1+ /*
2+ * Copyright © May-29-2010 by learn_more
3+ * SimpleObf.cpp is part of the project 'SimpleObfuscation'.
4+ *
5+ * Please do not use this in payhacks.
6+ *
7+ * This program is distributed in the hope that it will be useful,
8+ * but WITHOUT ANY WARRANTY, without even the implied warranty of
9+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
10+ *
11+ *$UCC_HDR$*
12+ */
13+
14+
15+ /* *****************************************************************************\
16+ ** **
17+ ** Please do not edit this file, unless you know what you are doing! **
18+ ** **
19+ \******************************************************************************/
20+
21+
22+ #define SIMPLE_OBF_CPP_VERSION 003
23+
24+ #define _WIN32_WINNT 0x0501
25+ #define _WIN32_WINDOWS 0x0410
26+ #define _WIN32_IE 0x0600
27+ #include " windows.h"
28+ #include " SimpleObf.h"
29+
30+ struct nop_equ {
31+ char * opcode;
32+ int len;
33+ };
34+
35+ #if SIMPLE_OBF_CPP_VERSION != SIMPLE_OBF_H_VERSION
36+ #error Obfuscation header does not match .cpp version
37+ #endif
38+
39+ #if defined(_WIN64) || defined(_M_X64) || defined(_M_IA64)
40+ #error Sorry, 64 bits not supported
41+ #endif
42+
43+ #if defined(_Wp64)
44+ #pragma warning( disable: 4244 4311 ) // conversion from '__w64 int' to 'int' and pointer truncation from 'const PBYTE' to 'int'
45+ #endif
46+
47+ nop_equ possible_opcodes[] = {
48+ {" \x90 " 1 }, // nop
49+ {" \xD9\xD0 " 2 }, // fnop
50+ {" \x8B\xC0 " 2 }, // mov eax, eax
51+ {" \x8B\xDB " 2 }, // mov ebx, ebx
52+ {" \x8B\xC9 " 2 }, // mov ecx, ecx
53+ {" \x8B\xD2 " 2 }, // mov edx, edx
54+ {" \x8B\xE4 " 2 }, // mov esp, esp
55+ {" \x8B\xF6 " 2 }, // mov esi, esi
56+ {" \x8B\xFF " 2 }, // mov edi, edi
57+ {" \x87\xDB " 2 }, // xchg ebx, ebx
58+ {" \x87\xC9 " 2 }, // xchg ecx, ecx
59+ {" \x87\xD2 " 2 }, // xchg edx, edx
60+ {" \x87\xE4 " 2 }, // xchg esp, esp
61+ {" \x87\xED " 2 }, // xchg ebp, ebp
62+ {" \x87\xF6 " 2 }, // xchg esi, esi
63+ {" \x87\xFF " 2 }, // xchg edi, edi
64+ {" \x50\x58 " 2 }, // push,pop eax
65+ {" \x53\x5B " 2 }, // push,pop ebx
66+ {" \x51\x59 " 2 }, // push,pop ecx
67+ {" \x52\x5A " 2 }, // push,pop edx
68+ {" \x56\x5E " 2 }, // push,pop esi
69+ {" \x57\x5F " 2 }, // push,pop edi
70+ {" \x83\xC8\x00 " 3 }, // or eax, 0
71+ {" \x83\xC9\x00 " 3 }, // or ecx, 0
72+ {" \x83\xCA\x00 " 3 }, // or edx, 0
73+ {" \x83\xCB\x00 " 3 }, // or ebx, 0
74+ {" \x83\xCC\x00 " 3 }, // or esp, 0
75+ {" \x83\xCD\x00 " 3 }, // or ebp, 0
76+ {" \x83\xCE\x00 " 3 }, // or esi, 0
77+ {" \x83\xCF\x00 " 3 }, // or edi, 0
78+ {" \x83\xE0\xFF " 3 }, // and eax, FFFFFFFF
79+ {" \x83\xE1\xFF " 3 }, // and ecx, FFFFFFFF
80+ {" \x83\xE2\xFF " 3 }, // and edx, FFFFFFFF
81+ {" \x83\xE3\xFF " 3 }, // and ebx, FFFFFFFF
82+ {" \x83\xE4\xFF " 3 }, // and esp, FFFFFFFF
83+ {" \x83\xE5\xFF " 3 }, // and ebp, FFFFFFFF
84+ {" \x83\xE6\xFF " 3 }, // and esi, FFFFFFFF
85+ {" \x83\xE7\xFF " 3 }, // and edi, FFFFFFFF
86+ {" \x83\xF0\x00 " 3 }, // xor eax, 0
87+ {" \x83\xF1\x00 " 3 }, // xor ecx, 0
88+ {" \x83\xF2\x00 " 3 }, // xor edx, 0
89+ {" \x83\xF3\x00 " 3 }, // xor ebx, 0
90+ {" \x83\xF4\x00 " 3 }, // xor esp, 0
91+ {" \x83\xF5\x00 " 3 }, // xor ebp, 0
92+ {" \x83\xF6\x00 " 3 }, // xor esi, 0
93+ {" \x83\xF7\x00 " 3 }, // xor edi, 0
94+ {0 ,0 }
95+ };
96+
97+
98+ int GenRand ( int min, int max )
99+ {
100+ UINT number = 0 ;
101+ __asm push edx
102+ __asm rdtsc
103+ __asm pop edx
104+ __asm mov number, eax
105+ number %= (max-min);
106+ return number + min;
107+ }
108+
109+ // perform the actual nopping, called from macro's trough _AddNops, or from AllocateJumpgate
110+ void real_AddNops ( PBYTE start, PBYTE end )
111+ {
112+ int iLeft = end-start;
113+ while ( iLeft ) {
114+ if ( GenRand ( 0 , 7 ) < 5 ) {
115+ nop_equ* p = possible_opcodes + GenRand (0 ,ARRAYSIZE (possible_opcodes));
116+ if ( !p->len ) continue ;
117+ if ( p->len > iLeft ) continue ;
118+ for ( int i = 0 ; i < p->len ; i++ )
119+ end[-iLeft+i] = p->opcode [i];
120+ iLeft -= p->len ;
121+ } else {
122+ end[-(iLeft--)] = 0xEB ;
123+ int iSize = GenRand ( 0 , iLeft );
124+ end[-(iLeft--)] = (BYTE)(iSize&0xFF );
125+ while ( iSize ) {
126+ end[-iLeft] = (BYTE)(GenRand (0 ,256 )&0xFF );
127+ iSize--;
128+ iLeft--;
129+ }
130+ }
131+ if ( iLeft == 1 ) {
132+ end[-1 ] = 0x90 ;
133+ break ;
134+ }
135+ }
136+ }
137+
138+ // wrapper function, change page protection only when called from macros :)
139+ void __stdcall _AddNops ( PBYTE start, PBYTE end )
140+ {
141+ DWORD dwOld, dwOld2;
142+ VirtualProtectEx ( INVALID_HANDLE_VALUE, start, end-start, PAGE_EXECUTE_READWRITE, &dwOld );
143+ real_AddNops ( start, end );
144+ VirtualProtectEx ( INVALID_HANDLE_VALUE, start, end-start, dwOld, &dwOld2 );
145+ }
146+
147+
148+ void WriteJmp ( const PBYTE from, const PBYTE to )
149+ {
150+ *from = 0xE9 ;
151+ PDWORD dwJmp = (PDWORD)(from+1 );
152+ *dwJmp = (int )to - (int )from - 5 ;
153+ }
154+
155+
156+ PBYTE __stdcall AllocateJumpgate ( PBYTE target, int minlen, int maxlen )
157+ {
158+ PBYTE buf;
159+ DWORD dwOld;
160+ int iLen = GenRand ( minlen, maxlen );
161+ buf = (PBYTE)VirtualAllocEx ( INVALID_HANDLE_VALUE, NULL , iLen + 5 , MEM_COMMIT, PAGE_EXECUTE_READWRITE );
162+ real_AddNops ( buf, buf + iLen );
163+ WriteJmp ( buf + iLen, target );
164+ VirtualProtectEx ( INVALID_HANDLE_VALUE, buf, iLen, PAGE_EXECUTE_READ, &dwOld );
165+ return buf;
166+ }
167+
168+ void __stdcall FreeJumpgate ( PBYTE target )
169+ {
170+ VirtualFreeEx ( INVALID_HANDLE_VALUE, target, 0 , MEM_RELEASE );
171+ }
0 commit comments