feat: Expanding Break Decompilers and Disassemblers feature

- The disassembler and decompiler's break feature now supports multiple techniques, inspired by a talk from BinjaDev at Off by One Conf. I've researched new capabilities to expand on this idea. The code has also been significantly improved to be more efficient and dynamic, allowing for future enhancements.
- Updated README.md to include the new Memory Protection feature.
This commit is contained in:
keowu
2025-07-17 21:02:09 -03:00
parent dd22fc4aa9
commit ac2d80c371
2 changed files with 18 additions and 9 deletions

View File

@@ -19,6 +19,7 @@
- Troll Reversers(Exclusive)
- Anti-Dump
- Anti-Disassembly + Anti-Decompiler
- Memory Protection(CRC32 - Planned - **TODO**)
- Custom Passes(Planned - **TODO**)
---

View File

@@ -1951,17 +1951,25 @@ void RyujinObfuscationCore::updateBasicBlocksContext() {
void RyujinObfuscationCore::insertBreakDecompilers(asmjit::x86::Assembler& a) {
//Breaking Decompilers(https://youtu.be/6UlxrDYng88?t=1287)
a.push(asmjit::x86::rbx);
std::vector<unsigned char> breakDecompilerOneByteTrick{
0xEB, 0xFF, 0xC3
//Inspired by Breaking Decompilers(https://youtu.be/6UlxrDYng88?t=1287)
const std::vector<std::pair<asmjit::x86::Gp, std::vector<uint8_t>>> tricks = {
{ asmjit::x86::rbx, { 0xEB, 0xFF, 0xC3 } },
{ asmjit::x86::rdx, { 0xEB, 0xFF, 0xC2, 0x90, 0x90 } },
{ asmjit::x86::rcx, { 0xEB, 0xFF, 0xC9 } },
{ asmjit::x86::rax, { 0xEB, 0xFF, 0xC0, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } }
};
a.embed(breakDecompilerOneByteTrick.data(), breakDecompilerOneByteTrick.size());
a.pop(asmjit::x86::rbx);
static std::mt19937 rng(static_cast<unsigned>(std::time(nullptr)));
std::uniform_int_distribution<size_t> dist(0, tricks.size() - 1);
const auto& selected = tricks[dist(rng)];
const auto& reg = selected.first;
const auto& bytes = selected.second;
a.push(reg);
a.embed(bytes.data(), bytes.size());
a.pop(reg);
}