-
Notifications
You must be signed in to change notification settings - Fork 1
/
template.go
137 lines (116 loc) · 3.3 KB
/
template.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
package main
import (
"fmt"
"os"
"path"
"path/filepath"
"strings"
)
const (
TPL_SNIPPETS_DIR = "%s/tpls/%ss/%s"
TPL_SNIPPETS_OBF_DIR = "%s/tpls/obfs"
TPL_CODE_FILE = "%s/tpls/code/%s.c"
TPL_SNIPPET_KEY = "%s_%s"
TPL_VARIANT_NAME = "%s_%s_%02d"
// TPL_SNIPPET_C_FUNC = "static void %s(_obf_api_caller_t caller) {\n%s}"
// TPL_SNIPPET_ASM_FUNC = "static void %s() {\n%s}"
TPL_SNIPPET_C_FUNC = "static forceinline void %s(_obf_api_caller_t caller) {\n%s}" // Pass caller by value to force binary obfuscation
TPL_SNIPPET_ASM_FUNC = "static forceinline void %s() {\n%s}"
TPL_SNIPPET_C_CALL = "%s(caller);"
TPL_SNIPPET_ASM_CALL = "%s();"
TPL_API_PROC_NAME = "_obf_api_proc_%s"
TCP_API_CALL_0 = "_obf_API_CALL_0(caller, %s)"
TCP_API_CALL_N = "_obf_API_CALL_N(caller, %s)"
TPL_DATA_DEFINE = "#define %-43s (_obf_data + %d)"
TPL_CUSTOM_DEFINE = "#define %-43s %v"
TPL_STRING_NAME = "_obf_str_%02d_%s"
TPL_STRING_ALLOC = "_obf_STRING_ALLOC(%s, %s);"
TPL_STRING_FREE = "_obf_STRING_FREE(%s);"
CODE_SHELL_CALL = "_obf_execute_shellcode(caller);"
CODE_CALLER_INIT = "_obf_api_caller_t caller; _obf_get_caller(&caller);"
CODE_CALLER = "caller"
CODE_CALLER_PTR = "&caller"
CODE_CALLER_VAR = "_obf_api_caller_t caller"
CODE_CALLER_VAR_PTR = "_obf_api_caller_t *caller"
CODE_CALLER_CAST = "_obf_api_caller_t caller = *(_obf_api_caller_t *)"
NAME_API_KERNEL = "_obf_api_kernel"
NAME_API_GET_PROC_ADDRESS = "_obf_api_get_proc_address"
NAME_API_KEY = "_obf_api_key"
NAME_API_KEY_SIZE = "_obf_api_key_size"
NAME_SHELL = "_obf_shellcode"
NAME_SHELL_KEY = "_obf_shellcode_key"
NAME_SHELL_SIZE = "_obf_shellcode_size"
valueApiKernel = "kernel32.dll"
valueGetProcAddress = "GetProcAddress"
)
type Lang uint
const (
LANG_C Lang = 1 << iota
LANG_ASM
LANG_MASK_ALL = (LANG_C | LANG_ASM)
)
func (lang Lang) String() string {
switch lang {
case LANG_C:
return "c"
case LANG_ASM:
return "asm"
default:
return "unknown"
}
}
func (lang Lang) CallFormat() string {
switch lang {
case LANG_C:
return TPL_SNIPPET_C_CALL
case LANG_ASM:
return TPL_SNIPPET_ASM_CALL
default:
panic("Assert: Invalid Language passed for Snippet Call Format")
}
}
func (lang Lang) TemplateKey() string {
switch lang {
case LANG_C:
return "{{c-snippets}}"
case LANG_ASM:
return "{{asm-snippets}}"
default:
panic("Assert: Invalid Language passed for Snippets Template Key")
}
}
type Template struct {
lang Lang
name string
code string
}
func loadObfTpls() []*Template {
return loadTemplates(fmt.Sprintf(TPL_SNIPPETS_OBF_DIR, *workingDir), LANG_ASM)
}
func loadTpls(typ SnippetType, lang Lang) []*Template {
return loadTemplates(fmt.Sprintf(TPL_SNIPPETS_DIR, *workingDir, typ, lang), lang)
}
func loadTemplates(dir string, lang Lang) []*Template {
var templates []*Template
files, err := os.ReadDir(dir)
if err != nil {
return templates
}
for _, file := range files {
if file.IsDir() {
continue
}
name := file.Name()
ext := filepath.Ext(name)
if ext != ".c" {
continue
}
template := &Template{
lang,
cFuncName(strings.TrimSuffix(name, ext)),
loadFile(path.Join(dir, name)),
}
templates = append(templates, template)
}
return templates
}