From 3683e8dbbaf6d4142ac8906400d34adcabee57ad Mon Sep 17 00:00:00 2001 From: keowu Date: Tue, 24 Jun 2025 21:23:15 -0300 Subject: [PATCH] feat: Improved project structure, added Ryujin includer header, export definitions, and more. - The Ryujin console can now include the Ryujin core through a dedicated header file. - Exporting is now standardized using a definition file. - The project's compiled output is now placed in a folder named compiled, organized by the desired configuration (Release or Debug). - Some code organization improvements have been made. --- ...RyujinConsole.sln => Ryujin Protector.sln} | 0 RyujinConsole/RyujinConsole/RyujinConsole.cc | 35 ++----------------- .../RyujinConsole/RyujinConsole.vcxproj | 15 ++++++++ .../RyujinConsole.vcxproj.filters | 5 +++ RyujinConsole/RyujinConsole/RyujinCore.hh | 32 +++++++++++++++++ RyujinCore/Ryujin.def | 3 ++ RyujinCore/RyujinCore.vcxproj | 14 ++++++-- RyujinCore/RyujinCore.vcxproj.filters | 14 ++++---- RyujinCore/cpp.hint | 2 -- 9 files changed, 76 insertions(+), 44 deletions(-) rename RyujinConsole/{RyujinConsole.sln => Ryujin Protector.sln} (100%) create mode 100644 RyujinConsole/RyujinConsole/RyujinCore.hh create mode 100644 RyujinCore/Ryujin.def delete mode 100644 RyujinCore/cpp.hint diff --git a/RyujinConsole/RyujinConsole.sln b/RyujinConsole/Ryujin Protector.sln similarity index 100% rename from RyujinConsole/RyujinConsole.sln rename to RyujinConsole/Ryujin Protector.sln diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.cc b/RyujinConsole/RyujinConsole/RyujinConsole.cc index 3083f8f..6d7f947 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.cc +++ b/RyujinConsole/RyujinConsole/RyujinConsole.cc @@ -1,36 +1,5 @@ #include - -// TODO: Fit it in a new class for ryujin -#include -#include -class RyujinObfuscatorConfig { - -public: - bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard - bool m_isVirtualized; // Virtualize the code [Try as much as possible] - bool m_isIatObfuscation; //Process IAT Obfuscation - bool m_isJunkCode; // Insert junk code to confuse - bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs) - bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection - std::vector m_strProceduresToObfuscate; // Names of the procedures to obfuscate - - bool RunRyujin(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config) { - - using tpdRunRyujinCore = BOOL (__stdcall *)(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config); - - auto hModule = LoadLibraryW(L"RyujinCore.dll"); - - if (!hModule) return FALSE; - - auto RunRyujinCore = reinterpret_cast(GetProcAddress(hModule, "?RunRyujinCore@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AEAVRyujinObfuscatorConfig@@@Z")); - - if (!RunRyujinCore) return FALSE; - - return RunRyujinCore(strInputFilePath, strPdbFilePath, strOutputFilePath, config); - } - -}; - +#include "RyujinCore.hh" auto main() -> int { @@ -57,7 +26,7 @@ auto main() -> int { }; config.m_strProceduresToObfuscate.assign(procsToObfuscate.begin(), procsToObfuscate.end()); - auto bSuccess = config.RunRyujin("C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.exe", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.pdb", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.obfuscated.exe", config); + auto bSuccess = config.RunRyujin("C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\compiled\\release\\DemoObfuscation.exe", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\compiled\\release\\DemoObfuscation.pdb", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\compiled\\release\\DemoObfuscation.obfuscated.exe", config); std::printf("Ryujin core returned: %d\n", bSuccess); diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj index 1c4bbba..de83bd9 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj @@ -70,6 +70,18 @@ + + ..\..\compiled\release + + + ..\..\compiled\release + + + ..\..\compiled\release + + + ..\..\compiled\release + Level3 @@ -133,6 +145,9 @@ + + + diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters index 416cbe4..827d87d 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters @@ -19,4 +19,9 @@ Source Files + + + Header Files + + \ No newline at end of file diff --git a/RyujinConsole/RyujinConsole/RyujinCore.hh b/RyujinConsole/RyujinConsole/RyujinCore.hh new file mode 100644 index 0000000..ba70975 --- /dev/null +++ b/RyujinConsole/RyujinConsole/RyujinCore.hh @@ -0,0 +1,32 @@ +#pragma once +#include +#include +#include + +class RyujinObfuscatorConfig { + +public: + bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard + bool m_isVirtualized; // Virtualize the code [Try as much as possible] + bool m_isIatObfuscation; //Process IAT Obfuscation + bool m_isJunkCode; // Insert junk code to confuse + bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs) + bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection + std::vector m_strProceduresToObfuscate; // Names of the procedures to obfuscate + + bool RunRyujin(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config) { + + using tpdRunRyujinCore = BOOL(__stdcall*)(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config); + + auto hModule = LoadLibraryW(L"RyujinCore.dll"); + + if (!hModule) return FALSE; + + auto RunRyujinCore = reinterpret_cast(GetProcAddress(hModule, "RunRyujinCore")); + + if (!RunRyujinCore) return FALSE; + + return RunRyujinCore(strInputFilePath, strPdbFilePath, strOutputFilePath, config); + } + +}; diff --git a/RyujinCore/Ryujin.def b/RyujinCore/Ryujin.def new file mode 100644 index 0000000..480a89e --- /dev/null +++ b/RyujinCore/Ryujin.def @@ -0,0 +1,3 @@ +LIBRARY RyujinObfuscator +EXPORTS + RunRyujinCore = ?RunRyujinCore@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AEAVRyujinObfuscatorConfig@@@Z \ No newline at end of file diff --git a/RyujinCore/RyujinCore.vcxproj b/RyujinCore/RyujinCore.vcxproj index d98a721..88392a5 100644 --- a/RyujinCore/RyujinCore.vcxproj +++ b/RyujinCore/RyujinCore.vcxproj @@ -72,15 +72,19 @@ RyujinCore + ..\compiled\release RyujinCore + ..\compiled\release RyujinCore + ..\compiled\release RyujinCore + ..\compiled\release @@ -95,6 +99,7 @@ Windows true false + Ryujin.def @@ -114,6 +119,7 @@ true true false + Ryujin.def @@ -129,6 +135,7 @@ Windows true false + Ryujin.def @@ -148,11 +155,9 @@ true true false + Ryujin.def - - - @@ -175,6 +180,9 @@ + + + diff --git a/RyujinCore/RyujinCore.vcxproj.filters b/RyujinCore/RyujinCore.vcxproj.filters index 95e83a0..1e1090f 100644 --- a/RyujinCore/RyujinCore.vcxproj.filters +++ b/RyujinCore/RyujinCore.vcxproj.filters @@ -30,12 +30,6 @@ - - - - - Header Files - Ryujin @@ -66,6 +60,9 @@ Ryujin\PDB + + Ryujin + @@ -90,4 +87,9 @@ Ryujin\RyujinCore + + + Source Files + + \ No newline at end of file diff --git a/RyujinCore/cpp.hint b/RyujinCore/cpp.hint deleted file mode 100644 index 63a695c..0000000 --- a/RyujinCore/cpp.hint +++ /dev/null @@ -1,2 +0,0 @@ -#define RYUJINCORE_API __declspec(dllexport) -#define RYUJINCORE_API __declspec(dllimport)