diff --git a/RyujinConsole/RyujinConsole.sln b/RyujinConsole/RyujinConsole.sln index 0218ebd..972a684 100644 --- a/RyujinConsole/RyujinConsole.sln +++ b/RyujinConsole/RyujinConsole.sln @@ -5,6 +5,8 @@ VisualStudioVersion = 17.13.35931.197 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RyujinConsole", "RyujinConsole\RyujinConsole.vcxproj", "{1DC1BB2C-6B3E-4084-8F26-76852C709BB4}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RyujinCore", "..\RyujinCore\RyujinCore.vcxproj", "{AEFF626B-1317-4C8F-94B3-B3D405AE65B2}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|x64 = Debug|x64 @@ -21,6 +23,14 @@ Global {1DC1BB2C-6B3E-4084-8F26-76852C709BB4}.Release|x64.Build.0 = Release|x64 {1DC1BB2C-6B3E-4084-8F26-76852C709BB4}.Release|x86.ActiveCfg = Release|Win32 {1DC1BB2C-6B3E-4084-8F26-76852C709BB4}.Release|x86.Build.0 = Release|Win32 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Debug|x64.ActiveCfg = Debug|x64 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Debug|x64.Build.0 = Debug|x64 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Debug|x86.ActiveCfg = Debug|Win32 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Debug|x86.Build.0 = Debug|Win32 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Release|x64.ActiveCfg = Release|x64 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Release|x64.Build.0 = Release|x64 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Release|x86.ActiveCfg = Release|Win32 + {AEFF626B-1317-4C8F-94B3-B3D405AE65B2}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.cc b/RyujinConsole/RyujinConsole/RyujinConsole.cc index 589304c..3083f8f 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.cc +++ b/RyujinConsole/RyujinConsole/RyujinConsole.cc @@ -1,14 +1,42 @@ #include -#include "Ryujin/Ryujin.hh" + +// TODO: Fit it in a new class for ryujin +#include +#include +class RyujinObfuscatorConfig { + +public: + bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard + bool m_isVirtualized; // Virtualize the code [Try as much as possible] + bool m_isIatObfuscation; //Process IAT Obfuscation + bool m_isJunkCode; // Insert junk code to confuse + bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs) + bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection + std::vector m_strProceduresToObfuscate; // Names of the procedures to obfuscate + + bool RunRyujin(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config) { + + using tpdRunRyujinCore = BOOL (__stdcall *)(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config); + + auto hModule = LoadLibraryW(L"RyujinCore.dll"); + + if (!hModule) return FALSE; + + auto RunRyujinCore = reinterpret_cast(GetProcAddress(hModule, "?RunRyujinCore@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AEAVRyujinObfuscatorConfig@@@Z")); + + if (!RunRyujinCore) return FALSE; + + return RunRyujinCore(strInputFilePath, strPdbFilePath, strOutputFilePath, config); + } + +}; + + auto main() -> int { std::cout << "Hello World!\n"; - std::unique_ptr ryujin = std::make_unique("C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Debug\\DemoObfuscation.exe", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Debug\\DemoObfuscation.pdb", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Debug\\DemoObfuscation.obfuscated.exe"); - - ryujin.get()->listRyujinProcedures(); - RyujinObfuscatorConfig config; config.m_isIgnoreOriginalCodeRemove = FALSE; config.m_isJunkCode = TRUE; @@ -17,6 +45,7 @@ auto main() -> int { config.m_isIatObfuscation = TRUE; config.m_isEncryptObfuscatedCode = TRUE; std::vector procsToObfuscate{ + "sum", "sub", "subadd", @@ -24,12 +53,15 @@ auto main() -> int { "invoke_main" "__scrt_common_main", "j___security_init_cookie" + }; config.m_strProceduresToObfuscate.assign(procsToObfuscate.begin(), procsToObfuscate.end()); - ryujin.get()->run(config); + auto bSuccess = config.RunRyujin("C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.exe", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.pdb", "C:\\Users\\Keowu\\Documents\\GitHub\\Ryujin\\RyujinConsole\\x64\\Release\\DemoObfuscation.obfuscated.exe", config); - ryujin.reset(); + std::printf("Ryujin core returned: %d\n", bSuccess); + + std::cin.get(); return 0; } \ No newline at end of file diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj index 60024b2..1c4bbba 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj @@ -132,23 +132,6 @@ - - - - - - - - - - - - - - - - - diff --git a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters index 9a621c7..416cbe4 100644 --- a/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters +++ b/RyujinConsole/RyujinConsole/RyujinConsole.vcxproj.filters @@ -13,72 +13,10 @@ {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - {a6c99d12-960c-49be-b336-4f46735958f6} - - - {f30d7f79-63e4-4d53-b9b2-a6e9a867335f} - - - {82c4bcff-ab3c-4c0e-b8ee-d04135859e2b} - - - {df02e440-42fd-4d5d-ace9-62fb1891e33c} - - - {cc8cdc69-0dce-4cc2-9b0d-6bba400b9599} - - - Ryujin\Utils - - - Ryujin - Source Files - - Ryujin\RyujinCore - - - Ryujin\Utils - - - Ryujin\RyujinCore - - - - - Ryujin\Models - - - Ryujin\Models - - - Ryujin\Models - - - Ryujin\Models - - - Ryujin\PDB - - - Ryujin\Utils - - - Ryujin - - - Ryujin\RyujinCore - - - Ryujin\Utils - - - Ryujin\RyujinCore - \ No newline at end of file diff --git a/RyujinConsole/RyujinConsole/Ryujin/Models/RyujinBasicBlock.hh b/RyujinCore/Ryujin/Models/RyujinBasicBlock.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Models/RyujinBasicBlock.hh rename to RyujinCore/Ryujin/Models/RyujinBasicBlock.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Models/RyujinInstruction.hh b/RyujinCore/Ryujin/Models/RyujinInstruction.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Models/RyujinInstruction.hh rename to RyujinCore/Ryujin/Models/RyujinInstruction.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Models/RyujinObfuscatorConfig.hh b/RyujinCore/Ryujin/Models/RyujinObfuscatorConfig.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Models/RyujinObfuscatorConfig.hh rename to RyujinCore/Ryujin/Models/RyujinObfuscatorConfig.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Models/RyujinProcedure.hh b/RyujinCore/Ryujin/Models/RyujinProcedure.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Models/RyujinProcedure.hh rename to RyujinCore/Ryujin/Models/RyujinProcedure.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/PDB/RyujinPdbParsing.hh b/RyujinCore/Ryujin/PDB/RyujinPdbParsing.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/PDB/RyujinPdbParsing.hh rename to RyujinCore/Ryujin/PDB/RyujinPdbParsing.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Ryujin.cc b/RyujinCore/Ryujin/Ryujin.cc similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Ryujin.cc rename to RyujinCore/Ryujin/Ryujin.cc diff --git a/RyujinConsole/RyujinConsole/Ryujin/Ryujin.hh b/RyujinCore/Ryujin/Ryujin.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Ryujin.hh rename to RyujinCore/Ryujin/Ryujin.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/RyujinCore/BasicBlockerBuilder.cc b/RyujinCore/Ryujin/RyujinCore/BasicBlockerBuilder.cc similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/RyujinCore/BasicBlockerBuilder.cc rename to RyujinCore/Ryujin/RyujinCore/BasicBlockerBuilder.cc diff --git a/RyujinConsole/RyujinConsole/Ryujin/RyujinCore/BasicBlockerBuilder.hh b/RyujinCore/Ryujin/RyujinCore/BasicBlockerBuilder.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/RyujinCore/BasicBlockerBuilder.hh rename to RyujinCore/Ryujin/RyujinCore/BasicBlockerBuilder.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/RyujinCore/RyujinObfuscationCore.cc b/RyujinCore/Ryujin/RyujinCore/RyujinObfuscationCore.cc similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/RyujinCore/RyujinObfuscationCore.cc rename to RyujinCore/Ryujin/RyujinCore/RyujinObfuscationCore.cc diff --git a/RyujinConsole/RyujinConsole/Ryujin/RyujinCore/RyujinObfuscationCore.hh b/RyujinCore/Ryujin/RyujinCore/RyujinObfuscationCore.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/RyujinCore/RyujinObfuscationCore.hh rename to RyujinCore/Ryujin/RyujinCore/RyujinObfuscationCore.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinPESections.cc b/RyujinCore/Ryujin/Utils/RyujinPESections.cc similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinPESections.cc rename to RyujinCore/Ryujin/Utils/RyujinPESections.cc diff --git a/RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinPESections.hh b/RyujinCore/Ryujin/Utils/RyujinPESections.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinPESections.hh rename to RyujinCore/Ryujin/Utils/RyujinPESections.hh diff --git a/RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinUtils.cc b/RyujinCore/Ryujin/Utils/RyujinUtils.cc similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinUtils.cc rename to RyujinCore/Ryujin/Utils/RyujinUtils.cc diff --git a/RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinUtils.hh b/RyujinCore/Ryujin/Utils/RyujinUtils.hh similarity index 100% rename from RyujinConsole/RyujinConsole/Ryujin/Utils/RyujinUtils.hh rename to RyujinCore/Ryujin/Utils/RyujinUtils.hh diff --git a/RyujinCore/RyujinCore.cc b/RyujinCore/RyujinCore.cc new file mode 100644 index 0000000..6626751 --- /dev/null +++ b/RyujinCore/RyujinCore.cc @@ -0,0 +1,14 @@ +#include "RyujinCore.hh" + +RYUJINCORE_API BOOL __stdcall RunRyujinCore(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig& config) { + + std::unique_ptr ryujin = std::make_unique(strInputFilePath, strPdbFilePath, strOutputFilePath); + + ryujin.get()->listRyujinProcedures(); + + ryujin.get()->run(config); + + ryujin.reset(); + + return TRUE; +} diff --git a/RyujinCore/RyujinCore.hh b/RyujinCore/RyujinCore.hh new file mode 100644 index 0000000..f25e3ae --- /dev/null +++ b/RyujinCore/RyujinCore.hh @@ -0,0 +1,8 @@ +#ifdef RYUJINCORE_EXPORTS +#define RYUJINCORE_API __declspec(dllexport) +#else +#define RYUJINCORE_API __declspec(dllimport) +#endif +#include "Ryujin/Ryujin.hh" + +RYUJINCORE_API BOOL __stdcall RunRyujinCore(const std::string& strInputFilePath, const std::string& strPdbFilePath, const std::string& strOutputFilePath, RyujinObfuscatorConfig &config); diff --git a/RyujinCore/RyujinCore.vcxproj b/RyujinCore/RyujinCore.vcxproj new file mode 100644 index 0000000..d98a721 --- /dev/null +++ b/RyujinCore/RyujinCore.vcxproj @@ -0,0 +1,181 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {aeff626b-1317-4c8f-94b3-b3d405ae65b2} + RyujinCore + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + RyujinCore + + + RyujinCore + + + RyujinCore + + + RyujinCore + + + + Level3 + true + WIN32;_DEBUG;RYUJINCORE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;RYUJINCORE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;RYUJINCORE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;RYUJINCORE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + pch.h + + + Windows + true + true + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/RyujinCore/RyujinCore.vcxproj.filters b/RyujinCore/RyujinCore.vcxproj.filters new file mode 100644 index 0000000..95e83a0 --- /dev/null +++ b/RyujinCore/RyujinCore.vcxproj.filters @@ -0,0 +1,93 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {75c5a07c-f3a0-4780-a2d6-82b6c759efbb} + + + {cf207520-50f1-4f26-9b7d-0a6ad7fd1fb1} + + + {81beb1cb-a0b6-4118-8a39-bd558f8f5522} + + + {49f30cd7-8ed7-42f3-b599-9f7fddf5c547} + + + {4284f652-8f94-493b-acb5-178e17622669} + + + + + + + + Header Files + + + Ryujin + + + Ryujin\Models + + + Ryujin\Models + + + Ryujin\Models + + + Ryujin\Models + + + Ryujin\Utils + + + Ryujin\Utils + + + Ryujin\RyujinCore + + + Ryujin\RyujinCore + + + Ryujin\PDB + + + + + Source Files + + + Source Files + + + Ryujin + + + Ryujin\Utils + + + Ryujin\Utils + + + Ryujin\RyujinCore + + + Ryujin\RyujinCore + + + \ No newline at end of file diff --git a/RyujinCore/cpp.hint b/RyujinCore/cpp.hint new file mode 100644 index 0000000..63a695c --- /dev/null +++ b/RyujinCore/cpp.hint @@ -0,0 +1,2 @@ +#define RYUJINCORE_API __declspec(dllexport) +#define RYUJINCORE_API __declspec(dllimport) diff --git a/RyujinCore/dllmain.cc b/RyujinCore/dllmain.cc new file mode 100644 index 0000000..0fc0182 --- /dev/null +++ b/RyujinCore/dllmain.cc @@ -0,0 +1,17 @@ +#include + +BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { + + switch (ul_reason_for_call) { + + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + + } + + return TRUE; +} +