04063714da
- Fixed bugs reported by third parties (instruction-override issues, padding-space logic, and more) - Corrected typos (translated comments/examples to English) - Fully refactored the Ryujin console (arguments now handled via the argparser library) - MBA pass: fixed equivalence-logic issues when generating MBA instructions for original operations - Updated DemoObfuscation usage examples
45 lines
1.9 KiB
C++
45 lines
1.9 KiB
C++
#pragma once
|
||
#include <string>
|
||
|
||
#define MAX_PROCEDURES 128
|
||
#define MAX_PROCEDURE_NAME_LEN 128
|
||
#define MAX_CALLBACKS 10
|
||
|
||
struct RyujinObfuscatorProcs {
|
||
int procedureCount;
|
||
char procedures[MAX_PROCEDURES][MAX_PROCEDURE_NAME_LEN];
|
||
};
|
||
|
||
using RyujinCallback = void (*)(RyujinProcedure*);
|
||
|
||
struct RyujinCallbacks {
|
||
int callbackCount;
|
||
RyujinCallback callbacks[MAX_CALLBACKS]; // Array de ponteiros de função
|
||
};
|
||
|
||
class RyuJinConfigInternal {
|
||
|
||
public:
|
||
std::vector<std::string> m_strdProceduresToObfuscate; // Names of the procedures to obfuscate
|
||
|
||
};
|
||
|
||
class RyujinObfuscatorConfig {
|
||
|
||
public:
|
||
bool m_isRandomSection; // Randomize the name of the new section with the processed code -> ".Ryujin" standard
|
||
bool m_isVirtualized; // Virtualize the code [Try as much as possible]
|
||
bool m_isIatObfuscation; //Process IAT Obfuscation
|
||
bool m_isJunkCode; // Insert junk code to confuse
|
||
bool m_isIgnoreOriginalCodeRemove; // Do not remove the original code after processing (replace the original instructions with NOPs)
|
||
bool m_isEncryptObfuscatedCode; // The user wants to encrypt all obfuscated code to avoid detection
|
||
bool m_isAntiDebug; // The user wants to avoid debuggers use while running a binary protected by Ryujin
|
||
bool m_isTrollRerversers; // The user wants to trick and use a special feature to troll reversers when their debugs be detected making they loose all the progress
|
||
bool m_isAntiDump; // Enable Anti Dump technic for Ryujin protected binary
|
||
bool m_isMemoryProtection; // Memory CRC32 protection
|
||
bool m_isHVPass; // Run some features of ryujin using Microsoft Hypervisor Framework API
|
||
bool m_isMutateMiniVM; // Perform the mutation and add full junk code to the Ryujin MiniVM stub, regardless of whether it’s the normal version or the HV pass.
|
||
RyujinObfuscatorProcs m_strProceduresToObfuscate; // Names of the procedures to obfuscate
|
||
RyujinCallbacks m_callbacks; // Ryujin Custom Pass Callbacks
|
||
|
||
}; |