-
Notifications
You must be signed in to change notification settings - Fork 0
/
mte64.h
161 lines (161 loc) · 3.56 KB
/
mte64.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
/* This file was automatically generated. Do not edit! */
#undef INTERFACE
typedef struct mut_output mut_output;
typedef struct mut_input mut_input;
mut_output *mut_engine(mut_input *f_in,mut_output *f_out);
uint32_t integer_inverse(uint32_t a);
#define LOCAL static
typedef union mrm_t mrm_t;
enum reg16_t {
REG_AX = 0,
REG_CX,
REG_DX,
REG_BX,
REG_SP,
REG_BP,
REG_SI,
REG_DI
};
typedef enum reg16_t reg16_t;
enum mrm_mode_t {
MRM_MODE_INDEX = 0,
MRM_MODE_INDEX_DISP8,
MRM_MODE_INDEX_DISP32,
MRM_MODE_REGISTER
};
typedef enum mrm_mode_t mrm_mode_t;
enum opcode_80_t {
OPCODE_80_ADD = 0,
OPCODE_80_OR,
OPCODE_80_ADC,
OPCODE_80_SBB,
OPCODE_80_AND,
OPCODE_80_SUB,
OPCODE_80_XOR
};
typedef enum opcode_80_t opcode_80_t;
enum opcode_f7_t {
OPCODE_F7_TEST_IMM = 0,
OPCODE_F7_TEST_IMM_ALT,
OPCODE_F7_NOT,
OPCODE_F7_NEG,
OPCODE_F7_MUL,
OPCODE_F7_IMUL,
OPCODE_F7_DIV,
OPCODE_F7_IDIV
};
typedef enum opcode_f7_t opcode_f7_t;
enum reg8_t {
REG_AL = 0,
REG_CL,
REG_DL,
REG_BL,
REG_AH,
REG_CH,
REG_DH,
REG_BH
};
typedef enum reg8_t reg8_t;
union mrm_t {
uint8_t byte;
struct {
// note to self: bitfields are right to left
reg16_t reg : 3;
reg16_t reg1 : 3;
mrm_mode_t mod : 2;
};
struct {
reg16_t reg : 3;
opcode_80_t op : 3;
mrm_mode_t mod : 2;
} op_80;
struct {
reg16_t reg : 3;
opcode_f7_t op : 3;
mrm_mode_t mod : 2;
} op_f7;
struct {
reg8_t reg8 : 3;
reg8_t reg1_8 : 3;
mrm_mode_t : 2;
} mrm_8;
};
enum opcode_t {
OPCODE_ADD = 0x03,
OPCODE_OR = 0x0B,
OPCODE_AND = 0x23,
OPCODE_SUB = 0x2B,
OPCODE_XOR = 0x33,
OPCODE_MOV_IMM8 = 0xB0,
OPCODE_MOV_IMM16 = 0xB8,
OPCODE_MOV_REG_MRM8 = 0x8A,
OPCODE_MOV_REG_MRM16 = 0x8B
};
typedef enum opcode_t opcode_t;
enum op_t {
// loads and stores
OP_DATA, // mov ptr_reg,data_reg || mov data_reg,ptr_reg
OP_START_OR_END, // mov ptr,imm || mov data,ptr
OP_POINTER, // mov [ptr],data_reg || mov data_reg,[ptr]
// invertible ops
OP_SUB,
OP_ADD,
OP_XOR,
OP_MUL,
OP_ROL,
OP_ROR,
// junk ops
OP_SHL,
OP_SHR,
OP_OR,
OP_AND,
OP_IMUL,
// dummy jump
OP_JNZ
};
typedef enum op_t op_t;
enum reg_set_t { REG_SET_BUSY = 0,
REG_SET_FREE = 0xff };
typedef enum reg_set_t reg_set_t;
#define LOCAL_INTERFACE 0
struct mut_output {
uint8_t* code; // ds:DX
unsigned int len; // CX
unsigned int decrypted_len; // AX
uint8_t* routine_end; // DI
uint8_t* loop_start; // SI
};
enum mut_flags_t {
MUT_FLAGS_PRESERVE_AX = 0x001,
MUT_FLAGS_PRESERVE_CX = 0x002,
MUT_FLAGS_PRESERVE_DX = 0x004,
MUT_FLAGS_PRESERVE_BX = 0x008,
MUT_FLAGS_PRESERVE_SP = 0x010,
MUT_FLAGS_PRESERVE_BP = 0x020,
MUT_FLAGS_PRESERVE_SI = 0x040,
MUT_FLAGS_PRESERVE_DI = 0x080,
MUT_FLAGS_RUN_ON_DIFFERENT_CPU = 0x100, // NOTUSED
MUT_FLAGS_CS_IS_NOT_DS = 0x200, // NOTUSED
MUT_FLAGS_CS_IS_NOT_SS = 0x400, // NOTUSED
MUT_FLAGS_DONT_ALIGN = 0x800, // paragraph boundary alignment
};
typedef enum mut_flags_t mut_flags_t;
enum mut_routine_size_t {
MUT_ROUTINE_SIZE_TINY = 0x1,
MUT_ROUTINE_SIZE_SMALL = 0x3,
MUT_ROUTINE_SIZE_MEDIUM = 0x7,
MUT_ROUTINE_SIZE_BIG = 0xf
};
typedef enum mut_routine_size_t mut_routine_size_t;
struct mut_input {
uint8_t* code; // ds:DX
unsigned int len; // CX
uintptr_t exec_offset; // BP
uintptr_t entry_offset; // DI
uintptr_t payload_offset; // SI
mut_flags_t flags; // AX
mut_routine_size_t routine_size;
};
#define MAX_ADD_LEN 25
#define MAX_ADD 512
#define INTERFACE 0