コード例 #1
0
ファイル: BuildVMCode.cpp プロジェクト: Kernal-GH/WProtect-1
  /*
pCodeBufferInfo BuildVMCode::BuildPCode(
                                        VirtualMachineManage *vmmanage,
                                        pCodeBufferInfo pinfo,
                                        VMAddressTable * address_table
                                          )
{
  Analysis analysis;
  std::vector<CodePiece> code_piece_list;
  analysis.disasm(pinfo,code_piece_list);
  VirtualMachine *vm = vmmanage->rand_virtual_machine();
  vector <VMCodeBufferManage*>vcodebufs;
  long first_pcode_addr = alloc_address(vm,address_table,&analysis,&vcodebufs);
  
   SeniorVMHandle *sfirst = &vcodebufs[ 0 ]->get_generator(  );
   //sfirst->upset_register_array(sfirst->pcode->register_store_in);
   //sfirst->start();
  
  long key = vcodebufs[ 0 ]->code.get_original_key(  );

  VTable t_v;

  memset(&t_v,0,sizeof(t_v));
  bool t_sign = address_table->get_sign();
  address_table->set_sign(true);
  //printf("1111%d\n",address_table->get_size());
  //__asm__ ("int3");
  long head_address = address_table->assign_address(0x70);
  address_table->set_sign(t_sign);

#ifdef DEBUG
  printf("vm入口地址:%x\r\n",head_address);
#endif
  ppcode_block_info info =  vm->create_function_head(head_address,first_pcode_addr,sfirst->pcode,pinfo->addr + pinfo->size,123456,key); //pcode位置有问题

  address_table->copy(head_address,info->buf,info->size);
  

  for (int i = 0; i < analysis.block_count; ++i)
  {
    ud_t ud;
    pAssemblerTree nowtree = analysis.get_tree(i);
    SeniorVMHandle *senior = &(vcodebufs)[i]->get_generator();
    vcodebufs[ i ]->code.set_key( nowtree->key ); //设置key
    senior->save_vm_context();
      bool b_j = false;    
    for (std::vector<ud_t>::iterator iter = nowtree->asmpiece.begin();
         iter != nowtree->asmpiece.end(); ++iter)
    {
      ud = *iter;
      if (nowtree->LeftChild)
      ud.vm_jcc_addr1 = nowtree->LeftChild->reloc_address;
      switch ( ud.mnemonic)
      {
      case UD_Ijnz:
        b_j = true;
        ud.vm_jcc_addr2 = nowtree->RightChild->reloc_address;//nowtree->jcc_addr;
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );        
        break;
      case UD_Ijz:
        b_j = true;
        ud.vm_jcc_addr2 = nowtree->jcc_addr;
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );        
        break;
      default:
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );
      }
    }
    printf("当前key:%x\r\n",nowtree->key);
    if (i+1 < analysis.block_count    )
    {
      senior->recover_vm_context();
      if (!b_j) 
        senior->push(nowtree->LeftChild->reloc_address);
      else
        senior->push(T_JCC_REGISTER);
      //senior->set_key(vcodebufs[i]->code.get_original_key());
      senior->set_key(nowtree->key); //handle设置key
    }
        
    //senior->recover_vm_context();      
  }
  address_table->copy();
  
  for (vector <VMCodeBufferManage*>::iterator iter = vcodebufs.begin(); iter != vcodebufs.end(); ++iter)
  {
    delete *iter;
  }
  pinfo->addr = head_address;
  return pinfo;
}*/
pCodeBufferInfo BuildVMCode::BuildPCode(
                                        VirtualMachineManage *vmmanage,
                                        pCodeBufferInfo pinfo,
                                        VMAddressTable * address_table
                                          )
{
  Analysis analysis;
  analysis.disasm(pinfo);
  VirtualMachine *vm = vmmanage->rand_virtual_machine();
  vector <VMCodeBufferManage*>vcodebufs;
  long first_pcode_addr = alloc_address(vm,address_table,&analysis,&vcodebufs);
  
   SeniorVMHandle *sfirst = &vcodebufs[ 0 ]->get_generator(  );
   //sfirst->upset_register_array(sfirst->pcode->register_store_in);
   //sfirst->start();
  
  long key = vcodebufs[ 0 ]->code.get_original_key(  );

  VTable t_v;

  memset(&t_v,0,sizeof(t_v));
  bool t_sign = address_table->get_sign();
  address_table->set_sign(true);
  //printf("1111%d\n",address_table->get_size());
  //__asm__ ("int3");
  long head_address = address_table->assign_address(0x70);
  address_table->set_sign(t_sign);

#ifdef DEBUG
  printf("vm入口地址:%x\r\n",head_address);
#endif
  ppcode_block_info info =  vm->create_function_head(head_address,first_pcode_addr,sfirst->pcode,pinfo->addr + pinfo->size,123456,key); //pcode位置有问题

  address_table->copy(head_address,info->buf,info->size);
  
  /*FILE *file;
  file = fopen( "head","wb" );
  fwrite( info->buf,1,info->size,file );
  fclose( file );  */
  for (int i = 0; i < analysis.block_count; ++i)
  {
    ud_t ud;
    pAssemblerTree nowtree = analysis.get_tree(i);
    SeniorVMHandle *senior = &(vcodebufs)[i]->get_generator();
    vcodebufs[ i ]->code.set_key( nowtree->key ); //设置key
    senior->save_vm_context();
      bool b_j = false;    
    for (std::vector<ud_t>::iterator iter = nowtree->asmpiece.begin();
         iter != nowtree->asmpiece.end(); ++iter)
    {
      ud = *iter;
      if (nowtree->LeftChild)
      ud.vm_jcc_addr1 = nowtree->LeftChild->reloc_address;
      switch ( ud.mnemonic)
      {
      case UD_Ijnz:
        b_j = true;
        ud.vm_jcc_addr2 = nowtree->RightChild->reloc_address;//nowtree->jcc_addr;
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );        
        break;
      case UD_Ijz:
        b_j = true;
        ud.vm_jcc_addr2 = nowtree->jcc_addr;
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );        
        break;
      default:
        asm_to_vm( &vcodebufs[ i ]->get_generator(  ),&ud );
      }
    }
    printf("当前key:%x\r\n",nowtree->key);
    if (i+1 < analysis.block_count    )
    {
      senior->recover_vm_context();
      if (!b_j) 
        senior->push(nowtree->LeftChild->reloc_address);
      else
        senior->push(T_JCC_REGISTER);
      //senior->set_key(vcodebufs[i]->code.get_original_key());
      senior->set_key(nowtree->key); //handle设置key
    }
        
    //senior->recover_vm_context();      
  }
  address_table->copy();
  
  for (vector <VMCodeBufferManage*>::iterator iter = vcodebufs.begin(); iter != vcodebufs.end(); ++iter)
  {
    delete *iter;
  }
  pinfo->addr = head_address;
  return pinfo;
}