├── .gitignore
├── LICENSE
├── README.md
├── src
├── BranchAddressEncryptor
│ ├── BranchAddressEncryptor.cpp
│ ├── BranchAddressEncryptor.hpp
│ └── CMakeLists.txt
├── CMakeLists.txt
├── Common
│ ├── CMakeLists.txt
│ ├── LLVMType.hpp
│ ├── Util.cpp
│ └── Util.hpp
├── DynamicCallConverter
│ ├── CMakeLists.txt
│ ├── DynamicCallConverter.cpp
│ └── DynamicCallConverter.hpp
├── FakeInstructionInserter
│ ├── CMakeLists.txt
│ ├── FakeInstructionInserter.cpp
│ └── FakeInstructionInserter.hpp
├── RegisterPass.cpp
└── StringEncryptor
│ ├── CMakeLists.txt
│ ├── StringEncryptor.cpp
│ └── StringEncryptor.hpp
└── windows
├── CodeLabyrinth.sln
├── CodeLabyrinth.vcxproj
├── CodeLabyrinth.vcxproj.filters
└── Directory.build.props
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.rsuser
8 | *.suo
9 | *.user
10 | *.userosscache
11 | *.sln.docstates
12 |
13 | # User-specific files (MonoDevelop/Xamarin Studio)
14 | *.userprefs
15 |
16 | # Mono auto generated files
17 | mono_crash.*
18 |
19 | # Build results
20 | [Dd]ebug/
21 | [Dd]ebugPublic/
22 | [Rr]elease/
23 | [Rr]eleases/
24 | x64/
25 | x86/
26 | [Ww][Ii][Nn]32/
27 | [Aa][Rr][Mm]/
28 | [Aa][Rr][Mm]64/
29 | bld/
30 | [Bb]in/
31 | [Oo]bj/
32 | [Ll]og/
33 | [Ll]ogs/
34 |
35 | # Visual Studio 2015/2017 cache/options directory
36 | .vs/
37 | # Uncomment if you have tasks that create the project's static files in wwwroot
38 | #wwwroot/
39 |
40 | # Visual Studio 2017 auto generated files
41 | Generated\ Files/
42 |
43 | # MSTest test Results
44 | [Tt]est[Rr]esult*/
45 | [Bb]uild[Ll]og.*
46 |
47 | # NUnit
48 | *.VisualState.xml
49 | TestResult.xml
50 | nunit-*.xml
51 |
52 | # Build Results of an ATL Project
53 | [Dd]ebugPS/
54 | [Rr]eleasePS/
55 | dlldata.c
56 |
57 | # Benchmark Results
58 | BenchmarkDotNet.Artifacts/
59 |
60 | # .NET Core
61 | project.lock.json
62 | project.fragment.lock.json
63 | artifacts/
64 |
65 | # ASP.NET Scaffolding
66 | ScaffoldingReadMe.txt
67 |
68 | # StyleCop
69 | StyleCopReport.xml
70 |
71 | # Files built by Visual Studio
72 | *_i.c
73 | *_p.c
74 | *_h.h
75 | *.ilk
76 | *.meta
77 | *.obj
78 | *.iobj
79 | *.pch
80 | *.pdb
81 | *.ipdb
82 | *.pgc
83 | *.pgd
84 | *.rsp
85 | *.sbr
86 | *.tlb
87 | *.tli
88 | *.tlh
89 | *.tmp
90 | *.tmp_proj
91 | *_wpftmp.csproj
92 | *.log
93 | *.tlog
94 | *.vspscc
95 | *.vssscc
96 | .builds
97 | *.pidb
98 | *.svclog
99 | *.scc
100 |
101 | # Chutzpah Test files
102 | _Chutzpah*
103 |
104 | # Visual C++ cache files
105 | ipch/
106 | *.aps
107 | *.ncb
108 | *.opendb
109 | *.opensdf
110 | *.sdf
111 | *.cachefile
112 | *.VC.db
113 | *.VC.VC.opendb
114 |
115 | # Visual Studio profiler
116 | *.psess
117 | *.vsp
118 | *.vspx
119 | *.sap
120 |
121 | # Visual Studio Trace Files
122 | *.e2e
123 |
124 | # TFS 2012 Local Workspace
125 | $tf/
126 |
127 | # Guidance Automation Toolkit
128 | *.gpState
129 |
130 | # ReSharper is a .NET coding add-in
131 | _ReSharper*/
132 | *.[Rr]e[Ss]harper
133 | *.DotSettings.user
134 |
135 | # TeamCity is a build add-in
136 | _TeamCity*
137 |
138 | # DotCover is a Code Coverage Tool
139 | *.dotCover
140 |
141 | # AxoCover is a Code Coverage Tool
142 | .axoCover/*
143 | !.axoCover/settings.json
144 |
145 | # Coverlet is a free, cross platform Code Coverage Tool
146 | coverage*.json
147 | coverage*.xml
148 | coverage*.info
149 |
150 | # Visual Studio code coverage results
151 | *.coverage
152 | *.coveragexml
153 |
154 | # NCrunch
155 | _NCrunch_*
156 | .*crunch*.local.xml
157 | nCrunchTemp_*
158 |
159 | # MightyMoose
160 | *.mm.*
161 | AutoTest.Net/
162 |
163 | # Web workbench (sass)
164 | .sass-cache/
165 |
166 | # Installshield output folder
167 | [Ee]xpress/
168 |
169 | # DocProject is a documentation generator add-in
170 | DocProject/buildhelp/
171 | DocProject/Help/*.HxT
172 | DocProject/Help/*.HxC
173 | DocProject/Help/*.hhc
174 | DocProject/Help/*.hhk
175 | DocProject/Help/*.hhp
176 | DocProject/Help/Html2
177 | DocProject/Help/html
178 |
179 | # Click-Once directory
180 | publish/
181 |
182 | # Publish Web Output
183 | *.[Pp]ublish.xml
184 | *.azurePubxml
185 | # Note: Comment the next line if you want to checkin your web deploy settings,
186 | # but database connection strings (with potential passwords) will be unencrypted
187 | *.pubxml
188 | *.publishproj
189 |
190 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
191 | # checkin your Azure Web App publish settings, but sensitive information contained
192 | # in these scripts will be unencrypted
193 | PublishScripts/
194 |
195 | # NuGet Packages
196 | *.nupkg
197 | # NuGet Symbol Packages
198 | *.snupkg
199 | # The packages folder can be ignored because of Package Restore
200 | **/[Pp]ackages/*
201 | # except build/, which is used as an MSBuild target.
202 | !**/[Pp]ackages/build/
203 | # Uncomment if necessary however generally it will be regenerated when needed
204 | #!**/[Pp]ackages/repositories.config
205 | # NuGet v3's project.json files produces more ignorable files
206 | *.nuget.props
207 | *.nuget.targets
208 |
209 | # Microsoft Azure Build Output
210 | csx/
211 | *.build.csdef
212 |
213 | # Microsoft Azure Emulator
214 | ecf/
215 | rcf/
216 |
217 | # Windows Store app package directories and files
218 | AppPackages/
219 | BundleArtifacts/
220 | Package.StoreAssociation.xml
221 | _pkginfo.txt
222 | *.appx
223 | *.appxbundle
224 | *.appxupload
225 |
226 | # Visual Studio cache files
227 | # files ending in .cache can be ignored
228 | *.[Cc]ache
229 | # but keep track of directories ending in .cache
230 | !?*.[Cc]ache/
231 |
232 | # Others
233 | ClientBin/
234 | ~$*
235 | *~
236 | *.dbmdl
237 | *.dbproj.schemaview
238 | *.jfm
239 | *.pfx
240 | *.publishsettings
241 | orleans.codegen.cs
242 |
243 | # Including strong name files can present a security risk
244 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
245 | #*.snk
246 |
247 | # Since there are multiple workflows, uncomment next line to ignore bower_components
248 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
249 | #bower_components/
250 |
251 | # RIA/Silverlight projects
252 | Generated_Code/
253 |
254 | # Backup & report files from converting an old project file
255 | # to a newer Visual Studio version. Backup files are not needed,
256 | # because we have git ;-)
257 | _UpgradeReport_Files/
258 | Backup*/
259 | UpgradeLog*.XML
260 | UpgradeLog*.htm
261 | ServiceFabricBackup/
262 | *.rptproj.bak
263 |
264 | # SQL Server files
265 | *.mdf
266 | *.ldf
267 | *.ndf
268 |
269 | # Business Intelligence projects
270 | *.rdl.data
271 | *.bim.layout
272 | *.bim_*.settings
273 | *.rptproj.rsuser
274 | *- [Bb]ackup.rdl
275 | *- [Bb]ackup ([0-9]).rdl
276 | *- [Bb]ackup ([0-9][0-9]).rdl
277 |
278 | # Microsoft Fakes
279 | FakesAssemblies/
280 |
281 | # GhostDoc plugin setting file
282 | *.GhostDoc.xml
283 |
284 | # Node.js Tools for Visual Studio
285 | .ntvs_analysis.dat
286 | node_modules/
287 |
288 | # Visual Studio 6 build log
289 | *.plg
290 |
291 | # Visual Studio 6 workspace options file
292 | *.opt
293 |
294 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
295 | *.vbw
296 |
297 | # Visual Studio 6 auto-generated project file (contains which files were open etc.)
298 | *.vbp
299 |
300 | # Visual Studio 6 workspace and project file (working project files containing files to include in project)
301 | *.dsw
302 | *.dsp
303 |
304 | # Visual Studio 6 technical files
305 | *.ncb
306 | *.aps
307 |
308 | # Visual Studio LightSwitch build output
309 | **/*.HTMLClient/GeneratedArtifacts
310 | **/*.DesktopClient/GeneratedArtifacts
311 | **/*.DesktopClient/ModelManifest.xml
312 | **/*.Server/GeneratedArtifacts
313 | **/*.Server/ModelManifest.xml
314 | _Pvt_Extensions
315 |
316 | # Paket dependency manager
317 | .paket/paket.exe
318 | paket-files/
319 |
320 | # FAKE - F# Make
321 | .fake/
322 |
323 | # CodeRush personal settings
324 | .cr/personal
325 |
326 | # Python Tools for Visual Studio (PTVS)
327 | __pycache__/
328 | *.pyc
329 |
330 | # Cake - Uncomment if you are using it
331 | # tools/**
332 | # !tools/packages.config
333 |
334 | # Tabs Studio
335 | *.tss
336 |
337 | # Telerik's JustMock configuration file
338 | *.jmconfig
339 |
340 | # BizTalk build output
341 | *.btp.cs
342 | *.btm.cs
343 | *.odx.cs
344 | *.xsd.cs
345 |
346 | # OpenCover UI analysis results
347 | OpenCover/
348 |
349 | # Azure Stream Analytics local run output
350 | ASALocalRun/
351 |
352 | # MSBuild Binary and Structured Log
353 | *.binlog
354 |
355 | # NVidia Nsight GPU debugger configuration file
356 | *.nvuser
357 |
358 | # MFractors (Xamarin productivity tool) working folder
359 | .mfractor/
360 |
361 | # Local History for Visual Studio
362 | .localhistory/
363 |
364 | # Visual Studio History (VSHistory) files
365 | .vshistory/
366 |
367 | # BeatPulse healthcheck temp database
368 | healthchecksdb
369 |
370 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
371 | MigrationBackup/
372 |
373 | # Ionide (cross platform F# VS Code tools) working folder
374 | .ionide/
375 |
376 | # Fody - auto-generated XML schema
377 | FodyWeavers.xsd
378 |
379 | # VS Code files for those working on multiple tools
380 | .vscode/*
381 | !.vscode/settings.json
382 | !.vscode/tasks.json
383 | !.vscode/launch.json
384 | !.vscode/extensions.json
385 | *.code-workspace
386 |
387 | # Local History for Visual Studio Code
388 | .history/
389 |
390 | # Windows Installer files from build outputs
391 | *.cab
392 | *.msi
393 | *.msix
394 | *.msm
395 | *.msp
396 |
397 | # JetBrains Rider
398 | *.sln.iml
399 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | GNU AFFERO GENERAL PUBLIC LICENSE
2 | Version 3, 19 November 2007
3 |
4 | Copyright (C) 2007 Free Software Foundation, Inc.
5 | Everyone is permitted to copy and distribute verbatim copies
6 | of this license document, but changing it is not allowed.
7 |
8 | Preamble
9 |
10 | The GNU Affero General Public License is a free, copyleft license for
11 | software and other kinds of works, specifically designed to ensure
12 | cooperation with the community in the case of network server software.
13 |
14 | The licenses for most software and other practical works are designed
15 | to take away your freedom to share and change the works. By contrast,
16 | our General Public Licenses are intended to guarantee your freedom to
17 | share and change all versions of a program--to make sure it remains free
18 | software for all its users.
19 |
20 | When we speak of free software, we are referring to freedom, not
21 | price. Our General Public Licenses are designed to make sure that you
22 | have the freedom to distribute copies of free software (and charge for
23 | them if you wish), that you receive source code or can get it if you
24 | want it, that you can change the software or use pieces of it in new
25 | free programs, and that you know you can do these things.
26 |
27 | Developers that use our General Public Licenses protect your rights
28 | with two steps: (1) assert copyright on the software, and (2) offer
29 | you this License which gives you legal permission to copy, distribute
30 | and/or modify the software.
31 |
32 | A secondary benefit of defending all users' freedom is that
33 | improvements made in alternate versions of the program, if they
34 | receive widespread use, become available for other developers to
35 | incorporate. Many developers of free software are heartened and
36 | encouraged by the resulting cooperation. However, in the case of
37 | software used on network servers, this result may fail to come about.
38 | The GNU General Public License permits making a modified version and
39 | letting the public access it on a server without ever releasing its
40 | source code to the public.
41 |
42 | The GNU Affero General Public License is designed specifically to
43 | ensure that, in such cases, the modified source code becomes available
44 | to the community. It requires the operator of a network server to
45 | provide the source code of the modified version running there to the
46 | users of that server. Therefore, public use of a modified version, on
47 | a publicly accessible server, gives the public access to the source
48 | code of the modified version.
49 |
50 | An older license, called the Affero General Public License and
51 | published by Affero, was designed to accomplish similar goals. This is
52 | a different license, not a version of the Affero GPL, but Affero has
53 | released a new version of the Affero GPL which permits relicensing under
54 | this license.
55 |
56 | The precise terms and conditions for copying, distribution and
57 | modification follow.
58 |
59 | TERMS AND CONDITIONS
60 |
61 | 0. Definitions.
62 |
63 | "This License" refers to version 3 of the GNU Affero General Public License.
64 |
65 | "Copyright" also means copyright-like laws that apply to other kinds of
66 | works, such as semiconductor masks.
67 |
68 | "The Program" refers to any copyrightable work licensed under this
69 | License. Each licensee is addressed as "you". "Licensees" and
70 | "recipients" may be individuals or organizations.
71 |
72 | To "modify" a work means to copy from or adapt all or part of the work
73 | in a fashion requiring copyright permission, other than the making of an
74 | exact copy. The resulting work is called a "modified version" of the
75 | earlier work or a work "based on" the earlier work.
76 |
77 | A "covered work" means either the unmodified Program or a work based
78 | on the Program.
79 |
80 | To "propagate" a work means to do anything with it that, without
81 | permission, would make you directly or secondarily liable for
82 | infringement under applicable copyright law, except executing it on a
83 | computer or modifying a private copy. Propagation includes copying,
84 | distribution (with or without modification), making available to the
85 | public, and in some countries other activities as well.
86 |
87 | To "convey" a work means any kind of propagation that enables other
88 | parties to make or receive copies. Mere interaction with a user through
89 | a computer network, with no transfer of a copy, is not conveying.
90 |
91 | An interactive user interface displays "Appropriate Legal Notices"
92 | to the extent that it includes a convenient and prominently visible
93 | feature that (1) displays an appropriate copyright notice, and (2)
94 | tells the user that there is no warranty for the work (except to the
95 | extent that warranties are provided), that licensees may convey the
96 | work under this License, and how to view a copy of this License. If
97 | the interface presents a list of user commands or options, such as a
98 | menu, a prominent item in the list meets this criterion.
99 |
100 | 1. Source Code.
101 |
102 | The "source code" for a work means the preferred form of the work
103 | for making modifications to it. "Object code" means any non-source
104 | form of a work.
105 |
106 | A "Standard Interface" means an interface that either is an official
107 | standard defined by a recognized standards body, or, in the case of
108 | interfaces specified for a particular programming language, one that
109 | is widely used among developers working in that language.
110 |
111 | The "System Libraries" of an executable work include anything, other
112 | than the work as a whole, that (a) is included in the normal form of
113 | packaging a Major Component, but which is not part of that Major
114 | Component, and (b) serves only to enable use of the work with that
115 | Major Component, or to implement a Standard Interface for which an
116 | implementation is available to the public in source code form. A
117 | "Major Component", in this context, means a major essential component
118 | (kernel, window system, and so on) of the specific operating system
119 | (if any) on which the executable work runs, or a compiler used to
120 | produce the work, or an object code interpreter used to run it.
121 |
122 | The "Corresponding Source" for a work in object code form means all
123 | the source code needed to generate, install, and (for an executable
124 | work) run the object code and to modify the work, including scripts to
125 | control those activities. However, it does not include the work's
126 | System Libraries, or general-purpose tools or generally available free
127 | programs which are used unmodified in performing those activities but
128 | which are not part of the work. For example, Corresponding Source
129 | includes interface definition files associated with source files for
130 | the work, and the source code for shared libraries and dynamically
131 | linked subprograms that the work is specifically designed to require,
132 | such as by intimate data communication or control flow between those
133 | subprograms and other parts of the work.
134 |
135 | The Corresponding Source need not include anything that users
136 | can regenerate automatically from other parts of the Corresponding
137 | Source.
138 |
139 | The Corresponding Source for a work in source code form is that
140 | same work.
141 |
142 | 2. Basic Permissions.
143 |
144 | All rights granted under this License are granted for the term of
145 | copyright on the Program, and are irrevocable provided the stated
146 | conditions are met. This License explicitly affirms your unlimited
147 | permission to run the unmodified Program. The output from running a
148 | covered work is covered by this License only if the output, given its
149 | content, constitutes a covered work. This License acknowledges your
150 | rights of fair use or other equivalent, as provided by copyright law.
151 |
152 | You may make, run and propagate covered works that you do not
153 | convey, without conditions so long as your license otherwise remains
154 | in force. You may convey covered works to others for the sole purpose
155 | of having them make modifications exclusively for you, or provide you
156 | with facilities for running those works, provided that you comply with
157 | the terms of this License in conveying all material for which you do
158 | not control copyright. Those thus making or running the covered works
159 | for you must do so exclusively on your behalf, under your direction
160 | and control, on terms that prohibit them from making any copies of
161 | your copyrighted material outside their relationship with you.
162 |
163 | Conveying under any other circumstances is permitted solely under
164 | the conditions stated below. Sublicensing is not allowed; section 10
165 | makes it unnecessary.
166 |
167 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
168 |
169 | No covered work shall be deemed part of an effective technological
170 | measure under any applicable law fulfilling obligations under article
171 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
172 | similar laws prohibiting or restricting circumvention of such
173 | measures.
174 |
175 | When you convey a covered work, you waive any legal power to forbid
176 | circumvention of technological measures to the extent such circumvention
177 | is effected by exercising rights under this License with respect to
178 | the covered work, and you disclaim any intention to limit operation or
179 | modification of the work as a means of enforcing, against the work's
180 | users, your or third parties' legal rights to forbid circumvention of
181 | technological measures.
182 |
183 | 4. Conveying Verbatim Copies.
184 |
185 | You may convey verbatim copies of the Program's source code as you
186 | receive it, in any medium, provided that you conspicuously and
187 | appropriately publish on each copy an appropriate copyright notice;
188 | keep intact all notices stating that this License and any
189 | non-permissive terms added in accord with section 7 apply to the code;
190 | keep intact all notices of the absence of any warranty; and give all
191 | recipients a copy of this License along with the Program.
192 |
193 | You may charge any price or no price for each copy that you convey,
194 | and you may offer support or warranty protection for a fee.
195 |
196 | 5. Conveying Modified Source Versions.
197 |
198 | You may convey a work based on the Program, or the modifications to
199 | produce it from the Program, in the form of source code under the
200 | terms of section 4, provided that you also meet all of these conditions:
201 |
202 | a) The work must carry prominent notices stating that you modified
203 | it, and giving a relevant date.
204 |
205 | b) The work must carry prominent notices stating that it is
206 | released under this License and any conditions added under section
207 | 7. This requirement modifies the requirement in section 4 to
208 | "keep intact all notices".
209 |
210 | c) You must license the entire work, as a whole, under this
211 | License to anyone who comes into possession of a copy. This
212 | License will therefore apply, along with any applicable section 7
213 | additional terms, to the whole of the work, and all its parts,
214 | regardless of how they are packaged. This License gives no
215 | permission to license the work in any other way, but it does not
216 | invalidate such permission if you have separately received it.
217 |
218 | d) If the work has interactive user interfaces, each must display
219 | Appropriate Legal Notices; however, if the Program has interactive
220 | interfaces that do not display Appropriate Legal Notices, your
221 | work need not make them do so.
222 |
223 | A compilation of a covered work with other separate and independent
224 | works, which are not by their nature extensions of the covered work,
225 | and which are not combined with it such as to form a larger program,
226 | in or on a volume of a storage or distribution medium, is called an
227 | "aggregate" if the compilation and its resulting copyright are not
228 | used to limit the access or legal rights of the compilation's users
229 | beyond what the individual works permit. Inclusion of a covered work
230 | in an aggregate does not cause this License to apply to the other
231 | parts of the aggregate.
232 |
233 | 6. Conveying Non-Source Forms.
234 |
235 | You may convey a covered work in object code form under the terms
236 | of sections 4 and 5, provided that you also convey the
237 | machine-readable Corresponding Source under the terms of this License,
238 | in one of these ways:
239 |
240 | a) Convey the object code in, or embodied in, a physical product
241 | (including a physical distribution medium), accompanied by the
242 | Corresponding Source fixed on a durable physical medium
243 | customarily used for software interchange.
244 |
245 | b) Convey the object code in, or embodied in, a physical product
246 | (including a physical distribution medium), accompanied by a
247 | written offer, valid for at least three years and valid for as
248 | long as you offer spare parts or customer support for that product
249 | model, to give anyone who possesses the object code either (1) a
250 | copy of the Corresponding Source for all the software in the
251 | product that is covered by this License, on a durable physical
252 | medium customarily used for software interchange, for a price no
253 | more than your reasonable cost of physically performing this
254 | conveying of source, or (2) access to copy the
255 | Corresponding Source from a network server at no charge.
256 |
257 | c) Convey individual copies of the object code with a copy of the
258 | written offer to provide the Corresponding Source. This
259 | alternative is allowed only occasionally and noncommercially, and
260 | only if you received the object code with such an offer, in accord
261 | with subsection 6b.
262 |
263 | d) Convey the object code by offering access from a designated
264 | place (gratis or for a charge), and offer equivalent access to the
265 | Corresponding Source in the same way through the same place at no
266 | further charge. You need not require recipients to copy the
267 | Corresponding Source along with the object code. If the place to
268 | copy the object code is a network server, the Corresponding Source
269 | may be on a different server (operated by you or a third party)
270 | that supports equivalent copying facilities, provided you maintain
271 | clear directions next to the object code saying where to find the
272 | Corresponding Source. Regardless of what server hosts the
273 | Corresponding Source, you remain obligated to ensure that it is
274 | available for as long as needed to satisfy these requirements.
275 |
276 | e) Convey the object code using peer-to-peer transmission, provided
277 | you inform other peers where the object code and Corresponding
278 | Source of the work are being offered to the general public at no
279 | charge under subsection 6d.
280 |
281 | A separable portion of the object code, whose source code is excluded
282 | from the Corresponding Source as a System Library, need not be
283 | included in conveying the object code work.
284 |
285 | A "User Product" is either (1) a "consumer product", which means any
286 | tangible personal property which is normally used for personal, family,
287 | or household purposes, or (2) anything designed or sold for incorporation
288 | into a dwelling. In determining whether a product is a consumer product,
289 | doubtful cases shall be resolved in favor of coverage. For a particular
290 | product received by a particular user, "normally used" refers to a
291 | typical or common use of that class of product, regardless of the status
292 | of the particular user or of the way in which the particular user
293 | actually uses, or expects or is expected to use, the product. A product
294 | is a consumer product regardless of whether the product has substantial
295 | commercial, industrial or non-consumer uses, unless such uses represent
296 | the only significant mode of use of the product.
297 |
298 | "Installation Information" for a User Product means any methods,
299 | procedures, authorization keys, or other information required to install
300 | and execute modified versions of a covered work in that User Product from
301 | a modified version of its Corresponding Source. The information must
302 | suffice to ensure that the continued functioning of the modified object
303 | code is in no case prevented or interfered with solely because
304 | modification has been made.
305 |
306 | If you convey an object code work under this section in, or with, or
307 | specifically for use in, a User Product, and the conveying occurs as
308 | part of a transaction in which the right of possession and use of the
309 | User Product is transferred to the recipient in perpetuity or for a
310 | fixed term (regardless of how the transaction is characterized), the
311 | Corresponding Source conveyed under this section must be accompanied
312 | by the Installation Information. But this requirement does not apply
313 | if neither you nor any third party retains the ability to install
314 | modified object code on the User Product (for example, the work has
315 | been installed in ROM).
316 |
317 | The requirement to provide Installation Information does not include a
318 | requirement to continue to provide support service, warranty, or updates
319 | for a work that has been modified or installed by the recipient, or for
320 | the User Product in which it has been modified or installed. Access to a
321 | network may be denied when the modification itself materially and
322 | adversely affects the operation of the network or violates the rules and
323 | protocols for communication across the network.
324 |
325 | Corresponding Source conveyed, and Installation Information provided,
326 | in accord with this section must be in a format that is publicly
327 | documented (and with an implementation available to the public in
328 | source code form), and must require no special password or key for
329 | unpacking, reading or copying.
330 |
331 | 7. Additional Terms.
332 |
333 | "Additional permissions" are terms that supplement the terms of this
334 | License by making exceptions from one or more of its conditions.
335 | Additional permissions that are applicable to the entire Program shall
336 | be treated as though they were included in this License, to the extent
337 | that they are valid under applicable law. If additional permissions
338 | apply only to part of the Program, that part may be used separately
339 | under those permissions, but the entire Program remains governed by
340 | this License without regard to the additional permissions.
341 |
342 | When you convey a copy of a covered work, you may at your option
343 | remove any additional permissions from that copy, or from any part of
344 | it. (Additional permissions may be written to require their own
345 | removal in certain cases when you modify the work.) You may place
346 | additional permissions on material, added by you to a covered work,
347 | for which you have or can give appropriate copyright permission.
348 |
349 | Notwithstanding any other provision of this License, for material you
350 | add to a covered work, you may (if authorized by the copyright holders of
351 | that material) supplement the terms of this License with terms:
352 |
353 | a) Disclaiming warranty or limiting liability differently from the
354 | terms of sections 15 and 16 of this License; or
355 |
356 | b) Requiring preservation of specified reasonable legal notices or
357 | author attributions in that material or in the Appropriate Legal
358 | Notices displayed by works containing it; or
359 |
360 | c) Prohibiting misrepresentation of the origin of that material, or
361 | requiring that modified versions of such material be marked in
362 | reasonable ways as different from the original version; or
363 |
364 | d) Limiting the use for publicity purposes of names of licensors or
365 | authors of the material; or
366 |
367 | e) Declining to grant rights under trademark law for use of some
368 | trade names, trademarks, or service marks; or
369 |
370 | f) Requiring indemnification of licensors and authors of that
371 | material by anyone who conveys the material (or modified versions of
372 | it) with contractual assumptions of liability to the recipient, for
373 | any liability that these contractual assumptions directly impose on
374 | those licensors and authors.
375 |
376 | All other non-permissive additional terms are considered "further
377 | restrictions" within the meaning of section 10. If the Program as you
378 | received it, or any part of it, contains a notice stating that it is
379 | governed by this License along with a term that is a further
380 | restriction, you may remove that term. If a license document contains
381 | a further restriction but permits relicensing or conveying under this
382 | License, you may add to a covered work material governed by the terms
383 | of that license document, provided that the further restriction does
384 | not survive such relicensing or conveying.
385 |
386 | If you add terms to a covered work in accord with this section, you
387 | must place, in the relevant source files, a statement of the
388 | additional terms that apply to those files, or a notice indicating
389 | where to find the applicable terms.
390 |
391 | Additional terms, permissive or non-permissive, may be stated in the
392 | form of a separately written license, or stated as exceptions;
393 | the above requirements apply either way.
394 |
395 | 8. Termination.
396 |
397 | You may not propagate or modify a covered work except as expressly
398 | provided under this License. Any attempt otherwise to propagate or
399 | modify it is void, and will automatically terminate your rights under
400 | this License (including any patent licenses granted under the third
401 | paragraph of section 11).
402 |
403 | However, if you cease all violation of this License, then your
404 | license from a particular copyright holder is reinstated (a)
405 | provisionally, unless and until the copyright holder explicitly and
406 | finally terminates your license, and (b) permanently, if the copyright
407 | holder fails to notify you of the violation by some reasonable means
408 | prior to 60 days after the cessation.
409 |
410 | Moreover, your license from a particular copyright holder is
411 | reinstated permanently if the copyright holder notifies you of the
412 | violation by some reasonable means, this is the first time you have
413 | received notice of violation of this License (for any work) from that
414 | copyright holder, and you cure the violation prior to 30 days after
415 | your receipt of the notice.
416 |
417 | Termination of your rights under this section does not terminate the
418 | licenses of parties who have received copies or rights from you under
419 | this License. If your rights have been terminated and not permanently
420 | reinstated, you do not qualify to receive new licenses for the same
421 | material under section 10.
422 |
423 | 9. Acceptance Not Required for Having Copies.
424 |
425 | You are not required to accept this License in order to receive or
426 | run a copy of the Program. Ancillary propagation of a covered work
427 | occurring solely as a consequence of using peer-to-peer transmission
428 | to receive a copy likewise does not require acceptance. However,
429 | nothing other than this License grants you permission to propagate or
430 | modify any covered work. These actions infringe copyright if you do
431 | not accept this License. Therefore, by modifying or propagating a
432 | covered work, you indicate your acceptance of this License to do so.
433 |
434 | 10. Automatic Licensing of Downstream Recipients.
435 |
436 | Each time you convey a covered work, the recipient automatically
437 | receives a license from the original licensors, to run, modify and
438 | propagate that work, subject to this License. You are not responsible
439 | for enforcing compliance by third parties with this License.
440 |
441 | An "entity transaction" is a transaction transferring control of an
442 | organization, or substantially all assets of one, or subdividing an
443 | organization, or merging organizations. If propagation of a covered
444 | work results from an entity transaction, each party to that
445 | transaction who receives a copy of the work also receives whatever
446 | licenses to the work the party's predecessor in interest had or could
447 | give under the previous paragraph, plus a right to possession of the
448 | Corresponding Source of the work from the predecessor in interest, if
449 | the predecessor has it or can get it with reasonable efforts.
450 |
451 | You may not impose any further restrictions on the exercise of the
452 | rights granted or affirmed under this License. For example, you may
453 | not impose a license fee, royalty, or other charge for exercise of
454 | rights granted under this License, and you may not initiate litigation
455 | (including a cross-claim or counterclaim in a lawsuit) alleging that
456 | any patent claim is infringed by making, using, selling, offering for
457 | sale, or importing the Program or any portion of it.
458 |
459 | 11. Patents.
460 |
461 | A "contributor" is a copyright holder who authorizes use under this
462 | License of the Program or a work on which the Program is based. The
463 | work thus licensed is called the contributor's "contributor version".
464 |
465 | A contributor's "essential patent claims" are all patent claims
466 | owned or controlled by the contributor, whether already acquired or
467 | hereafter acquired, that would be infringed by some manner, permitted
468 | by this License, of making, using, or selling its contributor version,
469 | but do not include claims that would be infringed only as a
470 | consequence of further modification of the contributor version. For
471 | purposes of this definition, "control" includes the right to grant
472 | patent sublicenses in a manner consistent with the requirements of
473 | this License.
474 |
475 | Each contributor grants you a non-exclusive, worldwide, royalty-free
476 | patent license under the contributor's essential patent claims, to
477 | make, use, sell, offer for sale, import and otherwise run, modify and
478 | propagate the contents of its contributor version.
479 |
480 | In the following three paragraphs, a "patent license" is any express
481 | agreement or commitment, however denominated, not to enforce a patent
482 | (such as an express permission to practice a patent or covenant not to
483 | sue for patent infringement). To "grant" such a patent license to a
484 | party means to make such an agreement or commitment not to enforce a
485 | patent against the party.
486 |
487 | If you convey a covered work, knowingly relying on a patent license,
488 | and the Corresponding Source of the work is not available for anyone
489 | to copy, free of charge and under the terms of this License, through a
490 | publicly available network server or other readily accessible means,
491 | then you must either (1) cause the Corresponding Source to be so
492 | available, or (2) arrange to deprive yourself of the benefit of the
493 | patent license for this particular work, or (3) arrange, in a manner
494 | consistent with the requirements of this License, to extend the patent
495 | license to downstream recipients. "Knowingly relying" means you have
496 | actual knowledge that, but for the patent license, your conveying the
497 | covered work in a country, or your recipient's use of the covered work
498 | in a country, would infringe one or more identifiable patents in that
499 | country that you have reason to believe are valid.
500 |
501 | If, pursuant to or in connection with a single transaction or
502 | arrangement, you convey, or propagate by procuring conveyance of, a
503 | covered work, and grant a patent license to some of the parties
504 | receiving the covered work authorizing them to use, propagate, modify
505 | or convey a specific copy of the covered work, then the patent license
506 | you grant is automatically extended to all recipients of the covered
507 | work and works based on it.
508 |
509 | A patent license is "discriminatory" if it does not include within
510 | the scope of its coverage, prohibits the exercise of, or is
511 | conditioned on the non-exercise of one or more of the rights that are
512 | specifically granted under this License. You may not convey a covered
513 | work if you are a party to an arrangement with a third party that is
514 | in the business of distributing software, under which you make payment
515 | to the third party based on the extent of your activity of conveying
516 | the work, and under which the third party grants, to any of the
517 | parties who would receive the covered work from you, a discriminatory
518 | patent license (a) in connection with copies of the covered work
519 | conveyed by you (or copies made from those copies), or (b) primarily
520 | for and in connection with specific products or compilations that
521 | contain the covered work, unless you entered into that arrangement,
522 | or that patent license was granted, prior to 28 March 2007.
523 |
524 | Nothing in this License shall be construed as excluding or limiting
525 | any implied license or other defenses to infringement that may
526 | otherwise be available to you under applicable patent law.
527 |
528 | 12. No Surrender of Others' Freedom.
529 |
530 | If conditions are imposed on you (whether by court order, agreement or
531 | otherwise) that contradict the conditions of this License, they do not
532 | excuse you from the conditions of this License. If you cannot convey a
533 | covered work so as to satisfy simultaneously your obligations under this
534 | License and any other pertinent obligations, then as a consequence you may
535 | not convey it at all. For example, if you agree to terms that obligate you
536 | to collect a royalty for further conveying from those to whom you convey
537 | the Program, the only way you could satisfy both those terms and this
538 | License would be to refrain entirely from conveying the Program.
539 |
540 | 13. Remote Network Interaction; Use with the GNU General Public License.
541 |
542 | Notwithstanding any other provision of this License, if you modify the
543 | Program, your modified version must prominently offer all users
544 | interacting with it remotely through a computer network (if your version
545 | supports such interaction) an opportunity to receive the Corresponding
546 | Source of your version by providing access to the Corresponding Source
547 | from a network server at no charge, through some standard or customary
548 | means of facilitating copying of software. This Corresponding Source
549 | shall include the Corresponding Source for any work covered by version 3
550 | of the GNU General Public License that is incorporated pursuant to the
551 | following paragraph.
552 |
553 | Notwithstanding any other provision of this License, you have
554 | permission to link or combine any covered work with a work licensed
555 | under version 3 of the GNU General Public License into a single
556 | combined work, and to convey the resulting work. The terms of this
557 | License will continue to apply to the part which is the covered work,
558 | but the work with which it is combined will remain governed by version
559 | 3 of the GNU General Public License.
560 |
561 | 14. Revised Versions of this License.
562 |
563 | The Free Software Foundation may publish revised and/or new versions of
564 | the GNU Affero General Public License from time to time. Such new versions
565 | will be similar in spirit to the present version, but may differ in detail to
566 | address new problems or concerns.
567 |
568 | Each version is given a distinguishing version number. If the
569 | Program specifies that a certain numbered version of the GNU Affero General
570 | Public License "or any later version" applies to it, you have the
571 | option of following the terms and conditions either of that numbered
572 | version or of any later version published by the Free Software
573 | Foundation. If the Program does not specify a version number of the
574 | GNU Affero General Public License, you may choose any version ever published
575 | by the Free Software Foundation.
576 |
577 | If the Program specifies that a proxy can decide which future
578 | versions of the GNU Affero General Public License can be used, that proxy's
579 | public statement of acceptance of a version permanently authorizes you
580 | to choose that version for the Program.
581 |
582 | Later license versions may give you additional or different
583 | permissions. However, no additional obligations are imposed on any
584 | author or copyright holder as a result of your choosing to follow a
585 | later version.
586 |
587 | 15. Disclaimer of Warranty.
588 |
589 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
590 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
591 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
592 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
593 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
594 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
595 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
596 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
597 |
598 | 16. Limitation of Liability.
599 |
600 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
601 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
602 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
603 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
604 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
605 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
606 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
607 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
608 | SUCH DAMAGES.
609 |
610 | 17. Interpretation of Sections 15 and 16.
611 |
612 | If the disclaimer of warranty and limitation of liability provided
613 | above cannot be given local legal effect according to their terms,
614 | reviewing courts shall apply local law that most closely approximates
615 | an absolute waiver of all civil liability in connection with the
616 | Program, unless a warranty or assumption of liability accompanies a
617 | copy of the Program in return for a fee.
618 |
619 | END OF TERMS AND CONDITIONS
620 |
621 | How to Apply These Terms to Your New Programs
622 |
623 | If you develop a new program, and you want it to be of the greatest
624 | possible use to the public, the best way to achieve this is to make it
625 | free software which everyone can redistribute and change under these terms.
626 |
627 | To do so, attach the following notices to the program. It is safest
628 | to attach them to the start of each source file to most effectively
629 | state the exclusion of warranty; and each file should have at least
630 | the "copyright" line and a pointer to where the full notice is found.
631 |
632 |
633 | Copyright (C)
634 |
635 | This program is free software: you can redistribute it and/or modify
636 | it under the terms of the GNU Affero General Public License as published
637 | by the Free Software Foundation, either version 3 of the License, or
638 | (at your option) any later version.
639 |
640 | This program is distributed in the hope that it will be useful,
641 | but WITHOUT ANY WARRANTY; without even the implied warranty of
642 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
643 | GNU Affero General Public License for more details.
644 |
645 | You should have received a copy of the GNU Affero General Public License
646 | along with this program. If not, see .
647 |
648 | Also add information on how to contact you by electronic and paper mail.
649 |
650 | If your software can interact with users remotely through a computer
651 | network, you should also make sure that it provides a way for users to
652 | get its source. For example, if your program is a web application, its
653 | interface could display a "Source" link that leads users to an archive
654 | of the code. There are many ways you could offer source, and different
655 | solutions will be better for different programs; see section 13 for the
656 | specific requirements.
657 |
658 | You should also get your employer (if you work as a programmer) or school,
659 | if any, to sign a "copyright disclaimer" for the program, if necessary.
660 | For more information on this, and how to apply and follow the GNU AGPL, see
661 | .
662 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Code Lybyrinth (LLVM Obfuscation Pass)
2 |
3 |
4 | ## Features
5 |
6 | - [Fake Instruction Inserter](https://github.com/codetronik/CodeLabyrinth/wiki/%5BPASS%5D-Fake-Instruction-Inserter)
7 | - [Dynamic Call Converter](https://github.com/codetronik/CodeLabyrinth/wiki/%5BPASS%5D-Dynamic-Call-Converter)
8 | - [Branch Address Encryptor](https://github.com/codetronik/CodeLabyrinth/wiki/%5BPASS%5D-Branch-Address-Encryptor)
9 | - [String Encryptor](https://github.com/codetronik/CodeLabyrinth/wiki/%5BPASS%5D-String-Encryptor)
10 |
11 | ## Build for iOS (on Mac)
12 |
13 | ### Compile Clang
14 | [How to build clang and swift‐frontend (on Mac M2)](https://github.com/codetronik/CodeLabyrinth/wiki/How-to-build-clang-and-swift%E2%80%90frontend-(on-Mac-M2))
15 |
16 | ### Compile Pass Plugin
17 | ```sh
18 | $ git clone https://github.com/codetronik/CodeLabyrinth
19 | $ cd CodeLabyrinth
20 | $ cmake -B Release -DLLVM_DIR=/SWIFT_CLONE_PATH/build/buildbot_osx/llvm-macosx-arm64/lib/cmake -DCMAKE_OSX_ARCHITECTURES=arm64
21 | $ cd Release
22 | $ make -j16
23 | ```
24 |
25 | ### Xcode's Clang option
26 | Project Setting -> Apple Clang -> Custom Compiler Flags -> Other C Flags -> Release
27 | > -fpass-plugin=/libCodeLabyrinth.dylib -DCMAKE_OSX_ARCHITECTURES=arm64
28 |
29 | ## Build for Android (on Windows)
30 |
31 | ### Compile Clang
32 | [How to compile LLVM Pass for Android using Visual Studio](https://github.com/codetronik/CodeLabyrinth/wiki/How-to-compile-LLVM-Pass-for-Android-using-Visual-Studio)
33 |
34 | ### Compile Pass Plugin
35 | ```sh
36 | $ git clone https://github.com/codetronik/CodeLabyrinth
37 | $ notepad.exe CodeLabyrinth\windows\Directory.build.props
38 | ```
39 | Modify ```LLVMINstallDir``` then open ```CodeLabyrinth.sln``` and build.
40 |
41 | ### Visual Studio's Clang option
42 | Project Setting -> Configuration Properties -> C/C++ -> Command Line -> Additional Options
43 | > -fpass-plugin=\CodeLabyrinth.dll
44 |
45 | ## Test Environment
46 | - iOS : C++, Objective C++ / Xcode 15.0.1 / iPhone 12 mini
47 | - Android : C++ / Visual Studio 2022 / Galaxy Note S20
48 | - Windows : C++ with Command Line
49 |
--------------------------------------------------------------------------------
/src/BranchAddressEncryptor/BranchAddressEncryptor.cpp:
--------------------------------------------------------------------------------
1 | #include "BranchAddressEncryptor.hpp"
2 | #include "llvm/TargetParser/Triple.h"
3 | #include "llvm/Transforms/Utils/ModuleUtils.h"
4 | #include "llvm/Demangle/Demangle.h"
5 | #include "llvm/Transforms/Utils/BasicBlockUtils.h"
6 | #include "llvm/IR/Instructions.h"
7 | #include "llvm/IR/IRBuilder.h"
8 | #include "llvm/IR/InstIterator.h"
9 | #include
10 | #include "Common/LLVMType.hpp"
11 | #include "Common/Util.hpp"
12 |
13 | PreservedAnalyses BranchAddressEncryptor::run(Module& M, ModuleAnalysisManager& MAM)
14 | {
15 | outs() << "[PASS START] BranchAddressEncryptor\n";
16 | this->mod = &M;
17 | this->moduleContext = &M.getContext();
18 | GetInstance()->init(moduleContext);
19 |
20 | // check if modified
21 | if (Run() == true)
22 | {
23 | return PreservedAnalyses::none();
24 | }
25 |
26 | return PreservedAnalyses::all();
27 | }
28 |
29 | bool BranchAddressEncryptor::Run()
30 | {
31 | bool success = false;
32 |
33 | for (Function& F : *mod)
34 | {
35 | outs() << "Function Name : " << demangle(F.getName().str()) << "..." << F.getLinkage() << '\n';
36 |
37 | if (F.isDeclaration() || F.hasAvailableExternallyLinkage() || F.getInstructionCount() == 0 || F.getLinkage() != GlobalValue::LinkageTypes::ExternalLinkage)
38 | {
39 | continue;
40 | }
41 | if (true == hasAnnotation(&F, "nobae"))
42 | {
43 | continue;
44 | }
45 | success |= EncryptAndIndirect(F);
46 |
47 | }
48 | PrintFunction(*mod);
49 | return success;
50 | }
51 |
52 | bool BranchAddressEncryptor::EncryptAndIndirect(Function& Func)
53 | {
54 | outs() << " -" << demangle(Func.getName().str()) << "\n";
55 |
56 | std::vector conditionBrInsts;
57 | std::vector unconditionBrInsts;
58 |
59 | for (Instruction& Inst : instructions(Func))
60 | {
61 | if (isa(&Inst))
62 | {
63 | BranchInst* br = dyn_cast(&Inst);
64 |
65 | if (true == br->isConditional())
66 | {
67 | conditionBrInsts.push_back(br);
68 | }
69 | else
70 | {
71 | unconditionBrInsts.push_back(br);
72 | }
73 | }
74 | }
75 |
76 | // 비조건 브랜치를 조건 브랜치처럼 난독화하면 최적화 되어 버린다.
77 | // rand()와 비교문을 추가하여 강제로 조건 브랜치로 변경하면 최적화 대상에서 제외된다.
78 | for (BranchInst* branchInst : unconditionBrInsts)
79 | {
80 | BasicBlock* trueBlock = branchInst->getSuccessor(0);
81 |
82 | IRBuilder<>* branchInstBuilder = new IRBuilder<>(branchInst);
83 | FunctionCallee randFunc = mod->getOrInsertFunction("rand", Int32Ty);
84 | CallInst* callRand = branchInstBuilder->CreateCall(randFunc, {});
85 | // 항상 false가 되는 구문을 작성해야함
86 | // if (rand() > -1)
87 | Value* cmpResult = branchInstBuilder->CreateICmpSGT(callRand, ConstantInt::get(Int32Ty, -1));
88 |
89 | // 최적화를 피하기 위해 추가함. 실행되면 안되는 코드
90 | BasicBlock* falseBlock = BasicBlock::Create(*moduleContext, "falseBlock", &Func);
91 | IRBuilder<> builder(falseBlock);
92 | builder.CreateBr(falseBlock);
93 |
94 | BranchInst* bi = BranchInst::Create(trueBlock, falseBlock, cmpResult);
95 | llvm::ReplaceInstWithInst(branchInst, bi);
96 |
97 | conditionBrInsts.push_back(bi);
98 | }
99 |
100 |
101 | Value* zero = ConstantInt::get(Int64Ty, 0);
102 | for (BranchInst* branchInst : conditionBrInsts)
103 | {
104 | outs() << "BI : " << *branchInst << "\n";
105 |
106 | IRBuilder<>* branchInstBuilder = new IRBuilder<>(branchInst);
107 |
108 | std::random_device rd;
109 | std::mt19937 gen(rd());
110 | std::uniform_int_distribution<> dist(0x100000, INT32_MAX);
111 |
112 | // type은 정수 타입 (Int32Ty일 경우 0x1이면 메모리에서 0x8임)
113 | ConstantInt* keyOffset = ConstantInt::get(Int64Ty, dist(gen));
114 |
115 | BasicBlock* trueBlock = branchInst->getSuccessor(0);
116 | BasicBlock* falseBlock = branchInst->getSuccessor(1);
117 | Triple triple = Triple(mod->getTargetTriple());
118 |
119 | // 분기 주소 + 오프셋
120 | // 최적화를 피할 수 있는 유일한 주소 연산 방법 (이라고 믿고 있음)
121 | Type* dynamicTy;
122 | if (triple.isArch64Bit())
123 | {
124 | dynamicTy = Int64Ty;
125 | }
126 | else
127 | {
128 | dynamicTy = Int32Ty;
129 | }
130 |
131 | auto trueBlockPtr = ConstantExpr::getGetElementPtr(dynamicTy, BlockAddress::get(trueBlock), keyOffset);
132 | auto trueBlockRealEncAddr = ConstantExpr::getPtrToInt(trueBlockPtr, dynamicTy);
133 | auto falseBlockPtr = ConstantExpr::getGetElementPtr(dynamicTy, BlockAddress::get(falseBlock), keyOffset);
134 | auto falseBlockRealEncAddr = ConstantExpr::getPtrToInt(falseBlockPtr, dynamicTy);
135 |
136 | // 순서는 false, true 순 (고정)
137 | std::vector trueFalseBlocks;
138 | trueFalseBlocks.push_back(falseBlockRealEncAddr);
139 | trueFalseBlocks.push_back(trueBlockRealEncAddr);
140 |
141 | ArrayType* arrayType = ArrayType::get(dynamicTy, trueFalseBlocks.size());
142 | Constant* trueFalseArray = ConstantArray::get(arrayType, ArrayRef(trueFalseBlocks));
143 |
144 | // 최적화를 피하기 위해 global section을 사용한다.
145 | GlobalVariable* trueFalseGV = new GlobalVariable(*mod, arrayType, false, GlobalValue::LinkageTypes::PrivateLinkage, trueFalseArray, "EncBlockTable");
146 |
147 | appendToCompilerUsed(*Func.getParent(), { trueFalseGV });
148 |
149 | // 어디로 분기할지 동적으로 구하는 코드
150 | // 메모리에 0 or 1로 저장됨. 이것을 index로 활용한다.
151 | Value* condition = branchInst->getCondition();
152 | // 큰 타입으로 변환 (상위 비트는 0으로 채움)
153 | Value* index = branchInstBuilder->CreateZExt(condition, Int64Ty); // 0 or 1
154 |
155 | // true or false 주소를 담고 있는 메모리의 주소를 가져옴
156 | Value* branchGV = branchInstBuilder->CreateGEP(arrayType, trueFalseGV, { zero, index });
157 | // encBranchAddrPtr = *branchGV
158 | LoadInst* encBranchAddrPtr = branchInstBuilder->CreateLoad(Int64PtrTy, branchGV);
159 | // 더했던 만큼 뺌
160 | Value* offset = branchInstBuilder->CreateSub(zero, keyOffset);
161 |
162 | // 분기 주소 - 오프셋
163 | Value* realBranchAddr = branchInstBuilder->CreateGEP(encBranchAddrPtr->getType(), encBranchAddrPtr, offset);
164 | IndirectBrInst* indirectBr = branchInstBuilder->CreateIndirectBr(realBranchAddr, trueFalseBlocks.size());
165 | indirectBr->addDestination(falseBlock);
166 | indirectBr->addDestination(trueBlock);
167 |
168 | // 원본 명령어는 삭제
169 | branchInst->eraseFromParent();
170 | }
171 |
172 | return true;
173 | }
--------------------------------------------------------------------------------
/src/BranchAddressEncryptor/BranchAddressEncryptor.hpp:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "llvm/IR/PassManager.h"
3 |
4 | using namespace llvm;
5 |
6 | class BranchAddressEncryptor : public PassInfoMixin
7 | {
8 | public:
9 | PreservedAnalyses run(Module& M, ModuleAnalysisManager& MAM);
10 |
11 | private:
12 | bool Run();
13 | bool EncryptAndIndirect(Function& Func);
14 |
15 | private:
16 | Module* mod;
17 | LLVMContext* moduleContext;
18 | };
19 |
--------------------------------------------------------------------------------
/src/BranchAddressEncryptor/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | target_sources(CodeLabyrinth PRIVATE BranchAddressEncryptor.cpp)
2 |
--------------------------------------------------------------------------------
/src/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | cmake_minimum_required(VERSION 3.13.5)
2 |
3 | set(COMPILER ${CMAKE_C_COMPILER} CACHE STRING "")
4 | set(CMAKE_C_COMPILER ${COMPILER})
5 | set(CMAKE_CXX_COMPILER ${COMPILER})
6 | message("Clang path : ${CMAKE_CXX_COMPILER}")
7 |
8 | project(CodeLabyrinth)
9 |
10 | find_package(LLVM PATHS "${LLVM_DIR}" REQUIRED CONFIG NO_DEFAULT_PATH)
11 |
12 | include_directories(${LLVM_INCLUDE_DIRS})
13 | separate_arguments(LLVM_DEFINITIONS_LIST NATIVE_COMMAND ${LLVM_DEFINITIONS})
14 | add_definitions(${LLVM_DEFINITIONS_LIST})
15 | link_directories(${LLVM_LIBRARY_DIRS})
16 |
17 | set(CMAKE_CXX_STANDARD 17)
18 | #set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall -Wextra -Wno-unused-parameter")
19 |
20 | add_library(CodeLabyrinth SHARED RegisterPass.cpp)
21 |
22 | target_include_directories(CodeLabyrinth PRIVATE ${CMAKE_SOURCE_DIR})
23 | target_include_directories(CodeLabyrinth PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
24 |
25 | if(WIN32 OR APPLE)
26 | llvm_map_components_to_libnames(LLVM_LIBRARIES Core Support TransformUtils)
27 | target_link_libraries(CodeLabyrinth PRIVATE ${LLVM_LIBRARIES})
28 | endif()
29 |
30 | add_subdirectory(Common)
31 | add_subdirectory(FakeInstructionInserter)
32 | add_subdirectory(DynamicCallConverter)
33 | add_subdirectory(BranchAddressEncryptor)
34 | add_subdirectory(StringEncryptor)
35 |
--------------------------------------------------------------------------------
/src/Common/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | target_sources(CodeLabyrinth PRIVATE Util.cpp)
2 |
--------------------------------------------------------------------------------
/src/Common/LLVMType.hpp:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "llvm/IR/Type.h"
3 | #include "llvm/IR/LLVMContext.h"
4 |
5 | using namespace llvm;
6 |
7 | #define VoidTy GetInstance()->getVoidTy()
8 | #define Int8Ty GetInstance()->getInt8Ty()
9 | #define Int8PtrTy GetInstance()->getInt8PtrTy()
10 | #define Int32Ty GetInstance()->getInt32Ty()
11 | #define Int32PtrTy GetInstance()->getInt32PtrTy()
12 | #define Int64Ty GetInstance()->getInt64Ty()
13 | #define Int64PtrTy GetInstance()->getInt64PtrTy()
14 |
15 | struct LLVMType
16 | {
17 | Type* voidTy;
18 | IntegerType* int8Ty;
19 | PointerType* int8PtrTy;
20 | IntegerType* int32Ty;
21 | PointerType* int32PtrTy;
22 | IntegerType* int64Ty;
23 | PointerType* int64PtrTy;
24 | Type* (*getVoidTy)();
25 | IntegerType* (*getInt8Ty)();
26 | PointerType* (*getInt8PtrTy)();
27 | IntegerType* (*getInt32Ty)();
28 | PointerType* (*getInt32PtrTy)();
29 | IntegerType* (*getInt64Ty)();
30 | PointerType* (*getInt64PtrTy)();
31 | void (*init)(LLVMContext* moduleContext);
32 | };
33 |
34 | static LLVMType* instance = nullptr;
35 |
36 | static void initFunction(LLVMContext* moduleContext)
37 | {
38 | instance->voidTy = Type::getVoidTy(*moduleContext);
39 | instance->int8Ty = Type::getInt8Ty(*moduleContext);
40 | instance->int8PtrTy = instance->int8Ty->getPointerTo();
41 | instance->int32Ty = Type::getInt32Ty(*moduleContext);
42 | instance->int32PtrTy = instance->int32Ty->getPointerTo();
43 | instance->int64Ty = Type::getInt64Ty(*moduleContext);
44 | instance->int64PtrTy = instance->int64Ty->getPointerTo();
45 | }
46 |
47 | static Type* getVoidTyFunction()
48 | {
49 | return instance->voidTy;
50 | }
51 | static IntegerType* getInt8TyFunction()
52 | {
53 | return instance->int8Ty;
54 | }
55 | static PointerType* getInt8PtrTyFunction()
56 | {
57 | return instance->int8PtrTy;
58 | }
59 | static IntegerType* getInt32TyFunction()
60 | {
61 | return instance->int32Ty;
62 | }
63 | static PointerType* getInt32PtrTyFunction()
64 | {
65 | return instance->int32PtrTy;
66 | }
67 | static IntegerType* getInt64TyFunction()
68 | {
69 | return instance->int64Ty;
70 | }
71 | static PointerType* getInt64PtrTyFunction()
72 | {
73 | return instance->int64PtrTy;
74 | }
75 |
76 | static LLVMType* GetInstance()
77 | {
78 | if (instance == nullptr)
79 | {
80 | instance = new LLVMType();
81 | instance->init = &initFunction;
82 | instance->getVoidTy = &getVoidTyFunction;
83 | instance->getInt8Ty = &getInt8TyFunction;
84 | instance->getInt8PtrTy = &getInt8PtrTyFunction;
85 | instance->getInt32Ty = &getInt32TyFunction;
86 | instance->getInt32PtrTy = &getInt32PtrTyFunction;
87 | instance->getInt64Ty = &getInt64TyFunction;
88 | instance->getInt64PtrTy = &getInt64PtrTyFunction;
89 | }
90 |
91 | return instance;
92 | }
93 |
--------------------------------------------------------------------------------
/src/Common/Util.cpp:
--------------------------------------------------------------------------------
1 | #include "Util.hpp"
2 | //#include "llvm/Transforms/Utils/BasicBlockUtils.h"
3 | #include "llvm/Demangle/Demangle.h"
4 | #include "llvm/IR/IRBuilder.h"
5 | //#include "llvm/IR/Instructions.h"
6 |
7 | bool hasAnnotation(Function* f, StringRef str)
8 | {
9 | GlobalVariable* Annotations = f->getParent()->getGlobalVariable("llvm.global.annotations");
10 | if (!Annotations)
11 | {
12 | return false;
13 | }
14 | ConstantArray* arrays = dyn_cast(Annotations->getInitializer());
15 | if (!arrays)
16 | {
17 | return false;
18 | }
19 |
20 | for (auto& op : arrays->operands())
21 | {
22 | ConstantStruct* constStruct = dyn_cast(op);
23 | if (!constStruct)
24 | {
25 | continue;
26 | }
27 | Function* func = dyn_cast(constStruct->getOperand(0)->stripPointerCasts());
28 | if (!func)
29 | {
30 | continue;
31 | }
32 | if (func != f)
33 | {
34 | continue;
35 | }
36 | GlobalValue* value = dyn_cast(constStruct->getOperand(1)->stripPointerCasts());
37 | if (!value)
38 | {
39 | continue;
40 | }
41 | ConstantDataSequential* data = dyn_cast(value->getOperand(0));
42 | if (!data)
43 | {
44 | continue;
45 | }
46 | if (data->getAsCString().contains(str))
47 | {
48 | outs() << "found Annotation\n";
49 | return true;
50 | }
51 | }
52 |
53 | return false;
54 | }
55 |
56 | void PrintFunction(Module &mod)
57 | {
58 | for (Function& F : mod)
59 | {
60 | outs() << "Function " << demangle(F.getName().str()) << "\n";
61 | for (BasicBlock& BB : F)
62 | {
63 | outs() << "BasicBlock " << BB.getName() << " size : " << BB.size() << "\n";
64 | for (Instruction& I : BB)
65 | {
66 | outs() << " - Inst : " << I << "\n";
67 | }
68 | }
69 | }
70 | }
--------------------------------------------------------------------------------
/src/Common/Util.hpp:
--------------------------------------------------------------------------------
1 | #include "llvm/IR/Function.h"
2 |
3 | using namespace llvm;
4 |
5 | bool hasAnnotation(Function* f, StringRef str);
6 | void PrintFunction(Module& mod);
--------------------------------------------------------------------------------
/src/DynamicCallConverter/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | target_sources(CodeLabyrinth PRIVATE DynamicCallConverter.cpp)
2 |
--------------------------------------------------------------------------------
/src/DynamicCallConverter/DynamicCallConverter.cpp:
--------------------------------------------------------------------------------
1 | #include "DynamicCallConverter.hpp"
2 | #include "llvm/TargetParser/Triple.h"
3 | #include "llvm/IR/IRBuilder.h"
4 | #include "llvm/IR/Instructions.h"
5 | #include "llvm/Demangle/Demangle.h"
6 | #include "Common/LLVMType.hpp"
7 | #include "Common/Util.hpp"
8 |
9 | PreservedAnalyses DynamicCallConverter::run(Module& M, ModuleAnalysisManager& MAM)
10 | {
11 | outs() << "[PASS START] DynamicCallConverter\n";
12 | this->mod = &M;
13 | this->moduleContext = &M.getContext();
14 | GetInstance()->init(moduleContext);
15 | Init();
16 |
17 | // check if modified
18 | if (Run() == true)
19 | {
20 | return PreservedAnalyses::none();
21 | }
22 | return PreservedAnalyses::all();
23 | }
24 |
25 | bool DynamicCallConverter::Run()
26 | {
27 | bool success = false;
28 |
29 | for (Function& F : *mod)
30 | {
31 | outs() << "Function Name : " << demangle(F.getName().str()) << '\n';
32 |
33 | if (F.isDeclaration() || F.hasAvailableExternallyLinkage())
34 | {
35 | continue;
36 | }
37 | if (true == hasAnnotation(&F, "nodcc"))
38 | {
39 | continue;
40 | }
41 |
42 | for (BasicBlock& BB : F)
43 | {
44 | for (Instruction& Inst : BB)
45 | {
46 | success |= Convert(Inst);
47 | }
48 | }
49 | }
50 | PrintFunction(*mod);
51 | return success;
52 | }
53 |
54 | void DynamicCallConverter::Init()
55 | {
56 |
57 | Triple triple = Triple(mod->getTargetTriple());
58 |
59 | if (triple.isOSWindows())
60 | {
61 | isWindows = true;
62 | windowsFuncArray.push_back({ "user32.dll", "MessageBoxA" });
63 | windowsFuncArray.push_back({ "user32.dll", "MessageBoxW" });
64 | windowsFuncArray.push_back({ "kernel32.dll", "Sleep" });
65 |
66 | }
67 | else
68 | {
69 | windowsFuncArray.push_back({ "", "printf" });
70 | windowsFuncArray.push_back({ "", "strlen" });
71 |
72 | if (triple.isOSDarwin())
73 | {
74 | dlopenFlag = 0x2 | 0x8;
75 | }
76 | else if (triple.isAndroid())
77 | {
78 | if (triple.isArch64Bit())
79 | {
80 | dlopenFlag = 0x00002/*RTLD_NOW*/ | 0x00100;/*RTLD_GLOBAL*/
81 | }
82 | else
83 | {
84 | dlopenFlag = 0x00000/*RTLD_NOW*/ | 0x00002;/*RTLD_GLOBAL*/
85 | }
86 | }
87 | }
88 | }
89 |
90 | bool DynamicCallConverter::Convert(Instruction& Inst)
91 | {
92 | if (false == isa(&Inst))
93 | {
94 | return false;
95 | }
96 | CallInst* callInst = dyn_cast(&Inst);
97 |
98 | if (!callInst->getCalledFunction())
99 | {
100 | return false;
101 | }
102 | outs() << "CallInst : " << Inst << "\n";
103 |
104 | StringRef loadLib;
105 | StringRef loadFunc;
106 |
107 | if (isWindows)
108 | {
109 | loadLib = "LoadLibraryA";
110 | loadFunc = "GetProcAddress";
111 | }
112 | else
113 | {
114 | loadLib = "dlopen";
115 | loadFunc = "dlsym";
116 | }
117 |
118 | if (callInst->getCalledFunction()->getName() == loadLib || callInst->getCalledFunction()->getName() == loadFunc)
119 | {
120 | return false;
121 | }
122 |
123 | StringRef name = callInst->getCalledFunction()->getName();
124 | auto it = std::find_if(windowsFuncArray.begin(), windowsFuncArray.end(), [&name](const std::pair& pair) { return pair.second == name; });
125 |
126 | if (it == windowsFuncArray.end())
127 | {
128 | outs() << "not found\n";
129 | return false;
130 | }
131 |
132 | BasicBlock* EntryBlock = callInst->getParent();
133 | IRBuilder<> IRB(EntryBlock, EntryBlock->getFirstInsertionPt());
134 |
135 | // dlopen()
136 | FunctionType* dlopenFnTy;
137 | FunctionCallee fc;
138 | if (false == isWindows)
139 | {
140 | dlopenFnTy = FunctionType::get(Int64PtrTy, { Int8PtrTy, Int32Ty }, false);
141 | }
142 | else
143 | {
144 | dlopenFnTy = FunctionType::get(Int64PtrTy, { Int8PtrTy }, false);
145 | }
146 |
147 | fc = mod->getOrInsertFunction(loadLib, dlopenFnTy);
148 |
149 | Function* dlopenFn = dyn_cast(fc.getCallee());
150 | if (!dlopenFn)
151 | {
152 | errs() << callInst->getCalledFunction()->getName() << " failed\n";
153 | return false;
154 | }
155 | Value* handle;
156 | FunctionType* dlsymFnTy = FunctionType::get(Int64PtrTy, { Int8PtrTy, Int8PtrTy }, false);
157 | Function* dlsymFn;
158 |
159 | if (false == isWindows)
160 | {
161 | handle = IRB.CreateCall(dlopenFn, { Constant::getNullValue(Int8PtrTy), ConstantInt::get(Int32Ty, dlopenFlag) });
162 | }
163 | else
164 | {
165 | handle = IRB.CreateCall(dlopenFn, { IRB.CreateGlobalStringPtr(it->first) });
166 | }
167 | dlsymFn = cast(mod->getOrInsertFunction(loadFunc, dlsymFnTy).getCallee());
168 | Value* dlsymFnAddress = IRB.CreateCall(dlsymFn, { handle, IRB.CreateGlobalStringPtr(callInst->getCalledFunction()->getName()) });
169 |
170 | Value* calledOperand = callInst->getCalledOperand();
171 | FunctionType* orgFnType = callInst->getCalledFunction()->getFunctionType();
172 | Value* dlsymFnCast = IRB.CreateBitCast(dlsymFnAddress, calledOperand->getType());
173 | // 원래 함수의 호출 규약으로 dlsymFnCast을 호출한다.
174 | callInst->setCalledFunction(orgFnType, dlsymFnCast);
175 | outs() << "changed ... " << calledOperand->getName() << "\n";
176 |
177 | return true;
178 | }
--------------------------------------------------------------------------------
/src/DynamicCallConverter/DynamicCallConverter.hpp:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "llvm/IR/PassManager.h"
3 | #include
4 |
5 | using namespace llvm;
6 |
7 | class DynamicCallConverter : public PassInfoMixin
8 | {
9 | public:
10 | PreservedAnalyses run(Module& M, ModuleAnalysisManager& MAM);
11 |
12 | private:
13 | bool Run();
14 | void Init();
15 | bool Convert(Instruction& Inst);
16 |
17 | private:
18 | Module* mod;
19 | LLVMContext* moduleContext;
20 | std::set funcArray;
21 | std::vector > windowsFuncArray;
22 | int dlopenFlag;
23 | bool isWindows = false;
24 | };
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
--------------------------------------------------------------------------------
/src/FakeInstructionInserter/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | target_sources(CodeLabyrinth PRIVATE FakeInstructionInserter.cpp)
2 |
--------------------------------------------------------------------------------
/src/FakeInstructionInserter/FakeInstructionInserter.cpp:
--------------------------------------------------------------------------------
1 | #include "FakeInstructionInserter.hpp"
2 | #include "llvm/Demangle/Demangle.h"
3 | #include "llvm/IR/Constants.h"
4 | #include "llvm/IR/InlineAsm.h"
5 | #include "llvm/IR/IRBuilder.h"
6 | #include "llvm/IR/Instructions.h"
7 | #include "llvm/TargetParser/Triple.h"
8 | #include "Common/LLVMType.hpp"
9 | #include "Common/Util.hpp"
10 |
11 | PreservedAnalyses FakeInstructionInserter::run(Module& M, ModuleAnalysisManager& FAM)
12 | {
13 | outs() << "[PASS START] FakeInstructionInserter\n";
14 | this->mod = &M;
15 | this->moduleContext = &M.getContext();
16 | GetInstance()->init(moduleContext);
17 |
18 | // check if modified
19 | if (Run() == true)
20 | {
21 | return PreservedAnalyses::none();
22 | }
23 |
24 | return PreservedAnalyses::all();
25 | }
26 |
27 | bool FakeInstructionInserter::InsertAsmIntoBlock(Function &F)
28 | {
29 | FunctionType *Ty = FunctionType::get(VoidTy, false);
30 |
31 | for (BasicBlock &BB : F)
32 | {
33 | if (BB.size() <= 1)
34 | {
35 | return false;
36 | }
37 |
38 | // insert first non-PHI instruction in this block.
39 | IRBuilder<> IRB(&BB, BB.getFirstInsertionPt());
40 |
41 | StringRef asmString;
42 | InlineAsm::AsmDialect ad;
43 |
44 | Triple triple = Triple(F.getParent()->getTargetTriple());
45 | if (triple.getArch() == Triple::aarch64)
46 | {
47 | // 아래의 코드에서 오류가 발견되었다.
48 | // cmp x3, x8
49 | // cmp x29, 0x109 : fake
50 | // b 0x8 : fake
51 | // deadbeef : fake
52 | // cset w10, ne ---> ne가 cmp x29, 0x109의 결과값으로 설정되면 안된다.
53 | // 따라서, 스택에 저장 & 복원하는 형식으로 변경한다.
54 |
55 | asmString = "str x29, [SP, #-16]!\n" // push
56 | "mrs x29, nzcv\n" // backup flag registers
57 | "cmp x29, 0x109\n" // it uses flag(ne) register
58 | "bne 0x8\n"
59 | ".long 0xdeadbeef\n"
60 | "msr nzcv, x29\n" // restore flag registers
61 | "ldr x29, [SP], #16"; // pop
62 |
63 | ad = InlineAsm::AD_ATT;
64 |
65 | }
66 | else if (triple.getArch() == Triple::x86_64)
67 | {
68 | asmString = "push rax\n"
69 | "pushfq\n"
70 | "mov rax, 0x1\n"
71 | "cmp rax, 0x1000\n"
72 | ".short 0x0475\n" // jnz +4
73 | ".long 0xf0f0f0f0\n" // bad instruction
74 | "popfq\n"
75 | "pop rax\n";
76 |
77 | ad = InlineAsm::InlineAsm::AD_Intel;
78 | }
79 | else
80 | {
81 | errs() << "Unsupported architecture.\n";
82 | return false;
83 | }
84 | InlineAsm* IA = InlineAsm::get(Ty, asmString, "", false, false, ad);
85 | IRB.CreateCall(IA);
86 | }
87 | return true;
88 | }
89 |
90 | bool FakeInstructionInserter::InsertAsmIntoPrologue(Function &F)
91 | {
92 | if (F.hasPrologueData())
93 | {
94 | return false;
95 | }
96 | StringRef obfusInst;
97 | Triple triple = Triple(F.getParent()->getTargetTriple());
98 | if (triple.getArch() == Triple::aarch64)
99 | {
100 | /*
101 | BF 27 04 F1 cmp X29, 0x109
102 | 41 00 00 54 bne 0x8
103 | CA FE BA BE just value (no inst.)
104 | */
105 |
106 | obfusInst = StringRef("\xBF\x27\x04\xF1\x41\x00\x00\x54\xCA\xFE\xBA\xBE", 12);
107 | }
108 | else if (triple.getArch() == Triple::x86_64)
109 | {
110 | /*
111 | 49 81 FC 09 01 00 00 cmp r12, 0x109
112 | 75 04 jnz 0x4
113 | CA FE BA BE just value (no inst.)
114 | */
115 | obfusInst = StringRef("\x49\x81\xFC\x09\x01\x00\x00\x75\x04\xCA\xFE\xBA\xBE", 13);
116 | }
117 | else
118 | {
119 | errs() << "Unsupported architecture.\n";
120 | }
121 | Constant* prologue = ConstantDataArray::getRaw(obfusInst, obfusInst.size(), Int8Ty);
122 | F.setPrologueData(prologue);
123 | return true;
124 | }
125 |
126 | bool FakeInstructionInserter::Run()
127 | {
128 | bool success = false;
129 |
130 | for (Function& F : *mod)
131 | {
132 | outs() << "Function Name : " << demangle(F.getName().str()) << '\n';
133 | if (F.isDeclaration() || F.hasAvailableExternallyLinkage() || F.getInstructionCount() == 0 || F.getLinkage() != GlobalValue::LinkageTypes::ExternalLinkage)
134 | {
135 | continue;
136 | }
137 | if (true == hasAnnotation(&F, "nofii"))
138 | {
139 | continue;
140 | }
141 |
142 | success |= InsertAsmIntoPrologue(F); // Binary instructions can be inserted directly into the prologue.
143 | success |= InsertAsmIntoBlock(F);
144 | }
145 | PrintFunction(*mod);
146 | return success;
147 | }
148 |
--------------------------------------------------------------------------------
/src/FakeInstructionInserter/FakeInstructionInserter.hpp:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "llvm/IR/PassManager.h"
3 |
4 | using namespace llvm;
5 |
6 | class FakeInstructionInserter : public PassInfoMixin
7 | {
8 | public:
9 | PreservedAnalyses run(Module& M, ModuleAnalysisManager& MAM);
10 |
11 | private:
12 | bool Run();
13 | bool InsertAsmIntoPrologue(Function &F);
14 | bool InsertAsmIntoBlock(Function &F);
15 |
16 | private:
17 | Module* mod;
18 | LLVMContext* moduleContext;
19 | };
20 |
--------------------------------------------------------------------------------
/src/RegisterPass.cpp:
--------------------------------------------------------------------------------
1 | #include "llvm/IR/PassManager.h"
2 | #include "llvm/Passes/OptimizationLevel.h"
3 | #include "llvm/Passes/PassBuilder.h"
4 | #include "llvm/Passes/PassPlugin.h"
5 | #include "FakeInstructionInserter/FakeInstructionInserter.hpp"
6 | #include "DynamicCallConverter/DynamicCallConverter.hpp"
7 | #include "BranchAddressEncryptor/BranchAddressEncryptor.hpp"
8 | #include "StringEncryptor/StringEncryptor.hpp"
9 |
10 | using namespace llvm;
11 |
12 | extern "C" PassPluginLibraryInfo LLVM_ATTRIBUTE_WEAK llvmGetPassPluginInfo()
13 | {
14 | // Register LLVM passes
15 | return
16 | {
17 | LLVM_PLUGIN_API_VERSION, "CodeLabyrinth", "v1.0.0", [](PassBuilder &PB)
18 | {
19 | PB.registerPipelineStartEPCallback(
20 | [](ModulePassManager &MPM, OptimizationLevel level)
21 | {
22 | // todo : Need to change to cli option
23 | MPM.addPass(FakeInstructionInserter());
24 | MPM.addPass(BranchAddressEncryptor());
25 | MPM.addPass(DynamicCallConverter());
26 | MPM.addPass(StringEncryptor());
27 | }
28 | );
29 | PB.registerScalarOptimizerLateEPCallback(
30 | [](FunctionPassManager &FPM, OptimizationLevel level)
31 | {
32 | }
33 | );
34 | }
35 | };
36 | }
37 |
--------------------------------------------------------------------------------
/src/StringEncryptor/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | target_sources(CodeLabyrinth PRIVATE StringEncryptor.cpp)
2 |
--------------------------------------------------------------------------------
/src/StringEncryptor/StringEncryptor.cpp:
--------------------------------------------------------------------------------
1 | #include "StringEncryptor.hpp"
2 | #include "llvm/IR/IRBuilder.h"
3 | #include "llvm/IR/Instructions.h"
4 | #include "llvm/IR/InstIterator.h"
5 | #include "llvm/Transforms/Utils/ModuleUtils.h"
6 | #include "llvm/Transforms/Utils/BasicBlockUtils.h"
7 | #include "llvm/Demangle/Demangle.h"
8 | #include
9 | #include "Common/Util.hpp"
10 | #include "Common/LLVMType.hpp"
11 |
12 | PreservedAnalyses StringEncryptor::run(Module& M, ModuleAnalysisManager& MAM)
13 | {
14 | outs() << "[PASS START] StringEncryptor\n";
15 | this->mod = &M;
16 | this->moduleContext = &M.getContext();
17 | GetInstance()->init(moduleContext);
18 | PrintFunction(*mod);
19 |
20 | // check if modified
21 | if (Run() == true)
22 | {
23 | return PreservedAnalyses::none();
24 | }
25 | return PreservedAnalyses::all();
26 | }
27 |
28 | bool StringEncryptor::Run()
29 | {
30 | bool success = false;
31 |
32 | for (Function& function : *mod)
33 | {
34 | outs() << "Function Name : " << demangle(function.getName().str()) << " ... " << function.getLinkage() << "...." << function.isSpeculatable() << '\n';
35 |
36 | if (false == hasAnnotation(&function, "string_encrypt"))
37 | {
38 | continue;
39 | }
40 |
41 | // ret 명령어가 없는 case
42 | // 함수안에 while(true)가 있을 가능성이 높음.
43 | // 이 로직은 ret 앞에 free()를 삽입하는 구조이므로 pass함.
44 | Instruction* retInst = GetRetInstruction(&function);
45 | if (retInst == nullptr)
46 | {
47 | outs() << "==> [SKIP] No ret instruction found.\n";
48 | continue;
49 | }
50 |
51 | success |= MarkAllStrings(function);
52 |
53 | }
54 | if (success) EncryptMarkStrings();
55 | PrintFunction(*mod);
56 |
57 | return success;
58 | }
59 |
60 | void StringEncryptor::PrintHex(unsigned char* hex, int size)
61 | {
62 | std::string line;
63 | outs() << "\t\t\t\t[" << size << "] ";
64 | for (int i = 0; i < size; i++)
65 | {
66 | char temp[5] = { 0, };
67 | sprintf(temp, "%02X ", *(hex + i));
68 | line.append(temp);
69 | if ((i % 16 == 0 && i != 0) || i == size - 1)
70 | {
71 | outs() << line;
72 | line = "";
73 | }
74 | }
75 | outs() << "\n";
76 | }
77 |
78 | bool StringEncryptor::IsStringGV(GlobalVariable* gv, Value* v)
79 | {
80 | outs() << "\t\t\t\t\tgv->getLinkage() : " << gv->getLinkage() << "\n";
81 | if (false == gv->hasInitializer())
82 | {
83 | outs() << "[INFO] Unsupport GV 1 " << v->getName() << " .. " << gv->getSection() << "\n";
84 | return false;
85 | }
86 | if (false == isa(gv->getInitializer()))
87 | {
88 | outs() << "[INFO] Unsupport GV 2 " << v->getName() << " .. " << gv->getSection() << "\n";
89 | return false;
90 | }
91 | if (gv->getLinkage() == GlobalValue::LinkageTypes::ExternalLinkage) // 전역 변수
92 | {
93 | outs() << "[INFO] Unsupport GV 3 " << v->getName() << " .. " << gv->getSection() << "\n";
94 | return false;
95 | }
96 |
97 | return true;
98 | }
99 |
100 | bool StringEncryptor::MarkAllStrings(Function& function)
101 | {
102 | bool mark = false;
103 | // 모든 BasicBlock을 순환하며 GlobalVariable을 마킹한다.
104 | for (BasicBlock& block : function)
105 | {
106 | outs() << "BasicBlock " << block.getName() << " size : " << block.size() << "\n";
107 | for (Instruction& inst : block)
108 | {
109 | outs() << "\tInst " << &inst << " : " << inst << "\n";
110 | if (isa(inst))
111 | {
112 | outs() << "contains Phi node which could raise issues!\n";
113 | continue;
114 | }
115 | for (Value* v : inst.operands())
116 | {
117 | outs() << "\t\tvalue " << v << " : " << v->getName() << "\n";
118 | GlobalVariable* gv = dyn_cast(v->stripPointerCasts());
119 | if (gv)
120 | {
121 | if (true == IsStringGV(gv, v))
122 | {
123 | outs() << "\t\t\tInst : " << &inst << " GV value " << gv << " : " << v->getName() << " / " << gv->getSection() << "\n";
124 |
125 | // mark string
126 | functionPairMap[&function].insert({ gv,nullptr });
127 | functionInstMap[&function].push_back(&inst);
128 | mark = true;
129 | }
130 | }
131 | }
132 | }
133 | }
134 | return mark;
135 | }
136 |
137 | Instruction* StringEncryptor::GetRetInstruction(Function* function)
138 | {
139 | for (Instruction& inst : instructions(function))
140 | {
141 | if (isa(&inst))
142 | {
143 | return &inst;
144 | }
145 | }
146 | return nullptr;
147 | }
148 |
149 | void StringEncryptor::EncryptMarkStrings()
150 | {
151 | std::random_device rd;
152 | std::mt19937 gen(rd());
153 | std::uniform_int_distribution<> dist(0x0, 0xFF);
154 |
155 | for (auto& [function, pairList] : functionPairMap)
156 | {
157 | // A(첫 명령어) -> 복호화 -> B(몸통)
158 | BasicBlock& firstBB = function->getEntryBlock();
159 |
160 | BasicBlock* A = &firstBB;
161 | BasicBlock* B = A->splitBasicBlock(A->getFirstNonPHIOrDbgOrLifetime());
162 |
163 | // B 앞에 복호화 블록을 생성
164 | BasicBlock* decryptBlock = BasicBlock::Create(*moduleContext, "DecryptBlock", A->getParent(), B);
165 | // A 블록에서 복호화 블록으로 점프
166 | llvm::ReplaceInstWithInst(A->getTerminator(), BranchInst::Create(decryptBlock));
167 |
168 | IRBuilder<> builderDecryptBlock(decryptBlock);
169 |
170 | // 각각의 GlobalVariable에 새로운 GlobalVariable 생성후 연결
171 | for (auto& [originalGV, mallocAddress] : pairList)
172 | {
173 | outs() << "mark :: " << originalGV << "\n";
174 | // 원래 변수
175 | ConstantDataSequential* cds = dyn_cast(originalGV->getInitializer());
176 | // 사이즈를 구함.
177 | unsigned strSize = cds->getNumElements() * cds->getElementByteSize();
178 | const char* str = cds->getRawDataValues().data();
179 | std::vector keyArray;
180 | // 1:1 XOR 키 생성
181 | for (unsigned j = 0; j < strSize; j++)
182 | {
183 | keyArray.push_back(dist(gen));
184 | }
185 | outs() << "key : ";
186 | PrintHex((unsigned char*)keyArray.data(), strSize);
187 | // 문자열 XOR
188 | std::vector encArray;
189 | for (unsigned j = 0; j < strSize; j++)
190 | {
191 | encArray.push_back(str[j] ^ keyArray[j]);
192 | }
193 | outs() << "original : " << str << "\n";
194 | PrintHex((unsigned char*)str, strSize);
195 | outs() << "encrypt : ";
196 | PrintHex((unsigned char*)encArray.data(), strSize);
197 | // 타겟의 data 섹션에 들어가는 변수 생성
198 | Constant* encryptConst = ConstantDataArray::get(*moduleContext, ArrayRef(encArray));
199 | GlobalVariable* encryptGV = new GlobalVariable(*mod, encryptConst->getType(), false, GlobalValue::LinkageTypes::PrivateLinkage, encryptConst, "EncStr");
200 |
201 | // 최적화 방지
202 | llvm::appendToCompilerUsed(*encryptGV->getParent(), { encryptGV });
203 |
204 | // malloc 명령어 생성
205 | llvm::Function* mallocFunc = llvm::cast(
206 | mod->getOrInsertFunction("malloc", llvm::FunctionType::get(Int8PtrTy, { Int64Ty }, false)).getCallee());
207 | llvm::Value* sizeValue = llvm::ConstantInt::get(Int64Ty, strSize);
208 |
209 | // malloc 실행 후 주소 할당 받음
210 | llvm::Value* allocatedMemory = builderDecryptBlock.CreateCall(mallocFunc, { sizeValue });
211 |
212 | // 로컬 변수에 저장
213 | AllocaInst* ai = builderDecryptBlock.CreateAlloca(Int64Ty);
214 | builderDecryptBlock.CreateStore(allocatedMemory, ai, true);
215 | mallocAddress = ai;
216 | allocSize[mallocAddress] = strSize;
217 | ArrayType* strType = ArrayType::get(Int8Ty, strSize);
218 |
219 | for (int j = 0; j < strSize; j++)
220 | {
221 | // 복호화 결과를 malloc 메모리에 저장
222 | Value* encValue = builderDecryptBlock.CreateGEP(strType, encryptGV, { builderDecryptBlock.getInt32(0), builderDecryptBlock.getInt32(j) });
223 | Value* decValue = builderDecryptBlock.CreateGEP(strType, allocatedMemory, { builderDecryptBlock.getInt32(0), builderDecryptBlock.getInt32(j) });
224 |
225 | // encryptGV에서 한글자 로딩
226 | LoadInst* loadOneByte = builderDecryptBlock.CreateLoad(Int8Ty, encValue, "encryptInst");
227 | loadOneByte->setVolatile(true);
228 | // key와 loadOneByte를 xor
229 | Value* xorValue = builderDecryptBlock.CreateXor(loadOneByte, keyArray[j]);
230 | // 복호화 메모리에 저장
231 | builderDecryptBlock.CreateStore(xorValue, decValue, true);
232 | }
233 | }
234 | builderDecryptBlock.CreateBr(B);
235 | }
236 |
237 | // free 삽입
238 | for (auto& [function, pairList] : functionPairMap)
239 | {
240 | // Run()에서 ret 명령어의 존재를 체크했으므로 무조건 존재한다고 가정함
241 | Instruction* retInst = GetRetInstruction(function);
242 |
243 | BasicBlock* BB = retInst->getParent();
244 | BasicBlock* A = BB;
245 | BasicBlock* B = A->splitBasicBlock(retInst);
246 | // B 앞에 복호화 블록을 생성
247 | BasicBlock* freeBlock = BasicBlock::Create(*moduleContext, "FreeBlock", A->getParent(), B);
248 | // A 블록에서 free 블록으로 점프
249 | llvm::ReplaceInstWithInst(A->getTerminator(), BranchInst::Create(freeBlock));
250 |
251 | IRBuilder<> builderFreeBlock(freeBlock);
252 |
253 | for (const auto& pair : pairList)
254 | {
255 | AllocaInst* mallocAddress = pair.second;
256 |
257 | LoadInst* li = builderFreeBlock.CreateLoad(Int64PtrTy, mallocAddress);
258 | li->setVolatile(true);
259 |
260 | // free 하기 전에 메모리를 0으로..
261 | Constant* wipeConstant = ConstantInt::get(Int8Ty, 0);
262 | int strSize = allocSize[mallocAddress];
263 | ArrayType* strType = ArrayType::get(Int8Ty, strSize);
264 | for (int i = 0; i < strSize; i++)
265 | {
266 | Value* decValue = builderFreeBlock.CreateGEP(strType, li, { builderFreeBlock.getInt32(0), builderFreeBlock.getInt32(i) });
267 | builderFreeBlock.CreateStore(wipeConstant, decValue, true);
268 | }
269 |
270 | // free 명령어 생성
271 | llvm::Function* freeFunc = llvm::cast(mod->getOrInsertFunction("free", llvm::FunctionType::get(llvm::Type::getVoidTy(*moduleContext), { Int8PtrTy }, false)).getCallee());
272 | builderFreeBlock.CreateCall(freeFunc, { li });
273 |
274 | }
275 | builderFreeBlock.CreateBr(B);
276 | }
277 |
278 | // GV 교체
279 | for (const auto& [function, instructions] : functionInstMap)
280 | {
281 | PairList gvPair = functionPairMap[function];
282 |
283 | for (const auto& pair : gvPair)
284 | {
285 | GlobalVariable* originalGV = pair.first;
286 | AllocaInst* mallocAddress = pair.second;
287 |
288 | for (const auto& inst : instructions)
289 | {
290 | IRBuilder<>* branchInstBuilder = new IRBuilder<>(inst);
291 | LoadInst* li = branchInstBuilder->CreateLoad(Int64PtrTy, mallocAddress);
292 | li->setVolatile(true);
293 | //li->setAlignment(Align(4));
294 |
295 | // GV <-> mallocAddress
296 | // 명령어에서 문자열 변수 교체
297 | // 예를 들어, 아래와 같이 바뀜
298 | // %4 = call i32 (ptr, ...) @wprintf(ptr noundef @.str), !dbg !1
299 | // -> %4 = call i32 (ptr, ...) @wprintf(ptr noundef @-EncryptString), !dbg !11
300 | inst->replaceUsesOfWith(originalGV, li);
301 | }
302 | }
303 | }
304 | }
305 |
--------------------------------------------------------------------------------
/src/StringEncryptor/StringEncryptor.hpp:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "llvm/IR/PassManager.h"
3 | #include "llvm/IR/Instructions.h"
4 | #include