VMProtect/core/runtime.vmp

944 lines
32 KiB
XML

<?xml version="1.0" encoding="UTF-8" ?>
<Document>
<Protection InputFileName="../bin/64/Release/win_runtime.dll" Options="0" OutputFileName="win_runtime32.dll">
<Messages />
<Folders />
<Procedures />
<Objects />
</Protection>
<Script>
<![CDATA[function OnBeforeSaveFile()
local file = vmprotect.core():outputArchitecture()
local functions = vmprotect.core():inputArchitecture():functions()
local empty_byte
local is_dotnet
if (file:name() == ".NET") then
is_dotnet = true
empty_byte = 0x2a
else
is_dotnet = false
empty_byte = 0xcc
end
for i = 1, functions:count() do
local func = functions:item(i)
if (not func:needCompile() and func:type() ~= ObjectType.String) then
local block_size = 0;
local block_address = 0;
for j = 1, func:count() do
command = func:item(j)
need_clear = bit32.btest(command:options(), CommandOption.ClearOriginalCode)
if (need_clear and is_dotnet and command:type() == ILCommandType.Comment) then
need_clear = false
end
if need_clear then
if (is_dotnet) then
-- IL
else
-- Intel
for k = 1, 3 do
operand = command:operand(k)
if operand:fixup() then
local fixup = file:fixups():itemByAddress(operand:fixup():address())
if fixup then
fixup:setDeleted(true)
end
end
end
end
if block_address ~= 0 and (block_address + block_size) ~= command:address() then
if block_size > 0 then
if file:addressSeek(block_address) then
local s = string.rep(string.char(empty_byte), block_size)
file:write(s)
end
end
block_address = 0
block_size = 0
end
if block_address == 0 then
block_address = command:address()
end
block_size = block_size + command:size()
end
end
if block_size > 0 then
if file:addressSeek(block_address) then
local s = string.rep(string.char(empty_byte), block_size)
file:write(s)
end
end
end
end
file:exports():clear()
end
function OnAfterCompilation()
local array_name = string.gsub(string.gsub(vmprotect.extractFileName(core:outputFileName()), "%.", "_"), "demo", "")
local lines = {}
table.insert(lines, string.format('const uint8_t %s_code[] = {', array_name))
local s = ""
for i = 1, code_data:len() do
s = s .. string.format("0x%.2x, ", code_data:byte(i))
if (s:len() > 100) then
table.insert(lines, s)
s = ""
end
end
if (s:len() > 0) then
table.insert(lines, s)
end
table.insert(lines, "};")
local stream = io.open(core:outputFileName(), "rb")
local file_data = stream:read("*all")
stream:close()
table.insert(lines, string.format('const uint8_t %s_file[] = {', array_name))
local key = math.random(0x100000000);
local key_data = DWordToChar(key);
s = ""
for i = 1, key_data:len() do
s = s .. string.format("0x%.2x, ", key_data:byte(i))
end
for i = 0, file_data:len() - 1 do
s = s .. string.format("0x%.2x, ", bit32.bxor(file_data:byte(i + 1), (bit32.lrotate(key, i) + i) % 0x100))
if (s:len() > 100) then
table.insert(lines, s)
s = ""
end
end
if (s:len() > 0) then
table.insert(lines, s)
end
table.insert(lines, "};")
local stream = io.open(core:outputFileName() .. ".inc", "w+")
stream:write(table.concat(lines, "\n"))
stream:close()
end
function ValueToChar(val, len)
local value = ""
if (type(val) == "userdata") then
value = tostring(val)
else
if (val < 0) then
val = 0x10000 + val
end
value = string.format("%x", val)
end
while (value:len() < len * 2) do
value = "0" .. value
end
local res = ""
for i = value:len() - 1, 1, -2 do
res = res .. string.char(tonumber("0x" .. value:sub(i, i + 1)))
len = len - 1
if (len == 0) then
break
end
end
return res
end
function ByteToChar(value)
return ValueToChar(value, 1)
end
function WordToChar(value)
return ValueToChar(value, 2)
end
function DWordToChar(value)
return ValueToChar(value, 4)
end
function QWordToChar(value)
return ValueToChar(value, 8)
end
function Ord(value)
if (value) then
return 1
end
return 0
end
function OnBeforeCompilation()
local file = core:outputArchitecture()
if (file:name() == ".NET") then
local rsrc = file:segments():itemByName(".rsrc")
if (rsrc) then
rsrc:destroy()
end
end
end
core = vmprotect.core()
file = core:inputFile():item(core:inputFile():count())
procedure_lines = {}
--[[
# format: procname XYZ
#
# X:
# A - All features
# L - Licensing system
# B - Bundler
# R - Registry
# E - rEsources
# I - Loader
# P - Processor
#
# Y:
# M - Mutation
# F - Fast virtualization
# V - Virtualization (default)
#
# Z:
# N - None entry point
# R - Random entry point
#
]]--
if (file:name() == ".NET") then
-- Virtual Machine
table.insert(procedure_lines, 'VMProtect.VirtualMachine::.ctor( PM')
table.insert(procedure_lines, 'VMProtect.VirtualMachine::Invoke( PM')
table.insert(procedure_lines, 'VMProtect.VirtualMachine/Utils::Random( AVN')
table.insert(procedure_lines, 'VMProtect.VirtualMachine/Utils::CalcCRC( AVN')
table.insert(procedure_lines, 'VMProtect.VirtualMachine:: PM')
table.insert(procedure_lines, 'VMProtect.VirtualMachine/ PM')
-- Crypto
table.insert(procedure_lines, 'VMProtect.CipherRC5:: AM')
-- Core
table.insert(procedure_lines, 'VMProtect.Core::Init( AV')
table.insert(procedure_lines, 'VMProtect.Core::IsProtected( AV')
table.insert(procedure_lines, 'VMProtect.Core::IsDebuggerPresent( AV')
table.insert(procedure_lines, 'VMProtect.Core::FindFirmwareVendor( AM')
table.insert(procedure_lines, 'VMProtect.Core::IsVirtualMachinePresent( AV')
table.insert(procedure_lines, 'VMProtect.Core::IsValidImageCRC( AM')
table.insert(procedure_lines, 'VMProtect.Core::DecryptString( AV')
table.insert(procedure_lines, 'VMProtect.Core::FreeString( AV')
table.insert(procedure_lines, 'VMProtect.Core::AntidebugThread( AV')
table.insert(procedure_lines, 'VMProtect.Core::SetSerialNumber( LV')
table.insert(procedure_lines, 'VMProtect.Core::GetSerialNumberState( LV')
table.insert(procedure_lines, 'VMProtect.Core::GetSerialNumberData( LV')
table.insert(procedure_lines, 'VMProtect.Core::GetCurrentHWID( LV')
table.insert(procedure_lines, 'VMProtect.Core::ActivateLicense( LV')
table.insert(procedure_lines, 'VMProtect.Core::DeactivateLicense( LV')
table.insert(procedure_lines, 'VMProtect.Core::GetOfflineActivationString( LV')
table.insert(procedure_lines, 'VMProtect.Core::GetOfflineDeactivationString( LV')
table.insert(procedure_lines, 'VMProtect.Core::DecryptBuffer( LVN')
-- CpuId
table.insert(procedure_lines, 'VMProtect.CpuId::Invoke( AV')
-- String Manager
table.insert(procedure_lines, 'VMProtect.StringManager::.ctor( AV')
table.insert(procedure_lines, 'VMProtect.StringManager:: AVN')
-- Resource Manager
table.insert(procedure_lines, 'VMProtect.ResourceManager::.ctor( AV')
table.insert(procedure_lines, 'VMProtect.ResourceManager::DecryptData( AM')
table.insert(procedure_lines, 'VMProtect.ResourceManager:: AV')
-- HardwareID
table.insert(procedure_lines, 'VMProtect.HardwareID::.ctor( AV')
table.insert(procedure_lines, 'VMProtect.HardwareID::ToString( AV')
table.insert(procedure_lines, 'VMProtect.HardwareID:: AVN')
-- Licensing Manager
table.insert(procedure_lines, 'VMProtect.LicensingManager::.ctor( AV')
table.insert(procedure_lines, 'VMProtect.LicensingManager:: LVN')
table.insert(procedure_lines, 'VMProtect.LicensingManager/ActivationRequest:: LV')
table.insert(procedure_lines, 'VMProtect.LicensingManager/DeactivationRequest:: LV')
table.insert(procedure_lines, 'VMProtect.LicensingManager/BaseRequest::Send( LV')
-- Loader
table.insert(procedure_lines, 'VMProtect.Loader::FindFirmwareVendor( IM')
table.insert(procedure_lines, 'VMProtect.Loader:: IVN')
table.insert(procedure_lines, 'VMProtect.GlobalData::Set IVN')
table.insert(procedure_lines, 'VMProtect.GlobalData:: IV')
table.insert(procedure_lines, 'SevenZip.Compression. IM')
table.insert(procedure_lines, 'VMProtect.Win32::GetProcAddress( IM')
table.insert(procedure_lines, 'VMProtect.Win32:: IV')
table.insert(procedure_lines, 'VMProtect.Win32/ IV')
else
-- Crypto
table.insert(procedure_lines, 'RC5Key:: A')
table.insert(procedure_lines, 'CipherRC5::CipherRC5( A')
table.insert(procedure_lines, 'CipherRC5::Encrypt( AM')
table.insert(procedure_lines, 'CipherRC5::Decrypt( AM')
table.insert(procedure_lines, 'CryptoContainer:: A')
table.insert(procedure_lines, 'SHA1:: A')
table.insert(procedure_lines, 'BigNumber::internal_mul( LMR')
table.insert(procedure_lines, 'BigNumber::internal_mod( LMR')
table.insert(procedure_lines, 'BigNumber:: LVN')
table.insert(procedure_lines, 'CalcCRC( AM')
-- Strings
table.insert(procedure_lines, 'string "')
-- Core
table.insert(procedure_lines, 'Core:: AV')
table.insert(procedure_lines, 'DllMain AV')
table.insert(procedure_lines, '_DllMain AV')
table.insert(procedure_lines, 'InternalGetProcAddress( A')
table.insert(procedure_lines, 'ShowMessage( AV')
table.insert(procedure_lines, 'ExportedIsValidImageCRC AVR')
table.insert(procedure_lines, 'CRCData::CRCData( AVN')
table.insert(procedure_lines, 'InternalFindFirmwareVendor AM')
table.insert(procedure_lines, 'ExportedIsVirtualMachinePresent AVR')
table.insert(procedure_lines, 'ExportedIsDebuggerPresent AVR')
table.insert(procedure_lines, 'ExportedIsProtected AVR')
table.insert(procedure_lines, 'CoreData::CoreData( AVN')
table.insert(procedure_lines, 'HookedNtProtectVirtualMemory( AM')
table.insert(procedure_lines, 'HookedNtClose( AM')
table.insert(procedure_lines, 'ExAllocateNonPagedPoolNx( AM')
-- Loader
table.insert(procedure_lines, 'SetupImage IVN')
table.insert(procedure_lines, 'FreeImage IV')
table.insert(procedure_lines, 'SETUP_IMAGE_DATA:: IVN')
table.insert(procedure_lines, 'LoaderMessage IVN')
table.insert(procedure_lines, 'Loader IM')
table.insert(procedure_lines, 'Lzma IM')
table.insert(procedure_lines, '_Lzma IM')
-- String Manager
table.insert(procedure_lines, 'VirtualString::VirtualString( AM')
table.insert(procedure_lines, 'VirtualString:: AVN')
table.insert(procedure_lines, 'VirtualStringList:: AVN')
table.insert(procedure_lines, 'StringManager:: AVN')
table.insert(procedure_lines, 'ExportedDecryptString AMR')
table.insert(procedure_lines, 'ExportedFreeString AMR')
-- Resource Manager
table.insert(procedure_lines, 'VirtualResource::Decrypt( EM')
table.insert(procedure_lines, 'VirtualResource:: EVN')
table.insert(procedure_lines, 'VirtualResourceList:: EVN')
table.insert(procedure_lines, 'ResourceManager:: EVN')
table.insert(procedure_lines, 'HookedLdrFindResource_U( EM')
table.insert(procedure_lines, 'HookedLdrAccessResource( EM')
table.insert(procedure_lines, 'HookedLoadStringA( EM')
table.insert(procedure_lines, 'HookedLoadStringW( EM')
table.insert(procedure_lines, 'ExportedLoadResource EMR')
table.insert(procedure_lines, 'ExportedFindResourceA EMR')
table.insert(procedure_lines, 'ExportedFindResourceExA EMR')
table.insert(procedure_lines, 'ExportedFindResourceW EMR')
table.insert(procedure_lines, 'ExportedFindResourceExW EMR')
table.insert(procedure_lines, 'ExportedLoadStringA EMR')
table.insert(procedure_lines, 'ExportedLoadStringW EMR')
table.insert(procedure_lines, 'ExportedEnumResourceNamesA EMR')
table.insert(procedure_lines, 'ExportedEnumResourceNamesW EMR')
table.insert(procedure_lines, 'ExportedEnumResourceLanguagesA EMR')
table.insert(procedure_lines, 'ExportedEnumResourceLanguagesW EMR')
table.insert(procedure_lines, 'ExportedEnumResourceTypesA EMR')
table.insert(procedure_lines, 'ExportedEnumResourceTypesW EMR')
-- Licensing Manager
table.insert(procedure_lines, 'LicensingManager:: L')
table.insert(procedure_lines, 'ActivationRequest:: L')
table.insert(procedure_lines, 'DeactivationRequest:: L')
table.insert(procedure_lines, 'BaseRequest::Send( LVR')
table.insert(procedure_lines, 'ExportedSetSerialNumber LVR')
table.insert(procedure_lines, 'ExportedGetSerialNumberState LVR')
table.insert(procedure_lines, 'ExportedGetSerialNumberData LVR')
table.insert(procedure_lines, 'ExportedActivateLicense LVR')
table.insert(procedure_lines, 'ExportedDeactivateLicense LVR')
table.insert(procedure_lines, 'ExportedGetOfflineActivationString LVR')
table.insert(procedure_lines, 'ExportedGetOfflineDeactivationString LVR')
table.insert(procedure_lines, 'ExportedDecryptBuffer LVR')
-- HardwareID
table.insert(procedure_lines, 'HardwareID:: L')
table.insert(procedure_lines, 'ExportedGetCurrentHWID LVR')
-- File Manager
table.insert(procedure_lines, 'FileManager::ReadFile( BM')
table.insert(procedure_lines, 'FileManager::ReadImage( BM')
table.insert(procedure_lines, 'FileManager:: BVN')
table.insert(procedure_lines, 'HookedNtQueryAttributesFile( BM')
table.insert(procedure_lines, 'HookedNtCreateFile( BM')
table.insert(procedure_lines, 'HookedNtOpenFile( BM')
table.insert(procedure_lines, 'HookedNtReadFile( BM')
table.insert(procedure_lines, 'HookedNtQueryInformationFile( BM')
table.insert(procedure_lines, 'HookedNtQueryVolumeInformationFile( BM')
table.insert(procedure_lines, 'HookedNtSetInformationFile( BM')
table.insert(procedure_lines, 'HookedNtQueryDirectoryFile( BM')
table.insert(procedure_lines, 'HookedNtCreateSection( BM')
table.insert(procedure_lines, 'HookedNtQuerySection( BM')
table.insert(procedure_lines, 'HookedNtMapViewOfSection( BM')
table.insert(procedure_lines, 'HookedNtUnmapViewOfSection( BM')
table.insert(procedure_lines, 'HookedNtQueryVirtualMemory( BM')
-- Registry Manager
table.insert(procedure_lines, 'RegistryManager:: RM')
table.insert(procedure_lines, 'RegistryKey:: RM')
table.insert(procedure_lines, 'HookedNtSetValueKey( RM')
table.insert(procedure_lines, 'HookedNtDeleteValueKey( RM')
table.insert(procedure_lines, 'HookedNtCreateKey( RM')
table.insert(procedure_lines, 'HookedNtOpenKey( RM')
table.insert(procedure_lines, 'HookedNtOpenKeyEx( RM')
table.insert(procedure_lines, 'HookedNtQueryValueKey( RM')
table.insert(procedure_lines, 'HookedNtDeleteKey( RM')
table.insert(procedure_lines, 'HookedNtQueryKey( RM')
table.insert(procedure_lines, 'HookedNtEnumerateValueKey( RM')
table.insert(procedure_lines, 'HookedNtEnumerateKey( RM')
-- Hook Manager
table.insert(procedure_lines, 'HookManager:: AV')
table.insert(procedure_lines, 'HookedAPI:: AVN')
end
map_functions = file:mapFunctions()
functions = file:functions()
functions:clear()
function_params = {}
for _, line in ipairs(procedure_lines) do
if (line:len() == 0 or line:sub(1, 1) == "#") then
-- do nothing
else
i = line:find(" ")
params = ""
compilation_type = CompilationType.Virtualization
if (i) then
name = line:sub(1, i - 1)
params = line:sub(i + 1)
if (params:len() > 1) then
if (params:sub(2, 2) == "M") then
compilation_type = CompilationType.Mutation
end
end
else
name = line
end
is_found = false
for i = 1, map_functions:count() do
map_function = map_functions:item(i)
if (map_function:name():sub(1, name:len()) == name) then
is_found = true
if (not functions:itemByAddress(map_function:address())) then
func = functions:addByAddress(map_function:address(), compilation_type, false)
if (func) then
function_params[tostring(func:address())] = params
end
end
end
end
if (not is_found) then
print(string.format("%s not found!!!", name))
end
end
end
--
code_data = ""
-- process exports
export_names = {}
if (file:name() == ".NET") then
table.insert(export_names, "void VMProtect.Loader::Main()")
table.insert(export_names, "string VMProtect.Core::DecryptString()")
table.insert(export_names, "string VMProtect.Core::DecryptString()")
table.insert(export_names, "bool VMProtect.Core::FreeString(string&)")
table.insert(export_names, "valuetype VMProtect.SerialState VMProtect.Core::SetSerialNumber(string)")
table.insert(export_names, "valuetype VMProtect.SerialState VMProtect.Core::GetSerialNumberState()")
table.insert(export_names, "bool VMProtect.Core::GetSerialNumberData(class VMProtect.SerialNumberData&)")
table.insert(export_names, "string VMProtect.Core::GetCurrentHWID()")
table.insert(export_names, "valuetype VMProtect.ActivationStatus VMProtect.Core::ActivateLicense(string, string&)")
table.insert(export_names, "valuetype VMProtect.ActivationStatus VMProtect.Core::DeactivateLicense(string)")
table.insert(export_names, "valuetype VMProtect.ActivationStatus VMProtect.Core::GetOfflineActivationString(string, string&)")
table.insert(export_names, "valuetype VMProtect.ActivationStatus VMProtect.Core::GetOfflineDeactivationString(string, string&)")
table.insert(export_names, "bool VMProtect.Core::IsValidImageCRC()")
table.insert(export_names, "bool VMProtect.Core::IsDebuggerPresent(bool)")
table.insert(export_names, "bool VMProtect.Core::IsVirtualMachinePresent()")
table.insert(export_names, "unsigned int32 VMProtect.Core::DecryptBuffer(unsigned int32, unsigned int32, unsigned int32, unsigned int32)")
table.insert(export_names, "bool VMProtect.Core::IsProtected()")
table.insert(export_names, "unsigned int32 VMProtect.GlobalData::SessionKey()")
table.insert(export_names, "int32 VMProtect.VirtualMachine/Utils::Random()")
table.insert(export_names, "int32 VMProtect.VirtualMachine/Utils::CalcCRC(unsigned int32, unsigned int32)")
table.insert(export_names, "object VMProtect.VirtualMachine/Utils::BoxPointer(void*)")
table.insert(export_names, "void* VMProtect.VirtualMachine/Utils::UnboxPointer(object)")
else
table.insert(export_names, "SetupImage")
table.insert(export_names, "FreeImage")
table.insert(export_names, "ExportedDecryptString")
table.insert(export_names, "ExportedDecryptString")
table.insert(export_names, "ExportedFreeString")
table.insert(export_names, "ExportedSetSerialNumber")
table.insert(export_names, "ExportedGetSerialNumberState")
table.insert(export_names, "ExportedGetSerialNumberData")
table.insert(export_names, "ExportedGetCurrentHWID")
table.insert(export_names, "ExportedActivateLicense")
table.insert(export_names, "ExportedDeactivateLicense")
table.insert(export_names, "ExportedGetOfflineActivationString")
table.insert(export_names, "ExportedGetOfflineDeactivationString")
table.insert(export_names, "ExportedIsValidImageCRC")
table.insert(export_names, "ExportedIsDebuggerPresent")
table.insert(export_names, "ExportedIsVirtualMachinePresent")
table.insert(export_names, "ExportedDecryptBuffer")
table.insert(export_names, "ExportedIsProtected")
table.insert(export_names, "CalcCRC")
if file:file():format() == "PE" then
table.insert(export_names, "LoaderData")
table.insert(export_names, "ExportedLoadResource")
table.insert(export_names, "ExportedFindResourceA")
table.insert(export_names, "ExportedFindResourceExA")
table.insert(export_names, "ExportedFindResourceW")
table.insert(export_names, "ExportedFindResourceExW")
table.insert(export_names, "ExportedLoadStringA")
table.insert(export_names, "ExportedLoadStringW")
table.insert(export_names, "ExportedEnumResourceNamesA")
table.insert(export_names, "ExportedEnumResourceNamesW")
table.insert(export_names, "ExportedEnumResourceLanguagesA")
table.insert(export_names, "ExportedEnumResourceLanguagesW")
table.insert(export_names, "ExportedEnumResourceTypesA")
table.insert(export_names, "ExportedEnumResourceTypesW")
elseif file:file():format() == "Mach-O" then
table.insert(export_names, "_loader_data")
table.insert(export_names, "DllMain")
else
table.insert(export_names, "loader_data")
table.insert(export_names, "DllMain")
end
end
count = 0
data = ""
for _, line in ipairs(export_names) do
export = file:exports():itemByName(line)
if (export) then
data = data .. DWordToChar(export:address() - file:imageBase())
count = count + 1
else
print(line .. " not found!!!")
end
end
code_data = code_data .. DWordToChar(count) .. data
-- process SDK
imports = file:imports()
sdk_indexes = {}
count = 0
data = ""
for i = 1, imports:count() do
import = imports:item(i)
if (import:isSDK()) then
table.insert(sdk_indexes, i)
for j = 1, import:count() do
import_function = import:item(j)
map_function = map_functions:itemByAddress(import_function:address())
if (map_function) then
data = data .. ByteToChar(import_function:type())
data = data .. DWordToChar(import_function:address() - file:imageBase())
count = count + 1
references = map_function:references()
data = data .. DWordToChar(references:count())
for k = 1, references:count() do
reference = references:item(k)
data = data .. DWordToChar(reference:address() - file:imageBase())
data = data .. DWordToChar(reference:operandAddress() - file:imageBase())
end
references:clear()
end
end
end
end
code_data = code_data .. DWordToChar(count) .. data
-- process import references
count = 0
data = ""
for i = 1, imports:count() do
import = imports:item(i)
for j = 1, import:count() do
import_function = import:item(j)
map_function = map_functions:itemByAddress(import_function:address())
if (map_function) then
references = map_function:references()
for k = references:count(), 1, -1 do
reference = references:item(k)
is_found = false
for p = 1, functions:count() do
if (functions:item(p):itemByAddress(reference:address(), true)) then
is_found = true
break
end
end
if (is_found) then
sdk_count = 0;
for _, sdk_index in ipairs(sdk_indexes) do
if (i > sdk_index) then
sdk_count = sdk_count + 1
end
end
data = data .. DWordToChar(i - sdk_count) .. DWordToChar(j)
data = data .. DWordToChar(reference:address() - file:imageBase())
data = data .. DWordToChar(reference:operandAddress() - file:imageBase())
count = count + 1
references:delete(k)
end
end
end
end
end
code_data = code_data .. DWordToChar(count) .. data
-- process strings
count = 0
data = ""
for i = 1, map_functions:count() do
map_function = map_functions:item(i)
if (map_function:type() == ObjectType.String) then
data = data .. DWordToChar(map_function:address() - file:imageBase())
data = data .. DWordToChar(map_function:address() + map_function:size() - file:imageBase())
count = count + 1
references = map_function:references()
data = data .. DWordToChar(references:count())
for k = 1, references:count() do
reference = references:item(k)
data = data .. DWordToChar(reference:address() - file:imageBase())
data = data .. DWordToChar(reference:operandAddress() - file:imageBase())
data = data .. ByteToChar(reference:tag())
end
end
end
code_data = code_data .. DWordToChar(count) .. data
-- process functions
count = 0
data = ""
for k = 1, functions:count() do
func = functions:item(k)
if (not func:needCompile()) then
count = count + 1
params = function_params[tostring(func:address())]
if (not params) then
params = ""
end
t = 0
if (params:len() > 0) then
if (params:sub(1, 1) == "L") then
t = 1
elseif (params:sub(1, 1) == "B") then
t = 2
elseif (params:sub(1, 1) == "R") then
t = 3
elseif (params:sub(1, 1) == "E") then
t = 4
elseif (params:sub(1, 1) == "I") then
t = 5
elseif (params:sub(1, 1) == "P") then
t = 6
end
end
e = 0
if (params:len() > 2) then
if (params:sub(3, 3) == "N") then
e = 1
elseif (params:sub(3, 3) == "R") then
e = 2
end
end
data = data .. ByteToChar(t)
.. ByteToChar(func:compilationType()
+ Ord(e == 1) * 0x10
+ Ord(e == 2) * 0x20
+ 0x80)
.. ByteToChar(func:type())
.. ByteToChar(file:cpuAddressSize())
.. DWordToChar(func:address() - file:imageBase())
data = data .. DWordToChar(func:count())
for i = 1, func:count() do
command = func:item(i)
if (file:name() == ".NET") then
-- IL
p = 0;
if (command:operandValue() > 0) then
p = 1
end
data = data .. ByteToChar(p
+ Ord(command:tokenReference()) * 0x08
+ Ord(command:size() > 255) * 0x10
+ Ord(command:link()) * 0x20)
.. DWordToChar(command:address() - file:imageBase())
.. WordToChar(command:type())
.. DWordToChar(command:options())
.. ByteToChar(command:alignment())
if (command:size() > 255) then
data = data .. WordToChar(command:size())
else
data = data .. ByteToChar(command:size())
end
if (command:type() == ILCommandType.Comment or command:type() == ILCommandType.Data) then
for j = 1, command:size() do
data = data .. ByteToChar(command:dump(j))
end
end
if (p > 0) then
data = data .. QWordToChar(command:operandValue())
end
else
-- Intel
if (command:type() == IntelCommandType.Lods or
command:type() == IntelCommandType.Stos or
command:type() == IntelCommandType.Scas or
command:type() == IntelCommandType.Movs or
command:type() == IntelCommandType.Cmps or
command:type() == IntelCommandType.Ins or
command:type() == IntelCommandType.Outs) then
p = 2
elseif (command:type() == IntelCommandType.Pusha or
command:type() == IntelCommandType.Popa or
command:type() == IntelCommandType.Pushf or
command:type() == IntelCommandType.Popf) then
p = 1
else
p = 0
for j = 1, 3 do
operand = command:operand(j)
if (operand:type() == OperandType.None) then
break
end
p = p + 1
end
end
data = data .. ByteToChar(p
+ Ord(command:preffix() ~= 0) * 0x8
+ Ord(command:size() > 255) * 0x10
+ Ord(command:link()) * 0x20
+ Ord(command:baseSegment() ~= IntelSegment.Default) * 0x40
+ Ord(command:flags() ~= 0) * 0x80)
.. DWordToChar(command:address() - file:imageBase())
.. WordToChar(command:type())
.. DWordToChar(command:options())
.. ByteToChar(command:alignment())
if (command:preffix() ~= 0) then
data = data .. WordToChar(command:preffix())
end
if (command:size() > 255) then
data = data .. WordToChar(command:size())
else
data = data .. ByteToChar(command:size())
end
if (command:baseSegment() ~= IntelSegment.Default) then
data = data .. ByteToChar(command:baseSegment())
end
if (command:flags() ~= 0) then
data = data .. WordToChar(command:flags())
end
if (command:type() == IntelCommandType.Db) then
for j = 1, command:size() do
data = data .. ByteToChar(command:dump(j))
end
else
r = 0
if (command:type() == IntelCommandType.Jmp or
command:type() == IntelCommandType.Call or
command:type() == IntelCommandType.Loop or
command:type() == IntelCommandType.Loope or
command:type() == IntelCommandType.Loopne or
command:type() == IntelCommandType.Jxx or
command:type() == IntelCommandType.Jcxz) then
operand = command:operand(1)
if (operand:type() == OperandType.Value) then
r = 1
end
end
for j = 1, p do
operand = command:operand(j)
address_size = operand:addressSize()
if bit32.btest(operand:type(), OperandType.Memory) then
address_size = operand:addressSize()
else
address_size = 0
end
if operand:fixup() then
fixup = 1
elseif operand:isLargeValue() then
fixup = 2
else
fixup = 0
end
data = data .. ByteToChar(operand:size())
.. WordToChar(operand:type()
+ Ord(j == r) * 0x1000
+ Ord(address_size ~= file:cpuAddressSize()) * 0x2000
+ Ord(operand:scale() > 0) * 0x4000
+ Ord(fixup > 0) * 0x8000)
if (bit32.btest(operand:type(), OperandType.Registr
+ OperandType.SegmentRegistr
+ OperandType.ControlRegistr
+ OperandType.DebugRegistr
+ OperandType.FPURegistr
+ OperandType.HiPartRegistr
+ OperandType.MMXRegistr
+ OperandType.XMMRegistr)) then
data = data .. ByteToChar(operand:registr())
end
if (bit32.btest(operand:type(), OperandType.BaseRegistr)) then
data = data .. ByteToChar(operand:baseRegistr())
end
if (bit32.btest(operand:type(), OperandType.Value)) then
data = data .. ByteToChar(operand:valueSize())
if (j == r or fixup > 0) then
data = data .. DWordToChar(operand:value() - file:imageBase())
else
value_size = operand:valueSize()
if (value_size == OperandSize.Byte) then
data = data .. ByteToChar(operand:value())
elseif (value_size == OperandSize.Word) then
data = data .. WordToChar(operand:value())
elseif (value_size == OperandSize.DWord) then
data = data .. DWordToChar(operand:value())
elseif (value_size == OperandSize.QWord) then
data = data .. QWordToChar(operand:value())
end
end
if (fixup > 0) then
data = data .. ByteToChar(fixup)
end
end
if (bit32.btest(operand:type(), OperandType.Memory)) then
if (operand:scale() ~= 0) then
data = data .. ByteToChar(operand:scale())
end
if (operand:addressSize() ~= file:cpuAddressSize()) then
data = data .. ByteToChar(operand:addressSize())
end
end
end
end
end
end
data = data .. DWordToChar(func:info():count())
for i = 1, func:info():count() do
info = func:info():item(i)
if (info:entry()) then
entry_index = func:indexOf(info:entry())
else
entry_index = 0
end
if (info:dataEntry()) then
data_entry_index = func:indexOf(info:dataEntry())
else
data_entry_index = 0
end
data = data .. DWordToChar(info:beginAddress() - file:imageBase())
.. DWordToChar(info:endAddress() - file:imageBase())
.. ByteToChar(info:baseType())
if (info:baseType() == 0) then
data = data .. DWordToChar(info:baseValue())
end
data = data .. DWordToChar(info:prologSize())
.. ByteToChar(info:frameRegistr())
.. DWordToChar(entry_index)
.. DWordToChar(data_entry_index)
.. DWordToChar(info:unwindOpcodes():count())
for j = 1, info:unwindOpcodes():count() do
data = data .. DWordToChar(func:indexOf(info:unwindOpcodes():item(j)))
end
end
data = data .. DWordToChar(func:ranges():count())
for i = 1, func:ranges():count() do
range = func:ranges():item(i)
if (range:beginEntry()) then
begin_index = func:indexOf(range:beginEntry())
else
begin_index = 0
end
if (range:endEntry()) then
end_index = func:indexOf(range:endEntry())
else
end_index = 0
end
if (range:sizeEntry()) then
size_index = func:indexOf(range:sizeEntry())
else
size_index = 0
end
data = data .. DWordToChar(range:beginAddress() - file:imageBase())
.. DWordToChar(range:endAddress() - file:imageBase())
.. DWordToChar(begin_index)
.. DWordToChar(end_index)
.. DWordToChar(size_index)
end
data = data .. DWordToChar(func:links():count())
for i = 1, func:links():count() do
link = func:links():item(i)
data = data .. DWordToChar(func:indexOf(link:from()))
.. ByteToChar(link:type())
.. ByteToChar(link:operand())
.. ByteToChar(Ord(link:toAddress() > 0)
+ Ord(link:subValue() > 0) * 0x2
+ Ord(link:parent()) * 0x4
+ Ord(link:baseInfo()) * 0x8)
if (link:toAddress() > 0) then
data = data .. DWordToChar(link:toAddress() - file:imageBase())
end
if (link:subValue() > 0) then
data = data .. DWordToChar(link:subValue() - file:imageBase())
end
if (link:parent()) then
data = data .. DWordToChar(func:indexOf(link:parent()))
end
if (link:baseInfo()) then
data = data .. DWordToChar(func:info():indexOf(link:baseInfo()))
end
end
end
end
code_data = code_data .. DWordToChar(count) .. data
if (file:file():format() == "PE") then
-- process CFG addresses
count = 0
data = ""
if (file:name() ~= ".NET") then
cfg_names = {}
table.insert(cfg_names, "_freefls")
table.insert(cfg_names, "__freefls@4")
for _, line in ipairs(cfg_names) do
map_function = map_functions:itemByName(line)
if (map_function) then
data = data .. DWordToChar(map_function:address() - file:imageBase())
count = count + 1
else
print(line .. " not found!!!")
end
end
end
code_data = code_data .. DWordToChar(count) .. data
end]]>
</Script>
<DLLBox />
<LicenseManager ProductCode="" />
</Document>