admin/Ryujin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
19bba59fd21b4727d19340a5e47b76a553b4d94b
Ryujin/diagrams/ryujin_core.excalidraw

4333 lines
177 KiB
Plaintext
Raw Normal View History

feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
{
"type": "excalidraw",
"version": 2,
"source": "https://excalidraw.com",
"elements": [
{
"id": "rp9BmNBNCZ3wF39nJqVei",
"type": "image",
"x": 3150.5466007530686,
"y": -566.9854024698343,
"width": 1221.196066826689,
"height": 507.3983657941878,
"angle": 0,
"strokeColor": "transparent",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "an",
"roundness": null,
"seed": 1706926208,
"version": 647,
"versionNonce": 1277227962,
"isDeleted": false,
"boundElements": [],
"updated": 1754352087140,
"link": null,
"locked": false,
"status": "saved",
"fileId": "a1d850325d9eefc3329c745d4bfcda4d1c9e2267",
"scale": [
1,
1
],
"crop": null
},
{
"id": "1Ksul8JG-CKAkiTTg3igh",
"type": "rectangle",
"x": -1958.133280436198,
"y": 697.033443053562,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "ax",
"roundness": {
"type": 3
},
"seed": 2053091066,
"version": 419,
"versionNonce": 1955594278,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "_eTyRJ_BnUj2EXLfgFn8-"
},
{
"id": "spsXF10QTQJodW_LgWH-G",
"type": "arrow"
}
],
"updated": 1754349992356,
"link": null,
"locked": false
},
{
"id": "_eTyRJ_BnUj2EXLfgFn8-",
"type": "text",
"x": -1654.6613260904949,
"y": 897.1896569480493,
"width": 233.05621337890625,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "ay",
"roundness": null,
"seed": 1329840058,
"version": 383,
"versionNonce": 949437562,
"isDeleted": false,
"boundElements": [],
"updated": 1754349959083,
"link": null,
"locked": false,
"text": "Ryūjin GUI",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "1Ksul8JG-CKAkiTTg3igh",
"originalText": "Ryūjin GUI",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "BVLefnct-zWws51utpVwZ",
"type": "rectangle",
"x": -1954.1333414713547,
"y": 1337.0334430535615,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "az",
"roundness": {
"type": 3
},
"seed": 1564409958,
"version": 471,
"versionNonce": 582663098,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "8YtI6DStN9ZCnkpB_18WH"
},
{
"id": "En_oMX-UTe0T2kGcAHroM",
"type": "arrow"
}
],
"updated": 1754349995591,
"link": null,
"locked": false
},
{
"id": "8YtI6DStN9ZCnkpB_18WH",
"type": "text",
"x": -1643.2676264444992,
"y": 1537.1896569480489,
"width": 218.26869201660156,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b00",
"roundness": null,
"seed": 864945062,
"version": 443,
"versionNonce": 1581924646,
"isDeleted": false,
"boundElements": [],
"updated": 1754349973286,
"link": null,
"locked": false,
"text": "Ryūjin CLI",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "BVLefnct-zWws51utpVwZ",
"originalText": "Ryūjin CLI",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "Ssfa2elKzA_vFWbWlc5ts",
"type": "rectangle",
"x": -551.4665120442712,
"y": 985.0334227085098,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b01",
"roundness": {
"type": 3
},
"seed": 830832166,
"version": 495,
"versionNonce": 670010,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "AgdhsNrMCu2n_6krB9eBa"
},
{
"id": "spsXF10QTQJodW_LgWH-G",
"type": "arrow"
},
{
"id": "En_oMX-UTe0T2kGcAHroM",
"type": "arrow"
},
{
"id": "xVwYLAcWAghQwOVCJNzSb",
"type": "arrow"
}
],
"updated": 1754350184742,
"link": null,
"locked": false
},
{
"id": "AgdhsNrMCu2n_6krB9eBa",
"type": "text",
"x": -383.4226277669274,
"y": 1185.189636602997,
"width": 503.912353515625,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b02",
"roundness": null,
"seed": 1035913574,
"version": 460,
"versionNonce": 1479611302,
"isDeleted": false,
"boundElements": [],
"updated": 1754350011812,
"link": null,
"locked": false,
"text": "RyujinObfuscatorConfig",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "Ssfa2elKzA_vFWbWlc5ts",
"originalText": "RyujinObfuscatorConfig",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "spsXF10QTQJodW_LgWH-G",
"type": "arrow",
"x": -1139.4665323893232,
"y": 916.5333251953116,
"width": 570.666707356771,
"height": 287.999979654948,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b03",
"roundness": {
"type": 2
},
"seed": 976146554,
"version": 32,
"versionNonce": 2689894,
"isDeleted": false,
"boundElements": [],
"updated": 1754349992356,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
570.666707356771,
287.999979654948
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "1Ksul8JG-CKAkiTTg3igh",
"focus": -0.47602761597258014,
"gap": 21.333374023437955
},
"endBinding": {
"elementId": "Ssfa2elKzA_vFWbWlc5ts",
"focus": -0.48402343536718445,
"gap": 17.333312988281023
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "En_oMX-UTe0T2kGcAHroM",
"type": "arrow",
"x": -1115.4664916992192,
"y": 1532.5332845052073,
"width": 544.0000406901045,
"height": 295.99995930989576,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b04",
"roundness": {
"type": 2
},
"seed": 57916710,
"version": 52,
"versionNonce": 2048865402,
"isDeleted": false,
"boundElements": [],
"updated": 1754349995591,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
544.0000406901045,
-295.99995930989576
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "BVLefnct-zWws51utpVwZ",
"focus": 0.42936669158593843,
"gap": 1.333272298177235
},
"endBinding": {
"elementId": "Ssfa2elKzA_vFWbWlc5ts",
"focus": 0.4723638296620877,
"gap": 19.999938964843523
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "lfnAZEl0qn4p2wIEEtBHT",
"type": "rectangle",
"x": 463.1999308268224,
"y": 995.0332192579881,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b05",
"roundness": {
"type": 3
},
"seed": 170856614,
"version": 626,
"versionNonce": 1367608806,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "-64FWEIiVOod7eZlO5Ih3"
},
{
"id": "xVwYLAcWAghQwOVCJNzSb",
"type": "arrow"
},
{
"id": "rC5HsZq1bXGKLR8AH18yl",
"type": "arrow"
},
{
"id": "hz-HJf3RwYUZXwEz1CeOh",
"type": "arrow"
}
],
"updated": 1754350199150,
"link": null,
"locked": false
},
{
"id": "-64FWEIiVOod7eZlO5Ih3",
"type": "text",
"x": 732.7000223795569,
"y": 1195.1894331524754,
"width": 300.99993896484375,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b06",
"roundness": null,
"seed": 546442214,
"version": 592,
"versionNonce": 1639955695,
"isDeleted": false,
"boundElements": [],
"updated": 1754352588885,
"link": null,
"locked": false,
"text": "RunRyujinCore",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "lfnAZEl0qn4p2wIEEtBHT",
"originalText": "RunRyujinCore",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "EAmXZQ7k4jiOLlYAEL1J6",
"type": "rectangle",
"x": 1507.1998697916663,
"y": 1299.0334633986135,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b07",
"roundness": {
"type": 3
},
"seed": 1425386470,
"version": 771,
"versionNonce": 722448314,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "Jp_WR9fZiu_YyZS-mCTgO"
},
{
"id": "hz-HJf3RwYUZXwEz1CeOh",
"type": "arrow"
},
{
"id": "4epI_u9iCsMfBe3Z8FRoK",
"type": "arrow"
}
],
"updated": 1754350519478,
"link": null,
"locked": false
},
{
"id": "Jp_WR9fZiu_YyZS-mCTgO",
"type": "text",
"x": 1817.9124628702796,
"y": 1499.1896772931009,
"width": 218.57493591308594,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b08",
"roundness": null,
"seed": 1717780262,
"version": 742,
"versionNonce": 161734502,
"isDeleted": false,
"boundElements": [],
"updated": 1754350084512,
"link": null,
"locked": false,
"text": "Ryujin.Run",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "EAmXZQ7k4jiOLlYAEL1J6",
"originalText": "Ryujin.Run",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "krxl8cC9-2r2LE3l-P7Io",
"type": "rectangle",
"x": 1514.5336507161448,
"y": 424.3668170769984,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b09",
"roundness": {
"type": 3
},
"seed": 947027174,
"version": 889,
"versionNonce": 401797286,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "6ASEHm_fgs4N4Mupxdwjr"
},
{
"id": "rC5HsZq1bXGKLR8AH18yl",
"type": "arrow"
},
{
"id": "8kG-RVEs0USrSMxSB4Uff",
"type": "arrow"
},
{
"id": "BtdK5LjFBHsBhQRt8f8EE",
"type": "arrow"
}
],
"updated": 1754350194955,
"link": null,
"locked": false
},
{
"id": "6ASEHm_fgs4N4Mupxdwjr",
"type": "text",
"x": 1801.1400044759105,
"y": 624.5230309714857,
"width": 266.78741455078125,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0A",
"roundness": null,
"seed": 1142812710,
"version": 861,
"versionNonce": 276566054,
"isDeleted": false,
"boundElements": [],
"updated": 1754350177413,
"link": null,
"locked": false,
"text": "Ryujin.Ryujin",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "krxl8cC9-2r2LE3l-P7Io",
"originalText": "Ryujin.Ryujin",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "lu7uWR5KJautRctyDp_OI",
"type": "rectangle",
"x": 2579.8666992187486,
"y": 106.36678655942114,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0B",
"roundness": {
"type": 3
},
"seed": 2033241530,
"version": 925,
"versionNonce": 1269563302,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "SF1qacpwOwRkvKN2q-IkS"
},
{
"id": "8kG-RVEs0USrSMxSB4Uff",
"type": "arrow"
}
],
"updated": 1754350191880,
"link": null,
"locked": false
},
{
"id": "SF1qacpwOwRkvKN2q-IkS",
"type": "text",
"x": 2589.2731323242174,
"y": 279.1792508264374,
"width": 821.187255859375,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0C",
"roundness": null,
"seed": 2080573050,
"version": 901,
"versionNonce": 454618278,
"isDeleted": false,
"boundElements": [],
"updated": 1754350142692,
"link": null,
"locked": false,
"text": "RyujinUtils::MapPortableExecutableFile\nIntoMemory",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "lu7uWR5KJautRctyDp_OI",
"originalText": "RyujinUtils::MapPortableExecutableFileIntoMemory",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "EuGQdOt9-xnHhhrIRi-BL",
"type": "rectangle",
"x": 2590.5334065755196,
"y": 695.7001300652804,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0D",
"roundness": {
"type": 3
},
"seed": 568486310,
"version": 916,
"versionNonce": 1438613286,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "uK2ebG2uYgaRMioAxMj_H"
},
{
"id": "BtdK5LjFBHsBhQRt8f8EE",
"type": "arrow"
}
],
"updated": 1754350194956,
"link": null,
"locked": false
},
{
"id": "uK2ebG2uYgaRMioAxMj_H",
"type": "text",
"x": 2602.0179646809884,
"y": 868.5125943322967,
"width": 817.031005859375,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0E",
"roundness": null,
"seed": 2054309094,
"version": 892,
"versionNonce": 889068922,
"isDeleted": false,
"boundElements": [],
"updated": 1754350163421,
"link": null,
"locked": false,
"text": "RyujinPdbParsing::ExtractProceduresF\nromPdb",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "EuGQdOt9-xnHhhrIRi-BL",
"originalText": "RyujinPdbParsing::ExtractProceduresFromPdb",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "xVwYLAcWAghQwOVCJNzSb",
"type": "arrow",
"x": 297.20013427734193,
"y": 1210.5333658854158,
"width": 160,
"height": 2.6667277018229925,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0F",
"roundness": {
"type": 2
},
"seed": 522632870,
"version": 28,
"versionNonce": 1268974074,
"isDeleted": false,
"boundElements": [],
"updated": 1754350184742,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
160,
-2.6667277018229925
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "Ssfa2elKzA_vFWbWlc5ts",
"focus": 0.02193852251346144,
"gap": 8.66652425130053
},
"endBinding": {
"elementId": "lfnAZEl0qn4p2wIEEtBHT",
"focus": 0.09282171918421768,
"gap": 5.999796549480493
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "rC5HsZq1bXGKLR8AH18yl",
"type": "arrow",
"x": 1299.2002563476547,
"y": 1160.5333658854158,
"width": 202.6666259765625,
"height": 512.0000203450521,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0G",
"roundness": {
"type": 2
},
"seed": 1584564858,
"version": 39,
"versionNonce": 34212410,
"isDeleted": false,
"boundElements": [],
"updated": 1754350189629,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
202.6666259765625,
-512.0000203450521
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "lfnAZEl0qn4p2wIEEtBHT",
"focus": 0.7674876151926134,
"gap": 3.9997965494803793
},
"endBinding": {
"elementId": "krxl8cC9-2r2LE3l-P7Io",
"focus": 0.8508666208472464,
"gap": 12.66676839192769
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "8kG-RVEs0USrSMxSB4Uff",
"type": "arrow",
"x": 2368.533548990884,
"y": 629.866658528645,
"width": 202.66682942708303,
"height": 240,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0H",
"roundness": {
"type": 2
},
"seed": 1654111354,
"version": 40,
"versionNonce": 1080851558,
"isDeleted": false,
"boundElements": [],
"updated": 1754350191880,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
202.66682942708303,
-240
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "krxl8cC9-2r2LE3l-P7Io",
"focus": 0.6786706019461027,
"gap": 13.999776204426325
},
"endBinding": {
"elementId": "lu7uWR5KJautRctyDp_OI",
"focus": 0.6230525968172602,
"gap": 8.666320800781705
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "BtdK5LjFBHsBhQRt8f8EE",
"type": "arrow",
"x": 2368.533548990884,
"y": 728.5333455403637,
"width": 213.33333333333303,
"height": 90.66670735677087,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0I",
"roundness": {
"type": 2
},
"seed": 734055974,
"version": 35,
"versionNonce": 182053862,
"isDeleted": false,
"boundElements": [],
"updated": 1754350194956,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
213.33333333333303,
90.66670735677087
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "krxl8cC9-2r2LE3l-P7Io",
"focus": -0.2654764290516587,
"gap": 13.999776204426325
},
"endBinding": {
"elementId": "EuGQdOt9-xnHhhrIRi-BL",
"focus": -0.19256976951014304,
"gap": 8.66652425130269
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "hz-HJf3RwYUZXwEz1CeOh",
"type": "arrow",
"x": 1304.5335083007797,
"y": 1275.200215657551,
"width": 194.666748046875,
"height": 191.99981689453125,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0J",
"roundness": {
"type": 2
},
"seed": 736617210,
"version": 42,
"versionNonce": 1188389158,
"isDeleted": false,
"boundElements": [],
"updated": 1754350199150,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
194.666748046875,
191.99981689453125
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "lfnAZEl0qn4p2wIEEtBHT",
"focus": -0.5654794951347429,
"gap": 1.3334554036446207
},
"endBinding": {
"elementId": "EAmXZQ7k4jiOLlYAEL1J6",
"focus": -0.5653368690826771,
"gap": 7.999613444011629
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "y_K_f70hTPJQI5D6nHSOf",
"type": "rectangle",
"x": 2596.5335693359348,
"y": 1303.033453226088,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0K",
"roundness": {
"type": 3
},
"seed": 744769530,
"version": 881,
"versionNonce": 54316346,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "7Ged52jWougTLTEUuKmyf"
},
{
"id": "4epI_u9iCsMfBe3Z8FRoK",
"type": "arrow"
},
{
"id": "fLtwofW8vRnu8L95Igo6o",
"type": "arrow"
}
],
"updated": 1754350565957,
"link": null,
"locked": false
},
{
"id": "7Ged52jWougTLTEUuKmyf",
"type": "text",
"x": 2663.099334716794,
"y": 1475.8459174931045,
"width": 706.8685913085938,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0L",
"roundness": null,
"seed": 1733114042,
"version": 900,
"versionNonce": 482007270,
"isDeleted": false,
"boundElements": [],
"updated": 1754350511132,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Organize Candidate\nProcedures",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "y_K_f70hTPJQI5D6nHSOf",
"originalText": "Ryujin.Run -> Organize Candidate Procedures",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "4epI_u9iCsMfBe3Z8FRoK",
"type": "arrow",
"x": 2344.533508300779,
"y": 1506.5333251953118,
"width": 242.6666259765625,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0M",
"roundness": {
"type": 2
},
"seed": 1677979962,
"version": 59,
"versionNonce": 330672250,
"isDeleted": false,
"boundElements": [],
"updated": 1754350519479,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
242.6666259765625,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "EAmXZQ7k4jiOLlYAEL1J6",
"focus": -0.08791254915225401,
"gap": 2.666483561200039
},
"endBinding": {
"elementId": "y_K_f70hTPJQI5D6nHSOf",
"focus": 0.10549492483948497,
"gap": 9.333435058593295
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "7Ih2mjiKRKCOMY060nVKO",
"type": "rectangle",
"x": 3605.200358072915,
"y": 1313.0334023634578,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0N",
"roundness": {
"type": 3
},
"seed": 1355273530,
"version": 932,
"versionNonce": 1203647994,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "E29k8RvrfmeXm7fr2GXJH"
},
{
"id": "fLtwofW8vRnu8L95Igo6o",
"type": "arrow"
},
{
"id": "n8o0JYogmnMtbVP3D1otE",
"type": "arrow"
}
],
"updated": 1754350673145,
"link": null,
"locked": false
},
{
"id": "E29k8RvrfmeXm7fr2GXJH",
"type": "text",
"x": 3665.291147867837,
"y": 1485.8458666304741,
"width": 719.8185424804688,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0O",
"roundness": null,
"seed": 1783438842,
"version": 974,
"versionNonce": 1607390330,
"isDeleted": false,
"boundElements": [],
"updated": 1754350554569,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Create Basic\nBlocks(RyujinBasicBlockerBuilder)",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "7Ih2mjiKRKCOMY060nVKO",
"originalText": "Ryujin.Run -> Create Basic Blocks(RyujinBasicBlockerBuilder)",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "fLtwofW8vRnu8L95Igo6o",
"type": "arrow",
"x": 3438.5335489908834,
"y": 1511.1999715169263,
"width": 162.6666259765625,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0P",
"roundness": {
"type": 2
},
"seed": 65764858,
"version": 61,
"versionNonce": 1935873530,
"isDeleted": false,
"boundElements": [],
"updated": 1754350565957,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
162.6666259765625,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "y_K_f70hTPJQI5D6nHSOf",
"focus": -0.0849821904663902,
"gap": 1.9998575846361746
},
"endBinding": {
"elementId": "7Ih2mjiKRKCOMY060nVKO",
"focus": 0.12893801789844297,
"gap": 4.000183105469205
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "g88acw1VMX-CANdbs2_T7",
"type": "rectangle",
"x": 4596.533162434893,
"y": 1310.3667763868953,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0Q",
"roundness": {
"type": 3
},
"seed": 629183162,
"version": 1049,
"versionNonce": 1940843297,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "3ieAUsaRmVgZFI0ZhtjgE"
},
{
"id": "n8o0JYogmnMtbVP3D1otE",
"type": "arrow"
},
{
"id": "Q8VHLrz6AShIS2x8zxQ5V",
"type": "arrow"
},
{
"id": "W9vU_pl4_fcHpWr4KCRQX",
"type": "arrow"
},
{
"id": "gCkcH674oB1THXrzQnbWk",
"type": "arrow"
}
],
"updated": 1754352923057,
"link": null,
"locked": false
},
{
"id": "3ieAUsaRmVgZFI0ZhtjgE",
"type": "text",
"x": 4636.892659505205,
"y": 1455.8354910264404,
"width": 759.2811279296875,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0R",
"roundness": null,
"seed": 1947347834,
"version": 1199,
"versionNonce": 1917640486,
"isDeleted": false,
"boundElements": [],
"updated": 1754350665895,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Instantiate\nRyujinObfuscationCore and Call Run\nfor every candidate procedures",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "g88acw1VMX-CANdbs2_T7",
"originalText": "Ryujin.Run -> Instantiate RyujinObfuscationCore and Call Run for every candidate procedures",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "n8o0JYogmnMtbVP3D1otE",
"type": "arrow",
"x": 4451.2001749674455,
"y": 1527.2000325520826,
"width": 133.33333333333394,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0S",
"roundness": {
"type": 2
},
"seed": 1347407270,
"version": 38,
"versionNonce": 490301114,
"isDeleted": false,
"boundElements": [],
"updated": 1754350673146,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
133.33333333333394,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "7Ih2mjiKRKCOMY060nVKO",
"focus": -0.05860806800545369,
"gap": 5.9996948242178405
},
"endBinding": {
"elementId": "g88acw1VMX-CANdbs2_T7",
"focus": 0.04688663326199245,
"gap": 11.99965413411337
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "XpCuSWwyC_0QVfThkNlUT",
"type": "rectangle",
"x": 5598.533487955727,
"y": 1308.3666543165825,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0T",
"roundness": {
"type": 3
},
"seed": 1776634746,
"version": 1120,
"versionNonce": 680535418,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "qUNoUUy18WcA0qZie8qqS"
},
{
"id": "Q8VHLrz6AShIS2x8zxQ5V",
"type": "arrow"
},
{
"id": "W9vU_pl4_fcHpWr4KCRQX",
"type": "arrow"
},
{
"id": "HEQm7MlaAZTEO4qyoIXXL",
"type": "arrow"
},
{
"id": "yKIhJS3VGK9hnERhJBUhd",
"type": "arrow"
},
{
"id": "9X6Cr0U4JQTRfrKAWEdZ3",
"type": "arrow"
},
{
"id": "0rJxCb7-vMyv0zh5rahKX",
"type": "arrow"
},
{
"id": "SzoFQvZGoLldUKOi2HRNR",
"type": "arrow"
},
{
"id": "i3Y0ZtQB5FcokqgoXwj94",
"type": "arrow"
},
{
"id": "Sbyjo9nCcokEFRgSo4jck",
"type": "arrow"
}
],
"updated": 1754351988861,
"link": null,
"locked": false
},
{
"id": "qUNoUUy18WcA0qZie8qqS",
"type": "text",
"x": 5638.892985026039,
"y": 1453.8353689561277,
"width": 759.2811279296875,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0U",
"roundness": null,
"seed": 1692519482,
"version": 1265,
"versionNonce": 86748026,
"isDeleted": false,
"boundElements": [],
"updated": 1754350692419,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Instantiate\nRyujinObfuscationCore and Call Run\nfor every candidate procedures",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "XpCuSWwyC_0QVfThkNlUT",
"originalText": "Ryujin.Run -> Instantiate RyujinObfuscationCore and Call Run for every candidate procedures",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "Q8VHLrz6AShIS2x8zxQ5V",
"type": "arrow",
"x": 5442.5335896809875,
"y": 1527.8666890462234,
"width": 149.33329264322947,
"height": 2.6666259765625,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0V",
"roundness": {
"type": 2
},
"seed": 1297928102,
"version": 64,
"versionNonce": 1343927930,
"isDeleted": false,
"boundElements": [],
"updated": 1754350716097,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
149.33329264322947,
2.6666259765625
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "g88acw1VMX-CANdbs2_T7",
"focus": -0.07492381842031048,
"gap": 6.0003051757821595
},
"endBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.00972609386903443,
"gap": 6.66660563150981
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "W9vU_pl4_fcHpWr4KCRQX",
"type": "arrow",
"x": 5597.200134277342,
"y": 1602.5334370930984,
"width": 146.66666666666697,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0W",
"roundness": {
"type": 2
},
"seed": 98452262,
"version": 71,
"versionNonce": 616330086,
"isDeleted": false,
"boundElements": [],
"updated": 1754350761050,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-146.66666666666697,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.2930410107433823,
"gap": 1.3333536783848103
},
"endBinding": {
"elementId": "g88acw1VMX-CANdbs2_T7",
"focus": 0.2842492639696761,
"gap": 14.00018310546966
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "5alnqV8UhDeJaHM0FWi7C",
"type": "rectangle",
"x": 4598.533487955726,
"y": 1911.7000385125466,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0X",
"roundness": {
"type": 3
},
"seed": 2007361146,
"version": 1099,
"versionNonce": 1215649505,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "7r_elLYbBO0mfjvzyj_Kk"
},
{
"id": "87oIxOxik3Q3gNqirekoF",
"type": "arrow"
},
{
"id": "l-NDD1MCjDJGlLUbeqmKy",
"type": "arrow"
},
{
"id": "gCkcH674oB1THXrzQnbWk",
"type": "arrow"
}
],
"updated": 1754352923057,
"link": null,
"locked": false
},
{
"id": "7r_elLYbBO0mfjvzyj_Kk",
"type": "text",
"x": 4742.73362223307,
"y": 2057.168753152092,
"width": 551.599853515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0Y",
"roundness": null,
"seed": 1171719994,
"version": 1254,
"versionNonce": 79526522,
"isDeleted": false,
"boundElements": [],
"updated": 1754350816335,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Instantiate\nRyujinPESections and Call\nAddNewSection",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "5alnqV8UhDeJaHM0FWi7C",
"originalText": "Ryujin.Run -> Instantiate RyujinPESections and Call AddNewSection",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "WTJNiy4a8eC7BruAeb4W4",
"type": "rectangle",
"x": 5125.866861979166,
"y": 2495.0334227085095,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0b",
"roundness": {
"type": 3
},
"seed": 766413926,
"version": 1225,
"versionNonce": 178692666,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "dq0XZGEVRHG8scBl9pDeR"
},
{
"id": "l-NDD1MCjDJGlLUbeqmKy",
"type": "arrow"
},
{
"id": "lBPriYap6uE4SOaUQHCBY",
"type": "arrow"
}
],
"updated": 1754350958117,
"link": null,
"locked": false
},
{
"id": "dq0XZGEVRHG8scBl9pDeR",
"type": "text",
"x": 5146.495157877604,
"y": 2667.845886975526,
"width": 798.7435302734375,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0c",
"roundness": null,
"seed": 1714163622,
"version": 1428,
"versionNonce": 1881417830,
"isDeleted": false,
"boundElements": [],
"updated": 1754350920957,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Insert the RyujinMiniVm\nEntry",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "WTJNiy4a8eC7BruAeb4W4",
"originalText": "Ryujin.Run -> Insert the RyujinMiniVm Entry",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "Hcqq8CGrvqtZI5tb572D0",
"type": "rectangle",
"x": 4619.199991861978,
"y": 3191.033483743666,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0d",
"roundness": {
"type": 3
},
"seed": 1781048122,
"version": 1248,
"versionNonce": 1718109882,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "BRJkLA_4LZ-Ba2L3oiRup"
},
{
"id": "87oIxOxik3Q3gNqirekoF",
"type": "arrow"
},
{
"id": "lBPriYap6uE4SOaUQHCBY",
"type": "arrow"
},
{
"id": "XoBHOKCmCPXBLm3EzF7OO",
"type": "arrow"
},
{
"id": "QaOOjNOTDfhccwHICmiAR",
"type": "arrow"
}
],
"updated": 1754351056216,
"link": null,
"locked": false
},
{
"id": "BRJkLA_4LZ-Ba2L3oiRup",
"type": "text",
"x": 4643.284525553384,
"y": 3336.502198383211,
"width": 791.8310546875,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0e",
"roundness": null,
"seed": 2053385210,
"version": 1493,
"versionNonce": 1967811130,
"isDeleted": false,
"boundElements": [],
"updated": 1754350995315,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Fix relocations and\nredirect each procedure candidate to\nthe new section for execution",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "Hcqq8CGrvqtZI5tb572D0",
"originalText": "Ryujin.Run -> Fix relocations and redirect each procedure candidate to the new section for execution",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "87oIxOxik3Q3gNqirekoF",
"type": "arrow",
"x": 4833.86680094401,
"y": 2375.866719563802,
"width": 2.6666259765625,
"height": 797.3332722981768,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0f",
"roundness": {
"type": 2
},
"seed": 1915758822,
"version": 94,
"versionNonce": 1598039162,
"isDeleted": false,
"boundElements": [],
"updated": 1754350943425,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
2.6666259765625,
797.3332722981768
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "5alnqV8UhDeJaHM0FWi7C",
"focus": 0.4407687481674317,
"gap": 9.166754007338568
},
"endBinding": {
"elementId": "Hcqq8CGrvqtZI5tb572D0",
"focus": -0.4797169036513933,
"gap": 17.833491881687223
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "l-NDD1MCjDJGlLUbeqmKy",
"type": "arrow",
"x": 5316.533426920572,
"y": 2370.533365885416,
"width": 2.66682942708303,
"height": 112.00002034505269,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0g",
"roundness": {
"type": 2
},
"seed": 1806761658,
"version": 42,
"versionNonce": 213332326,
"isDeleted": false,
"boundElements": [],
"updated": 1754350949088,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
2.66682942708303,
112.00002034505269
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "5alnqV8UhDeJaHM0FWi7C",
"focus": -0.6875408521565725,
"gap": 3.833400328952848
},
"endBinding": {
"elementId": "WTJNiy4a8eC7BruAeb4W4",
"focus": -0.5193774670405522,
"gap": 12.500036478040784
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "lBPriYap6uE4SOaUQHCBY",
"type": "arrow",
"x": 5327.200134277343,
"y": 2954.53330485026,
"width": 2.6666259765625,
"height": 221.33341471354197,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0h",
"roundness": {
"type": 2
},
"seed": 548119334,
"version": 64,
"versionNonce": 2026523386,
"isDeleted": false,
"boundElements": [],
"updated": 1754350958117,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
2.6666259765625,
221.33341471354197
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "WTJNiy4a8eC7BruAeb4W4",
"focus": 0.5238714352987286,
"gap": 4.499955097833663
},
"endBinding": {
"elementId": "Hcqq8CGrvqtZI5tb572D0",
"focus": 0.6944923013129334,
"gap": 15.166764179864003
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "UCSjLr0SKGn8L3eWKmE-k",
"type": "rectangle",
"x": 5179.19999186198,
"y": 3805.0334227085095,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0i",
"roundness": {
"type": 3
},
"seed": 1039043430,
"version": 1301,
"versionNonce": 1236983654,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "TZd1kaMf_fo7njvbQUkfi"
},
{
"id": "XoBHOKCmCPXBLm3EzF7OO",
"type": "arrow"
}
],
"updated": 1754351048882,
"link": null,
"locked": false
},
{
"id": "TZd1kaMf_fo7njvbQUkfi",
"type": "text",
"x": 5235.834513346355,
"y": 3977.845886975526,
"width": 726.7310791015625,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0j",
"roundness": null,
"seed": 202649254,
"version": 1592,
"versionNonce": 494746790,
"isDeleted": false,
"boundElements": [],
"updated": 1754351026975,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Encrypt Obfuscated\ncode using TeaDelKew",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "UCSjLr0SKGn8L3eWKmE-k",
"originalText": "Ryujin.Run -> Encrypt Obfuscated code using TeaDelKew",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "VGZKx_80tzHvN_keSolTK",
"type": "rectangle",
"x": 4608.533487955727,
"y": 4422.366796731949,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0k",
"roundness": {
"type": 3
},
"seed": 1738455462,
"version": 1408,
"versionNonce": 336346362,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "nrTuf7C9n3R7CagL39bLU"
},
{
"id": "QaOOjNOTDfhccwHICmiAR",
"type": "arrow"
},
{
"id": "0tJK6M3xmuq88zRzv0BGH",
"type": "arrow"
}
],
"updated": 1754351120894,
"link": null,
"locked": false
},
{
"id": "nrTuf7C9n3R7CagL39bLU",
"type": "text",
"x": 4665.168009440102,
"y": 4595.179260998965,
"width": 726.7310791015625,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0l",
"roundness": null,
"seed": 1680119014,
"version": 1698,
"versionNonce": 210270438,
"isDeleted": false,
"boundElements": [],
"updated": 1754351035484,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Encrypt Obfuscated\ncode using TeaDelKew",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "VGZKx_80tzHvN_keSolTK",
"originalText": "Ryujin.Run -> Encrypt Obfuscated code using TeaDelKew",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "XoBHOKCmCPXBLm3EzF7OO",
"type": "arrow",
"x": 5337.866841634113,
"y": 3655.200012207032,
"width": 2.6666259765625,
"height": 149.33329264322902,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0m",
"roundness": {
"type": 2
},
"seed": 339736422,
"version": 59,
"versionNonce": 1624003622,
"isDeleted": false,
"boundElements": [],
"updated": 1754351048882,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-2.6666259765625,
149.33329264322902
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "Hcqq8CGrvqtZI5tb572D0",
"focus": -0.7142647944995172,
"gap": 9.166601419449762
},
"endBinding": {
"elementId": "UCSjLr0SKGn8L3eWKmE-k",
"focus": -0.6321502291841233,
"gap": 1
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "QaOOjNOTDfhccwHICmiAR",
"type": "arrow",
"x": 4815.200215657551,
"y": 3656.533325195313,
"width": 2.6666259765625,
"height": 749.3333943684897,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0n",
"roundness": {
"type": 2
},
"seed": 2146090470,
"version": 94,
"versionNonce": 635658106,
"isDeleted": false,
"boundElements": [],
"updated": 1754351056216,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-2.6666259765625,
749.3333943684897
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "Hcqq8CGrvqtZI5tb572D0",
"focus": 0.5302940934258933,
"gap": 10.499914407730557
},
"endBinding": {
"elementId": "VGZKx_80tzHvN_keSolTK",
"focus": -0.5153595453792846,
"gap": 16.500077168146163
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "st652fxjybi7jvrNgjOpg",
"type": "rectangle",
"x": 3529.8666992187486,
"y": 4427.699946959814,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0o",
"roundness": {
"type": 3
},
"seed": 1284044134,
"version": 1497,
"versionNonce": 393608641,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "vbubx0bbBE6ECyH02dXsD"
},
{
"id": "0tJK6M3xmuq88zRzv0BGH",
"type": "arrow"
},
{
"id": "V2Dq4Ydd58EqKkugJNBMn",
"type": "arrow"
}
],
"updated": 1754353674780,
"link": null,
"locked": false
},
{
"id": "vbubx0bbBE6ECyH02dXsD",
"type": "text",
"x": 3553.7980957031236,
"y": 4600.51241122683,
"width": 792.1373291015625,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0p",
"roundness": null,
"seed": 1875990694,
"version": 1825,
"versionNonce": 1059910970,
"isDeleted": false,
"boundElements": [],
"updated": 1754351113258,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Process PE File Header\nadjustments",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "st652fxjybi7jvrNgjOpg",
"originalText": "Ryujin.Run -> Process PE File Header adjustments",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "0tJK6M3xmuq88zRzv0BGH",
"type": "arrow",
"x": 4613.866800944008,
"y": 4641.866678873699,
"width": 234.66654459635356,
"height": 2.6666259765625,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0q",
"roundness": {
"type": 2
},
"seed": 222850746,
"version": 37,
"versionNonce": 1613663674,
"isDeleted": false,
"boundElements": [],
"updated": 1754351120894,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-234.66654459635356,
-2.6666259765625
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "VGZKx_80tzHvN_keSolTK",
"focus": 0.014155902995534531,
"gap": 5.33331298828125
},
"endBinding": {
"elementId": "st652fxjybi7jvrNgjOpg",
"focus": -0.08988823264437942,
"gap": 9.33343505859284
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "fh663zfAhcEi3vDpFzYoH",
"type": "rectangle",
"x": 2532.5333251953107,
"y": 4427.700150410335,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0r",
"roundness": {
"type": 3
},
"seed": 2088833702,
"version": 1566,
"versionNonce": 1414545793,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "bIksq7pEM4kC-jJ_uZON6"
},
{
"id": "hrxA17zhdM64zKm5XQFpL",
"type": "arrow"
},
{
"id": "V2Dq4Ydd58EqKkugJNBMn",
"type": "arrow"
}
],
"updated": 1754353674780,
"link": null,
"locked": false
},
{
"id": "bIksq7pEM4kC-jJ_uZON6",
"type": "text",
"x": 2579.8928833007794,
"y": 4600.512614677351,
"width": 745.281005859375,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0s",
"roundness": null,
"seed": 1028902374,
"version": 1960,
"versionNonce": 1066092410,
"isDeleted": false,
"boundElements": [],
"updated": 1754351181066,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Call FinishNewSection\nand save output PE File on Disk",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "fh663zfAhcEi3vDpFzYoH",
"originalText": "Ryujin.Run -> Call FinishNewSection and save output PE File on Disk",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "hrRz2uniKQbqF8621vM_M",
"type": "rectangle",
"x": 2540.5334065755187,
"y": 3721.3666848341627,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0t",
"roundness": {
"type": 3
},
"seed": 2104932986,
"version": 1627,
"versionNonce": 365291494,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "LiNeTmGSa_VNMFDiQoayi"
},
{
"id": "hrxA17zhdM64zKm5XQFpL",
"type": "arrow"
}
],
"updated": 1754351218028,
"link": null,
"locked": false
},
{
"id": "LiNeTmGSa_VNMFDiQoayi",
"type": "text",
"x": 2608.586690266925,
"y": 3894.179149101179,
"width": 703.8935546875,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0u",
"roundness": null,
"seed": 40721210,
"version": 2059,
"versionNonce": 2117251706,
"isDeleted": false,
"boundElements": [],
"updated": 1754351212484,
"link": null,
"locked": false,
"text": "Ryujin.Run -> Execute cleanup an\nContext Clean",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "hrRz2uniKQbqF8621vM_M",
"originalText": "Ryujin.Run -> Execute cleanup an Context Clean",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "hrxA17zhdM64zKm5XQFpL",
"type": "arrow",
"x": 2936.533528645831,
"y": 4416.86698404948,
"width": 0,
"height": 228.00033569335938,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0v",
"roundness": {
"type": 2
},
"seed": 537072998,
"version": 31,
"versionNonce": 799960230,
"isDeleted": false,
"boundElements": [],
"updated": 1754351218028,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
0,
-228.00033569335938
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "fh663zfAhcEi3vDpFzYoH",
"focus": -0.03809489347501755,
"gap": 10.833166360854193
},
"endBinding": {
"elementId": "hrRz2uniKQbqF8621vM_M",
"focus": 0.0571427035169747,
"gap": 12.500036478041693
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "NoDZOyX1zT-3f6casa9Ys",
"type": "rectangle",
"x": 5603.421895345051,
"y": -224.7445958190491,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0w",
"roundness": {
"type": 3
},
"seed": 983647546,
"version": 1342,
"versionNonce": 1862031738,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "QhKWYGIpILHIDMGEVP8-e"
},
{
"id": "HEQm7MlaAZTEO4qyoIXXL",
"type": "arrow"
}
],
"updated": 1754351784995,
"link": null,
"locked": false
},
{
"id": "QhKWYGIpILHIDMGEVP8-e",
"type": "text",
"x": 5663.337636311848,
"y": -51.932131552032786,
"width": 720.1686401367188,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0x",
"roundness": null,
"seed": 930647546,
"version": 1526,
"versionNonce": 1555502927,
"isDeleted": false,
"boundElements": [],
"updated": 1754353027386,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run ->\naddPaddingSpaces on Basic Blocs",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "NoDZOyX1zT-3f6casa9Ys",
"originalText": "RyujinObfuscationCore.Run -> addPaddingSpaces on Basic Blocs",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "n44rTqI9-OzIHrlNO1Vgv",
"type": "rectangle",
"x": 6586.533365885414,
"y": 1310.7001300652819,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0y",
"roundness": {
"type": 3
},
"seed": 1218605606,
"version": 1419,
"versionNonce": 172377702,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "OKMVkCz86MCHLxJsX8Lt0"
},
{
"id": "yKIhJS3VGK9hnERhJBUhd",
"type": "arrow"
},
{
"id": "ujYQz4L_fGhCZNhRIBAsH",
"type": "arrow"
},
{
"id": "wypiPJF-xTg9aLvYDpbzn",
"type": "arrow"
}
],
"updated": 1754351691188,
"link": null,
"locked": false
},
{
"id": "OKMVkCz86MCHLxJsX8Lt0",
"type": "text",
"x": 6595.174143473305,
"y": 1483.5125943322982,
"width": 822.7185668945312,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b0z",
"roundness": null,
"seed": 1293761894,
"version": 1621,
"versionNonce": 1374536506,
"isDeleted": false,
"boundElements": [],
"updated": 1754351490161,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Execute\n\"RyujinRunOncePass\" Passes",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "n44rTqI9-OzIHrlNO1Vgv",
"originalText": "RyujinObfuscationCore.Run -> Execute \"RyujinRunOncePass\" Passes",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "HEQm7MlaAZTEO4qyoIXXL",
"type": "arrow",
"x": 6007.06004429412,
"y": 1302.4660068732803,
"width": 2.481874210067872,
"height": 1070.8552021361218,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b10",
"roundness": {
"type": 2
},
"seed": 435549926,
"version": 157,
"versionNonce": 1866187514,
"isDeleted": false,
"boundElements": [],
"updated": 1754351784995,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
2.481874210067872,
-1070.8552021361218
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.028571715062934436,
"gap": 12.166682799654382
},
"endBinding": {
"elementId": "NoDZOyX1zT-3f6casa9Ys",
"focus": 0.03174530052374886,
"gap": 2.8335427443173558
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "M9p7woRMmuma_iEPBY6Hb",
"type": "rectangle",
"x": 7575.86706542968,
"y": 1026.7001402378078,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b13",
"roundness": {
"type": 3
},
"seed": 1444709798,
"version": 1477,
"versionNonce": 1296694118,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "nGLZPvwlcMjuUEMphSJbC"
},
{
"id": "ujYQz4L_fGhCZNhRIBAsH",
"type": "arrow"
}
],
"updated": 1754351688017,
"link": null,
"locked": false
},
{
"id": "nGLZPvwlcMjuUEMphSJbC",
"type": "text",
"x": 7635.301574707024,
"y": 1172.168854877353,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b14",
"roundness": null,
"seed": 1493754086,
"version": 1718,
"versionNonce": 1451248230,
"isDeleted": false,
"boundElements": [],
"updated": 1754351645388,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\ninsertAntiDump and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "M9p7woRMmuma_iEPBY6Hb",
"originalText": "RyujinObfuscationCore.Run -> Call insertAntiDump and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "ra-7gMadpJbnauct65FuC",
"type": "rectangle",
"x": 7586.53356933593,
"y": 1573.3666543165841,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b15",
"roundness": {
"type": 3
},
"seed": 2053384698,
"version": 1521,
"versionNonce": 1678271718,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "nEGX5Rmc58WH2s3u9aIEz"
},
{
"id": "wypiPJF-xTg9aLvYDpbzn",
"type": "arrow"
}
],
"updated": 1754351691188,
"link": null,
"locked": false
},
{
"id": "nEGX5Rmc58WH2s3u9aIEz",
"type": "text",
"x": 7645.968078613274,
"y": 1718.8353689561293,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b16",
"roundness": null,
"seed": 1862326970,
"version": 1765,
"versionNonce": 186490726,
"isDeleted": false,
"boundElements": [],
"updated": 1754351677007,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\ninsertMemoryProtection and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "ra-7gMadpJbnauct65FuC",
"originalText": "RyujinObfuscationCore.Run -> Call insertMemoryProtection and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "yKIhJS3VGK9hnERhJBUhd",
"type": "arrow",
"x": 6435.866787380635,
"y": 1531.5333591037333,
"width": 135.11115180121487,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b17",
"roundness": {
"type": 2
},
"seed": 1469939174,
"version": 46,
"versionNonce": 1846570362,
"isDeleted": false,
"boundElements": [],
"updated": 1754351684417,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
135.11115180121487,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.019047294196109704,
"gap": 2.666822645403954
},
"endBinding": {
"elementId": "n44rTqI9-OzIHrlNO1Vgv",
"focus": 0.029304332098773964,
"gap": 15.55542670356408
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "ujYQz4L_fGhCZNhRIBAsH",
"type": "arrow",
"x": 7433.200161404073,
"y": 1458.6444295247402,
"width": 140.44447157117975,
"height": 197.33330620659717,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b18",
"roundness": {
"type": 2
},
"seed": 983164858,
"version": 32,
"versionNonce": 252637222,
"isDeleted": false,
"boundElements": [],
"updated": 1754351688017,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
140.44447157117975,
-197.33330620659717
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "n44rTqI9-OzIHrlNO1Vgv",
"focus": 0.6359113168645693,
"gap": 6.666673448346046
},
"endBinding": {
"elementId": "M9p7woRMmuma_iEPBY6Hb",
"focus": 0.7168776405297453,
"gap": 2.2224324544276897
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "wypiPJF-xTg9aLvYDpbzn",
"type": "arrow",
"x": 7433.200161404073,
"y": 1487.088914659289,
"width": 138.6667209201387,
"height": 209.77783203125,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b19",
"roundness": {
"type": 2
},
"seed": 1197660646,
"version": 51,
"versionNonce": 196905382,
"isDeleted": false,
"boundElements": [],
"updated": 1754351691188,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
138.6667209201387,
209.77783203125
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "n44rTqI9-OzIHrlNO1Vgv",
"focus": -0.8072705109147938,
"gap": 6.666673448346046
},
"endBinding": {
"elementId": "ra-7gMadpJbnauct65FuC",
"focus": -0.6415374925961456,
"gap": 14.66668701171875
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "pLlr8qQpflc5s1FyfGCSt",
"type": "rectangle",
"x": 4693.644504123254,
"y": -227.07771552933622,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1A",
"roundness": {
"type": 3
},
"seed": 789371750,
"version": 1452,
"versionNonce": 844478886,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "9xs2IgN5vBm_DleLlVYwf"
},
{
"id": "0rJxCb7-vMyv0zh5rahKX",
"type": "arrow"
}
],
"updated": 1754351913408,
"link": null,
"locked": false
},
{
"id": "9xs2IgN5vBm_DleLlVYwf",
"type": "text",
"x": 4753.079013400597,
"y": -81.60900088979096,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1B",
"roundness": null,
"seed": 1692958374,
"version": 1653,
"versionNonce": 25740390,
"isDeleted": false,
"boundElements": [],
"updated": 1754351841391,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\ninsertAntiDebug and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "pLlr8qQpflc5s1FyfGCSt",
"originalText": "RyujinObfuscationCore.Run -> Call insertAntiDebug and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "JW8-ZUprPuh4B5ODZ10pj",
"type": "rectangle",
"x": 6506.977905273432,
"y": -220.8555204338502,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1C",
"roundness": {
"type": 3
},
"seed": 21185702,
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
"version": 1516,
"versionNonce": 387408921,
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "w5L4zCiPRb7-8rvxZRw9A"
},
{
"id": "SzoFQvZGoLldUKOi2HRNR",
"type": "arrow"
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
},
{
"id": "wNIZl3AoBKAJoREqi0NUe",
"type": "arrow"
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
}
],
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
"updated": 1756475632472,
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
"link": null,
"locked": false
},
{
"id": "w5L4zCiPRb7-8rvxZRw9A",
"type": "text",
"x": 6566.412414550776,
"y": -75.38680579430493,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1D",
"roundness": null,
"seed": 251641830,
"version": 1718,
"versionNonce": 1408479226,
"isDeleted": false,
"boundElements": [],
"updated": 1754351869841,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\ninsertVirtualization and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "JW8-ZUprPuh4B5ODZ10pj",
"originalText": "RyujinObfuscationCore.Run -> Call insertVirtualization and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "AtUUx9Stz4mYmaUNwAv0D",
"type": "rectangle",
"x": 4662.088989257804,
"y": 501.3667017883722,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1E",
"roundness": {
"type": 3
},
"seed": 342385062,
"version": 1525,
"versionNonce": 1261975782,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "4QEqhnl_iifJdV7lV7Zuy"
},
{
"id": "9X6Cr0U4JQTRfrKAWEdZ3",
"type": "arrow"
}
],
"updated": 1754351908277,
"link": null,
"locked": false
},
{
"id": "4QEqhnl_iifJdV7lV7Zuy",
"type": "text",
"x": 4721.523498535148,
"y": 646.8354164279175,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1F",
"roundness": null,
"seed": 427375846,
"version": 1729,
"versionNonce": 1151890106,
"isDeleted": false,
"boundElements": [],
"updated": 1754351898073,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\nobfuscateIat and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "AtUUx9Stz4mYmaUNwAv0D",
"originalText": "RyujinObfuscationCore.Run -> Call obfuscateIat and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "9X6Cr0U4JQTRfrKAWEdZ3",
"type": "arrow",
"x": 5604.755744086364,
"y": 1310.200080023872,
"width": 218.6667209201387,
"height": 334.22227647569434,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1G",
"roundness": {
"type": 2
},
"seed": 1077474554,
"version": 46,
"versionNonce": 1901518246,
"isDeleted": false,
"boundElements": [],
"updated": 1754351908276,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-218.6667209201387,
-334.22227647569434
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.4678517558264816,
"gap": 5.787055867653048
},
"endBinding": {
"elementId": "AtUUx9Stz4mYmaUNwAv0D",
"focus": -0.2502028654708487,
"gap": 19.61117471588875
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "0rJxCb7-vMyv0zh5rahKX",
"type": "arrow",
"x": 5780.7557712131,
"y": 1304.8666924370666,
"width": 264.888916015625,
"height": 1057.7778116861978,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1H",
"roundness": {
"type": 2
},
"seed": 973059942,
"version": 85,
"versionNonce": 1480947302,
"isDeleted": false,
"boundElements": [],
"updated": 1754351913408,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-264.888916015625,
-1057.7778116861978
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.3772364940585822,
"gap": 3.499961879515922
},
"endBinding": {
"elementId": "pLlr8qQpflc5s1FyfGCSt",
"focus": -0.7137797477511632,
"gap": 20.539256595363785
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "SzoFQvZGoLldUKOi2HRNR",
"type": "arrow",
"x": 6029.644660101989,
"y": 1295.9778035481777,
"width": 472.8888617621524,
"height": 1109.3333604600693,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1I",
"roundness": {
"type": 2
},
"seed": 717490214,
"version": 37,
"versionNonce": 329365798,
"isDeleted": false,
"boundElements": [],
"updated": 1754351917485,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
472.8888617621524,
-1109.3333604600693
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": -0.17631110809488915,
"gap": 12.388850768404836
},
"endBinding": {
"elementId": "JW8-ZUprPuh4B5ODZ10pj",
"focus": 0.672587366484056,
"gap": 4.444383409290822
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "udXdsfhWsew1nDO1gkWGA",
"type": "rectangle",
"x": 6514.97785101996,
"y": 324.92227090729574,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1J",
"roundness": {
"type": 3
},
"seed": 2062577658,
"version": 1577,
"versionNonce": 1880088506,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "jRS9nSdk73PPP8H4000rD"
},
{
"id": "i3Y0ZtQB5FcokqgoXwj94",
"type": "arrow"
}
],
"updated": 1754351942923,
"link": null,
"locked": false
},
{
"id": "jRS9nSdk73PPP8H4000rD",
"type": "text",
"x": 6574.412360297304,
"y": 470.39098554684097,
"width": 721.131103515625,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1K",
"roundness": null,
"seed": 1645502650,
"version": 1781,
"versionNonce": 2130134118,
"isDeleted": false,
"boundElements": [],
"updated": 1754351936435,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call\ninsertJunkCode and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "udXdsfhWsew1nDO1gkWGA",
"originalText": "RyujinObfuscationCore.Run -> Call insertJunkCode and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "i3Y0ZtQB5FcokqgoXwj94",
"type": "arrow",
"x": 6133.2001614040755,
"y": 1298.2000257703999,
"width": 378.6667209201387,
"height": 798.2222493489583,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1L",
"roundness": {
"type": 2
},
"seed": 163605946,
"version": 43,
"versionNonce": 1244647162,
"isDeleted": false,
"boundElements": [],
"updated": 1754351942923,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
378.6667209201387,
-798.2222493489583
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": 0.0036379021870951386,
"gap": 10.166628546182665
},
"endBinding": {
"elementId": "udXdsfhWsew1nDO1gkWGA",
"focus": 0.8485893665330112,
"gap": 3.1109686957461236
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "-x4F3EEjaey-joQqGAsAz",
"type": "rectangle",
"x": 6522.088989257809,
"y": 816.4777857727472,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1M",
"roundness": {
"type": 3
},
"seed": 2015973818,
"version": 1654,
"versionNonce": 1464635130,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "mMSyDjaM_JJoL-c7hs68q"
},
{
"id": "Sbyjo9nCcokEFRgSo4jck",
"type": "arrow"
}
],
"updated": 1754351988862,
"link": null,
"locked": false
},
{
"id": "mMSyDjaM_JJoL-c7hs68q",
"type": "text",
"x": 6533.682861328121,
"y": 961.9465004122925,
"width": 816.8123779296875,
"height": 164.06249776482622,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1N",
"roundness": null,
"seed": 290130554,
"version": 1898,
"versionNonce": 279359206,
"isDeleted": false,
"boundElements": [],
"updated": 1754351981796,
"link": null,
"locked": false,
"text": "RyujinObfuscationCore.Run -> Call all\nUser Registered Custom Callbacks and\nupdateBasicBlocksContext",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "-x4F3EEjaey-joQqGAsAz",
"originalText": "RyujinObfuscationCore.Run -> Call all User Registered Custom Callbacks and updateBasicBlocksContext",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "Sbyjo9nCcokEFRgSo4jck",
"type": "arrow",
"x": 6252.311218261714,
"y": 1305.311096191407,
"width": 266.66666666666697,
"height": 302.2222222222223,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1O",
"roundness": {
"type": 2
},
"seed": 46706022,
"version": 68,
"versionNonce": 2099340858,
"isDeleted": false,
"boundElements": [],
"updated": 1754351988862,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
266.66666666666697,
-302.2222222222223
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "XpCuSWwyC_0QVfThkNlUT",
"focus": 0.04888770707617019,
"gap": 3.055558125175594
},
"endBinding": {
"elementId": "-x4F3EEjaey-joQqGAsAz",
"focus": 0.7397510142892048,
"gap": 3.1111043294276897
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "W6Dpj04oyKdueAdw8tWwe",
"type": "rectangle",
"x": -216.13330078125455,
"y": -590.9109971788189,
"width": 8888.00048828125,
"height": 5664.000244140625,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1P",
"roundness": {
"type": 3
},
"seed": 639408250,
"version": 130,
"versionNonce": 1933355322,
"isDeleted": false,
"boundElements": [],
"updated": 1754352015232,
"link": null,
"locked": false
},
{
"id": "sgQe_S6nbnvhlNwZipLOJ",
"type": "text",
"x": -149.46663411458894,
"y": -522.9109157986111,
"width": 864.9993236404534,
"height": 134.33344523111975,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1S",
"roundness": null,
"seed": 599860902,
"version": 72,
"versionNonce": 2053898022,
"isDeleted": false,
"boundElements": [],
"updated": 1754352079009,
"link": null,
"locked": false,
"text": "Ryujin Core Flow",
"fontSize": 107.46675618489577,
"fontFamily": 5,
"textAlign": "left",
"verticalAlign": "top",
"containerId": null,
"originalText": "Ryujin Core Flow",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "gCkcH674oB1THXrzQnbWk",
"type": "arrow",
"x": 5002.533487955725,
"y": 1765.0890638563358,
"width": 0,
"height": 135.99995930989598,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1T",
"roundness": {
"type": 2
},
"seed": 626044705,
"version": 63,
"versionNonce": 2076630785,
"isDeleted": false,
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
"boundElements": [],
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
"updated": 1754352923057,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
0,
135.99995930989598
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "g88acw1VMX-CANdbs2_T7",
"focus": 0.03333269876156773,
"gap": 1
},
"endBinding": {
"elementId": "5alnqV8UhDeJaHM0FWi7C",
"focus": -0.038095377880953504,
"gap": 10.611015346314844
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "V2Dq4Ydd58EqKkugJNBMn",
"type": "arrow",
"x": 3527.2000325520794,
"y": 4670.422417534721,
"width": 130.66670735677053,
"height": 0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1U",
"roundness": {
"type": 2
},
"seed": 2071402831,
"version": 22,
"versionNonce": 1179819425,
"isDeleted": false,
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
"boundElements": [],
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
"updated": 1754353674780,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
-130.66670735677053,
0
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "st652fxjybi7jvrNgjOpg",
"focus": -0.06691212964295318,
"gap": 2.6666666666692436
},
"endBinding": {
"elementId": "fh663zfAhcEi3vDpFzYoH",
"focus": 0.06691123535481036,
"gap": 23.99987792968568
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
},
{
"id": "UCO_YWFvFeUdEawUAr7qf",
"type": "rectangle",
"x": 7656.533060709631,
"y": -514.4106453524728,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1V",
"roundness": {
"type": 3
},
"seed": 672034136,
"version": 1585,
"versionNonce": 1452436183,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "5N2R4zT87VIfrQ6W2pmMC"
},
{
"id": "N9yNln9NZ03vMPmKUas5h",
"type": "arrow"
}
],
"updated": 1756475639870,
"link": null,
"locked": false
},
{
"id": "5N2R4zT87VIfrQ6W2pmMC",
"type": "text",
"x": 7661.805063883459,
"y": -341.5981810854565,
"width": 829.4561157226562,
"height": 109.37499850988414,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1W",
"roundness": null,
"seed": 327615064,
"version": 1847,
"versionNonce": 443771480,
"isDeleted": false,
"boundElements": [],
"updated": 1756475541629,
"link": null,
"locked": false,
"text": "VMMiniVM - Using MS HV to Run MiniVM\nStub",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "UCO_YWFvFeUdEawUAr7qf",
"originalText": "VMMiniVM - Using MS HV to Run MiniVM Stub",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "EPUAc7lTyubN-vWTBpL25",
"type": "rectangle",
"x": 7664.53334554036,
"y": 13.589283439844849,
"width": 840.0001220703126,
"height": 454.9999270439167,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1X",
"roundness": {
"type": 3
},
"seed": 1463462232,
"version": 1638,
"versionNonce": 694022617,
"isDeleted": false,
"boundElements": [
{
"type": "text",
"id": "TSBaAxRJhVWkycMRN1eAV"
},
{
"id": "wNIZl3AoBKAJoREqi0NUe",
"type": "arrow"
}
],
"updated": 1756475632472,
"link": null,
"locked": false
},
{
"id": "TSBaAxRJhVWkycMRN1eAV",
"type": "text",
"x": 7731.886586507157,
"y": 213.74549733433219,
"width": 705.2936401367188,
"height": 54.68749925494207,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1Y",
"roundness": null,
"seed": 164347480,
"version": 1881,
"versionNonce": 1485562200,
"isDeleted": false,
"boundElements": [],
"updated": 1756475553505,
"link": null,
"locked": false,
"text": "MiniVM Normal - Only MiniVM Stub",
"fontSize": 43.74999940395365,
"fontFamily": 5,
"textAlign": "center",
"verticalAlign": "middle",
"containerId": "EPUAc7lTyubN-vWTBpL25",
"originalText": "MiniVM Normal - Only MiniVM Stub",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "N9yNln9NZ03vMPmKUas5h",
"type": "arrow",
"x": 7343.199991861976,
"y": -4.244004991321617,
"width": 298.66678873697947,
"height": 250.66665649414062,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1Z",
"roundness": {
"type": 2
},
"seed": 735406936,
"version": 58,
"versionNonce": 1754785529,
"isDeleted": false,
"boundElements": [],
"updated": 1756475641055,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
298.66678873697947,
-250.66665649414062
]
],
"lastCommittedPoint": null,
"startBinding": null,
"endBinding": {
"elementId": "UCO_YWFvFeUdEawUAr7qf",
"focus": 0.5738088771848212,
"gap": 14.66628011067587
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
},
{
"id": "wNIZl3AoBKAJoREqi0NUe",
"type": "arrow",
"x": 7351.200073242184,
"y": 51.75595431857414,
"width": 293.33333333333394,
"height": 232.00002034505223,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 4,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": "b1a",
"roundness": {
"type": 2
},
"seed": 1804740919,
"version": 42,
"versionNonce": 379943161,
"isDeleted": false,
"boundElements": null,
"updated": 1756475632472,
"link": null,
"locked": false,
"points": [
[
0,
0
],
[
293.33333333333394,
232.00002034505223
]
],
"lastCommittedPoint": null,
"startBinding": {
"elementId": "JW8-ZUprPuh4B5ODZ10pj",
"focus": -0.5188834235118901,
"gap": 4.222045898439319
},
"endBinding": {
"elementId": "EPUAc7lTyubN-vWTBpL25",
"focus": -0.698015759957645,
"gap": 19.99993896484193
},
"startArrowhead": null,
"endArrowhead": "arrow",
"elbowed": false
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
}
],
"appState": {
"gridSize": 20,
"gridStep": 5,
"gridModeEnabled": false,
"viewBackgroundColor": "#ffffff",
"lockedMultiSelections": {}
},
"files": {
"a1d850325d9eefc3329c745d4bfcda4d1c9e2267": {
"mimeType": "image/png",
"id": "a1d850325d9eefc3329c745d4bfcda4d1c9e2267",
"dataURL": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAaoAAACxCAIAAAAai25NAAAgAElEQVR4Aey9B3RTV7r3PXetu9675pv33plJZpiE4g6md9ybumy59yKrWdWWe1PvXVav7rYsWzamu1BCCAm4AemZTAik0dyABBKS0KRvhInjUBJy7yTxXe/R8hL77PNo72f/zjl/9j67/c4DfAACAAGAwP+TBH7365d6YLAXS4D+0vnev3+PxkdTajJ/6YyA9AECAIH/pQR+bfkbGnax7GSGBvvL83LnVKLKzTgWm/rfy+uLr268ce7tw2++dn7qs4vXJj+e/uzgu6+89s7J6WtT/70EgV8BBAACi4rAryp/t+98W6nK5zRjuNKSX4ECpjqXqk5nmIpu3fryZ2V3ZPzY1PUf07jrN6+5jva73e6flSxgDBAACCwqAr+q/JXVFNZbipjWglNnXv0VKOgbFURRVqU2q7Qq99mze+fcm89o/NqZV7+8deMZjQEzgABAYLER+B/J3333/dt3v71z7/a9+3efpWDZJXCsMJEuS3sW43+FjTuzBMVpKeCZSM+Y2om3X3tGyzmzG7duvHX+nZ/1E8AYIAAQWCQEfkz+7t2/13Sos+1Y1yO+fv7ldeNwh+qgQ3XMJTvarXrJpTnk0gx3G1/q6j3ad+/+vUfs5w4HDu7Mqo1nthDkTaVPNPglInNKk+rMeXUW3FtvnPjJ9K/duLbQ5t1zbwucJlGfvtqpdhzb/bSmrtvtfvPc2wt/CIQBAgCB/xUEnip/n9+8bnnFqTnqnFzwpn/mi+mGlzplw93qIzvlh7oUh7ssR7onzr55fvLjK7NXPpm50Ds6YHypa+Tdk48XnlyTW6TMZTRjK4XZj5/9hWJQuEi2lcC040US8k9m8fqHZ+ZtPp28cPXmvBq6rYOOmn2Nztf2zhssDFz7fNbtvr8wBggDBAACi5/Ak+Xv3r07lpe6Tr1/emEBdk8MKg52qg/2NhzqVh5znfrgjYVnF4anrl5+vK6USkVV6gtZTQWkyqSFxr9oGJodUm8icJuw6UVhP5nRja++cHu+78049e7EyNl5QXSLD3Tw9zU37G9bmM7759/2PPiJfbh5YTwQBggABBY/gSfL377xwdc/fGuh9+PvjksONysHvVU/1ZHutz76ec09t9udSE2gyNJqzFmFVNjClH/RMCRre40Rx24srFbkP0tG7y0o1527d7oXVPdUe5sFg22cgY7TZ3/QN/L2h97/JGZvTN9/Sqv/WfIFbAACAIFfn8AT5O+Tix+eWtAM9Hg8jYc6uYe7JAedokOd0iNtsz86KOSJZfj2228SS1FMO57fgSupzZi3uTL1GTxh2/zh/zyQnReXmB914dJHc0khCyIqtPns5kJpW8l8hfTu3dvlvOyvvnpyp62qV3/2s7NnL50Tu9QL/flk+lPegVbW3nbBgY479+4sPPX2We9/Fcfe/3ndJgtTAMIAAYDAr0/gCfL3+RczC/1oeamLf6BLfaBTOeSUDbR/MnPp7KVzl2Yv/6zKzq2vv0quSuY04tnNaFp16lz6HV1Gto1QL8ctzO5/GNbbJNU6Uo0e09Ku83g88YUxpeq8Sl2G0E65ffubucQz8SBuC9nhNP3cvJh7m3j9jYwBh/Gg4/Hffv3t17M3ZqyvdDx+CogBCAAEFiGBJ8jfQi/tL3WLhrulA+3CoXbpsENwxCE/5JQdcMgOOhQHnQcmDi80fiRczC98++2Juchbt75CVSQyrfhyVRqxIt7bWpy5Uq7OrzLnX7j4sKb2yM//24fE8oRaI5rTWPTZhfPxOHC1Ecdrxgoaqd98c8vj8WiMXI6tWNxCHh05+oxZfP7l562HezsONrN32YT7Whj72gW7mp7Wwe3xeIZODjxjyoAZQAAg8BsS+DH5e++T96RDnYLhTtmgQzDUJh/qEB3qlB10CocdgkNO8cEe3eGn1nTcbjeen0OuRc2V7datr5IqUaWqbI4dx9LhPR4PhgqvtxeyzQTPk+dOuKemruw/vI/MKUZQMiIJKSHo+I1pcZtSYkPToCh8BqmOtv/w4Bc3Pn+c3dkP3k0rg3FbsfE5oanFCfV2Are5kN+Kn529cuPG5+WyPEEboVie+bTG7yMJDp8YHH9rYl7svvzmy/ZXdvF2Nb5x/t1HLBceth5uWXgIhAECAIFFSOCp8vfl1zfFw07RQIdwsIsz3CEZ7OAfbFcecAgH23VDbSfeOHHz1s17935stHNaWTy7kSCVV3g8nq+/voUqgZY0oFlNOexm/M0vvxC2lnAbcTwNcSEUt9t9/MSxtVmQKFFpvFmAMAqQFinEIISYBVATH2oSQA38Fwk5AaU4iF6AskhgWiZCWb0jH3n2o7ML00kug9dqCjIr4akVCbV2AqcJI2olnBw9Ck/fTJHCRc2E3HLEQvsnht1ud8u+J6uY2+Nue9n5xF/NRd78+sv5V40/YgacAggABH5DAj+QP7fbbR/smhv8IR50SIbaBQMd4kGHaKBdMdghG+iWHOq8eevmM7qbRoCVGwprlZhqJv7evbtJpQl4YTa/Cc1vI6yLWCLsIAk6CCpN/VxqQo1qKyZtDSkjzsoHmfgwswhuEcMsQrhdHGfhIe2icHlNUCVum7Ai3iaJ0/PAFgHYwoMY+QiTBGGRI/X80Bocs0E4lxqmFJVchcphJSeUQpmNeH4zFlOHxNXG81oKuG2YrBIYLH3HT5bi5TPHf9LmRwwA+fsROMApgMBiIPAD+dMPdVqO9Hg8nuZDDtGBdt5AK3ewVTjQeuKdUx9c+bjhUOfCYXE/6T2TV5ZRmcBpw3AayTHJwahyeHpdfK0ul9GIK6yLZbfgWC3Et94509XXuQaTsplfHmcSQu0SiIUPtQigdiHMzIcZueHSighZFUzPg+sF8WZZUAUhuK4oTseFmISxDZxIWT3MJEQ2ChF2IdwihujFG4oygiA78ig5yZXwhFJwUhmcaS/kt6AZFoygDcNvw9eZicnFcWfeGPtx///xyQcLDe7cvTPx4bttR/f0nzh87eYXC08BYYAAQOB/KYHv5a9/7JBq2PnBhbOnz74uOtwm39sh2udgHmofPnO8/+QQe6jl06mPf1Yh79y5jSpGUuSprFYSt6UopQKcVAmvs2F4LRh+C4HbgmM24pchQnyJGISRC2+UQIxcqImXaBPHW0WBJbnxRj5Ez4FY+VC7ENksh1pECLsUahOvY9Lger4vNWdjPRGi5yItIoiRCzHyUI1yiIWHNEk21ZUsT4tFlcCQpfD0ajinpYDbjBE0F3GbC3ittGQaPI0K/8mC9L66f97GOtib36TMN4rT7YrCVmVOkzbbLL599wdjXypblPP2QAAgABD4X0HgofzdvvMtf38Tb7hdNtQlG+7iH2jhDLcJB9okg12cQw7xgfaGoUdn/j5L8UrrsCmVcIoyh9+Mx3ISEiug7BYytwXHshWKOkn1tqJNOFSkWgAxcSAWIdTEg5n4QeUFCSYB3CyANopi7d5qINIiQJnEa8qxS7Gp8QYBxCaGWkUwiwhuE8JtEqhdDLILoXZhgkUSzStbQcraxi1dhUcl0mCxxOgcBrK0IYnbjGW348WtpIQyUBIJ+uWXP11923fy+07tdz85+813g2ZkO1vTmkR5zarcVvXJ938w76WmW/ssTAAbgABAYJEQeCh/r7w1whtsFg53yIccsgGnYn8nZ7hDdKBVPdAmHWznDLWe+fDnTfOYK96tW18m0lEwWkylLp8sy0qsRFSacHWW/DpTHsNWUKHNW1sIiTbLoWY+0iQI4dNfJKaibOIEuwTZJIE2iqDNEoRVGMYtWZKPCiDnBFHzluPSYgxcsFngrQxaxQijEGWVQW1CWKMIaRVDLXyYiv237Pi1mAQwBYygw/GiFFZTQaUunduKp8iy0stRSh3vWdBf/Xz2/v3vp/F+8d0YabfbndsoSLZIMyzK3PYf6N3AmVfHfjgh5FkyAmwAAgCB34rAQ/lTDnbKB9pFQ+3CoSbhcIdwoJN3qEsx1Cn2dn30SoZdbUf6Xj//5t17d93u+/fu33vrw7eOv37sWZx
"created": 1754348623396,
feat: Added source code as a comment to the Ryujin MiniVM Stub Shellcode, update ryujin core diagram - Added the full source code for the Ryujin MiniVM hypervisor feature as a comment to the shellcode stub. - Update Ryujin Core Diagram.
2025-08-29 21:34:34 -03:00
"lastRetrieved": 1756475625021
feat: New HVPass (extension for code obfuscation) + MiniVM code mutation (for HVPass and standard MiniVM); Bug fixes for extracted unused registers (with future XMM support); Bug fixes for junk/mutation overwriting the RAX register unexpectedly; Improvements and added support for fixing relocation offsets in memory mov instructions; articles/projects diagrams and more. - New HVPass feature – This feature allows the code VM to run through Microsoft’s Hypervisor API, adding an extra layer of analysis difficulty. - MiniVM (normal) or MiniVM + HVPass – Now support junk/mutation in the stub, making the logic and instructions randomized at each interaction, further protecting the stub’s code. - Bug fix – Fixed an issue in the extraction of unused registers from candidate procedures, where some registers were not being handled correctly. - Bug fix – Fixed an issue in the extraction of XMM registers to enable junk/mutation support for multimedia registers. - Bug fix – Fixed a problem in the junk/mutation logic for the instructions cdqe and cbw, which were incorrectly overwriting the RAX register, breaking results even when the registers were in use. - Bug fix – Some instructions were not having relocations properly fixed by the RIP-relative relocation algorithm; this has now been corrected. - Articles + Project Diagrams as well. Some of these issues, as well as feature suggestions like HVPass, were discovered or suggested by the reviewers of Ryujin’s article.
2025-08-28 21:20:58 -03:00
}
}
}
Reference in New Issue Copy Permalink