cobf.hpp

Go to the documentation of this file.

 
#ifndef COBF_HPP
#define COBF_HPP
 
// Includes.
#include <shellcode.hpp>
#include <utils.hpp>
#include <algorithm>
#include <string>
#include <vector>
#include <map>
using namespace std;
 
class cobf
{
private:
 
    // Each symbol.
    class csym {
    private:
 
        string          sym_name;       
        DWORD           dll_rva;        
        WORD            sym_ord;        
        DWORD           fth_rva;        
        DWORD           oth_off;        
        DWORD           name_off;       
        BOOL            by_name;        
        BOOL            obfuscated;     
        string          obf_name;       
        WORD            obf_ord;        
        BOOL            to_name;        
    public:
 
        static BOOL match_wildcard(PCCH wild_card, PCCH string);
 
        csym(string sym_name, DWORD dll_rva, DWORD fth_rva, DWORD oth_off, DWORD name_off);
 
        csym(WORD sym_ord, DWORD dll_rva, DWORD fth_rva, DWORD oth_off);
 
        BOOL check_sym(string n_sym);
 
        BOOL check_sym(WORD n_ord);
 
        VOID obfuscate(string o_sym);
 
        VOID obfuscate(WORD o_ord);
 
        VOID unobfuscate();
 
        VOID apply_obfuscation(PBYTE pe_rawf, DWORD strings_off, vector<BYTE>& strings,
            vector<shellcode::obfuscated_sym>& symbols);
    };
 
    // Each module.
    struct cmod {
        string          dll_name;       
        vector<csym>    mod_syms;       
    };
 
    string          pe_path;    
    vector<BYTE>    pe_rawf;    
    vector<cmod>    pe_mods;    
    BOOL disable_the_relocation();
 
    BOOL remove_debug_symbols();
 
    BOOL make_the_iat_writable();
 
    template <typename t_sym_info>
    VOID find_symbols(string dll_name, t_sym_info sym_info, vector<csym*>& p_syms);
 
    BOOL add_shellcode_entry(PIMAGE_SECTION_HEADER& sh_sec, DWORD entry);
    
    BOOL section_of_rva(DWORD rva, PIMAGE_SECTION_HEADER& sec);
 
    BOOL rva_to_offset(DWORD rva, DWORD& offset);
 
    BOOL rva_to_ptr(DWORD ptr_rva, PVOID* p_ptr);
 
    BOOL create_shellcode_section(PIMAGE_SECTION_HEADER& sh_sec, DWORD& funs_rva);
 
    BOOL get_data_table(size_t data_entry, PVOID* p_table_ptr, size_t& table_size);
 
    BOOL get_dos_header(PIMAGE_DOS_HEADER& dos_hdr);
 
    BOOL get_nt_headers(PIMAGE_DOS_HEADER dos_hdr, PIMAGE_NT_HEADERS& nt_hdrs);
 
    BOOL verify_machine(PIMAGE_NT_HEADERS nt_hdrs);
 
    BOOL verify_sections(PIMAGE_DOS_HEADER dos_hdr, PIMAGE_NT_HEADERS nt_hdrs);
 
    BOOL insert_import(cmod& dll_mod, DWORD dll_off, size_t th_sym, DWORD fth_rva, DWORD oth_off);
 
    BOOL parse_imports(PIMAGE_IMPORT_DESCRIPTOR p_imports, size_t imports_size);
 
    VOID apply_obfuscations(PIMAGE_SECTION_HEADER& sh_sec, DWORD& syms_rva);
 
    VOID add_shellcode_stub(PIMAGE_SECTION_HEADER& sh_sec, DWORD funs_offset, DWORD syms_rva, DWORD& entry);
 
    VOID finalize_pe(PIMAGE_SECTION_HEADER& sh_sec);
 
    template <typename t_sym_info, typename t_obf_info>
    cobf_error obf_sym_internal(string dll_name, t_sym_info sym_info, t_obf_info obf_info);
 
    template <typename t_sym_info>
    cobf_error unobf_sym_internal(string dll_name, t_sym_info sym_info);
 
public:
    cobf(string pe_path);
 
    cobf_error load_pe();
 
    cobf_error unload_pe();
 
    cobf_error obf_sym(string dll_name, string sym_name, string obf_name);
 
    cobf_error obf_sym(string dll_name, string sym_name, WORD obf_ord);
 
    cobf_error obf_sym(string dll_name, WORD sym_ord, WORD obf_ord);
 
    cobf_error obf_sym(string dll_name, WORD sym_ord, string obf_name);
 
    cobf_error unobf_sym(string dll_name, string sym_name);
 
    cobf_error unobf_sym(string dll_name, WORD sym_ord);
 
    cobf_error generate(string out_file);
};
 
#endif // !COBF_HPP.