||||
auto it = std::find(config.m_strdProceduresToObfuscate.begin(), config.m_strdProceduresToObfuscate.end(), proc.name);
|
||||
|
||||
if (it == config.m_strProceduresToObfuscate.end()) continue;
|
||||
if (it == config.m_strdProceduresToObfuscate.end()) continue;
|
||||
|
||||
std::printf(
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
class RyujinObfuscationCore {
|
||||
|
||||
private:
|
||||
const int MAX_PADDING_SPACE_INSTR = 13;
|
||||
const int MAX_PADDING_SPACE_INSTR = 14;
|
||||
const int MAX_JUNK_GENERATION_ITERATION = 5;
|
||||
std::vector<ZydisRegister> m_unusedRegisters;
|
||||
std::vector<RyujinBasicBlock> m_obfuscated_bb;
|
||||
|
||||
Reference in New Issue
Block a user