diff --git a/RyujinConsole/RyujinConsole/Ryujin.cc b/RyujinConsole/RyujinConsole/Ryujin.cc index f76a241..f138178 100644 --- a/RyujinConsole/RyujinConsole/Ryujin.cc +++ b/RyujinConsole/RyujinConsole/Ryujin.cc @@ -41,7 +41,7 @@ m_strInputFilePath(strInputFilePath), m_strOutputFilePath(strOutputFilePath), m_ } -bool Ryujin::run() { +bool Ryujin::run(const RyujinObfuscatorConfig& config) { auto imgDos = reinterpret_cast(m_mappedPE.get()); @@ -80,6 +80,42 @@ bool Ryujin::run() { return FALSE; } + if (config.m_strProceduresToObfuscate.size() == 0) { + + ::OutputDebugStringA( + + _In_ "Ryujin::Ryujin: not provided functions to obfuscate.\n" + + ); + + return FALSE; + } + + for (const auto& proc : m_ryujinProcedures) { + + auto it = std::find(config.m_strProceduresToObfuscate.begin(), config.m_strProceduresToObfuscate.end(), proc.name); + + if (it == config.m_strProceduresToObfuscate.end()) continue; + + std::printf("[WORKING ON]: %s\n", proc.name); + + // Is a valid procedure ? + if (proc.size == 0) { + + ::OutputDebugStringA( + + _In_ "Ryujin::Ryujin: The candidate is a ghost function cannot obfuscate this..\n" + + ); + + continue; + } + + //Create basic blocks + + + } + } void Ryujin::listRyujinProcedures() { @@ -87,20 +123,29 @@ void Ryujin::listRyujinProcedures() { if (!m_isInitialized) { ::OutputDebugStringA( - - _In_ "Ryujin::Ryujin: not initilized.\n" - + + _In_ "Ryujin::listRyujinProcedures: not initialized.\n" + ); return; } - for (auto& procedure : m_ryujinProcedures) { + std::printf("=== Ryujin Procedures ===\n"); - std::printf("%s - 0x%llx - 0x%llx\n", procedure.name.c_str(), procedure.address, procedure.size); + for (const auto& procedure : m_ryujinProcedures) { + + std::printf( + "Name: %-30s | Address: 0x%016llx | Size: 0x%llx\n", + procedure.name.c_str(), + procedure.address, + procedure.size + ); } + std::printf("==========================\n"); + } Ryujin::~Ryujin() { diff --git a/RyujinConsole/RyujinConsole/Ryujin.hh b/RyujinConsole/RyujinConsole/Ryujin.hh index f773896..6c15c2e 100644 --- a/RyujinConsole/RyujinConsole/Ryujin.hh +++ b/RyujinConsole/RyujinConsole/Ryujin.hh @@ -6,6 +6,7 @@ #include #include "RyujinPdbParsing.hh" #include "RyujinUtils.hh" +#include "RyujinObfuscatorConfig.hh" class Ryujin { @@ -20,7 +21,7 @@ private: public: Ryujin(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath); - bool run(); + bool run(const RyujinObfuscatorConfig& config); void listRyujinProcedures(); ~Ryujin(); diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.cc b/RyujinConsole/RyujinConsole/RyujinConsole.cc index 033632c..1b7e129 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.cc +++ b/RyujinConsole/RyujinConsole/RyujinConsole.cc @@ -9,7 +9,17 @@ auto main() -> int { ryujin.get()->listRyujinProcedures(); - ryujin.get()->run(); + RyujinObfuscatorConfig config; + config.m_isIgnoreOriginalCodeRemove = FALSE; + config.m_isJunkCode = TRUE; + config.m_isRandomSection = FALSE; + config.m_isVirtualized = FALSE; + std::vector procsToObfuscate{ + "main" + }; + config.m_strProceduresToObfuscate.assign(procsToObfuscate.begin(), procsToObfuscate.end()); + + ryujin.get()->run(config); ryujin.reset(); diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj index d6857fc..0f9fecb 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj @@ -139,6 +139,7 @@ + diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters index 6856148..bb9dbb6 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters @@ -56,5 +56,8 @@ Ryujin\Models + + Ryujin\Models + \ No newline at end of file diff --git a/RyujinConsole/RyujinConsole/RyujinObfuscatorConfig.hh b/RyujinConsole/RyujinConsole/RyujinObfuscatorConfig.hh new file mode 100644 index 0000000..966eb48 --- /dev/null +++ b/RyujinConsole/RyujinConsole/RyujinObfuscatorConfig.hh @@ -0,0 +1,12 @@ + +class RyujinObfuscatorConfig { + +public: + bool m_isRandomSection; // Randomize the name of the new section with the processed code -> Ryujin standard + bool m_isVirtualized; // Virtualize the code [Try as much as possible] + bool m_isJunkCode; // Insert junk code to confuse + bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs) + std::vector m_strProceduresToObfuscate; // Names of the procedures to obfuscate + // todo: passes + +}; \ No newline at end of file