ObfuscationInline.hpp

#pragma once
#include <vector>
#include <string>
#include <algorithm>
#include <cctype>
#include <cstdint>
#include <cstring>
#include <windows.h>
#include "ObfuscationOptions.hpp"

inline void obfuscate(std::vector<char>& data, char key, const ObfuscationOptions& opts)
{
    if (data.size() < sizeof(IMAGE_DOS_HEADER)) return;
    IMAGE_DOS_HEADER* dosHeader = reinterpret_cast<IMAGE_DOS_HEADER*>(data.data());
    if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return;
    IMAGE_NT_HEADERS* ntHeader = reinterpret_cast<IMAGE_NT_HEADERS*>(data.data() + dosHeader->e_lfanew);
    if (ntHeader->Signature != IMAGE_NT_SIGNATURE) return;
    IMAGE_SECTION_HEADER* sectionHeaders;
    if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
        sectionHeaders = reinterpret_cast<IMAGE_SECTION_HEADER*>(reinterpret_cast<char*>(ntHeader) + sizeof(IMAGE_NT_HEADERS64));
    } else {
        sectionHeaders = reinterpret_cast<IMAGE_SECTION_HEADER*>(reinterpret_cast<char*>(ntHeader) + sizeof(IMAGE_NT_HEADERS32));
    }
    bool decoder_injected = false;
    IMAGE_SECTION_HEADER* textSecPtr = nullptr;
    IMAGE_SECTION_HEADER* rdataSecPtr = nullptr;
    for (int i = 0; i < ntHeader->FileHeader.NumberOfSections; ++i) {
        IMAGE_SECTION_HEADER& section = sectionHeaders[i];
        std::string sectionName(reinterpret_cast<char*>(section.Name), 8);
        size_t nullPos = sectionName.find('\0');
        if (nullPos != std::string::npos) sectionName = sectionName.substr(0, nullPos);
        if (sectionName.find(".text") == 0) {
            textSecPtr = &section;
            size_t sectionStart = section.PointerToRawData;
            size_t sectionSize = section.SizeOfRawData;
            if (sectionStart + sectionSize <= data.size()) {
                if (opts.mutate_nop_pairs) {
                    for (size_t j = sectionStart; j < sectionStart + sectionSize - 2; ++j) {
                        if ((unsigned char)data[j] == 0x90 && (unsigned char)data[j+1] == 0x90) { data[j] = 0x89; data[j+1] = 0xC0; ++j; }
                    }
                }
                if (opts.mutate_single_nops) {
                    for (size_t j = sectionStart; j < sectionStart + sectionSize; ++j) {
                        if ((unsigned char)data[j] == 0x90 && j + 2 < sectionStart + sectionSize) { data[j] = 0x8D; data[j+1] = 0x40; data[j+2] = 0x00; j += 2; }
                    }
                }
                if (opts.padding_obfuscation) {
                    for (size_t j = sectionStart + sectionSize - 100; j < sectionStart + sectionSize; ++j) {
                        if (j < data.size() && data[j] == 0x00) { data[j] = (char)(0xCC ^ (j & 0xFF)); }
                    }
                }
                if (opts.dead_code_insertion) {
                    size_t startScan = (sectionSize > 256) ? (sectionStart + sectionSize - 256) : sectionStart;
                    for (size_t o = startScan; o + 10 <= sectionStart + sectionSize; ++o) {
                        if (data[o] == 0x00 && data[o+1] == 0x00 && data[o+2] == 0x00 && data[o+3] == 0x00 && data[o+4] == 0x00 && data[o+5] == 0x00 && data[o+6] == 0x00 && data[o+7] == 0x00 && data[o+8] == 0x00 && data[o+9] == 0x00) {
                            data[o] = 0x3D; data[o+1] = 0xEF; data[o+2] = 0xBE; data[o+3] = 0xAD; data[o+4] = 0xDE; data[o+5] = 0x75; data[o+6] = 0x00; data[o+7] = 0x31; data[o+8] = 0xC0; data[o+9] = 0x90;
                            break;
                        }
                    }
                }
                if (opts.loop_unrolling) {
                    for (size_t j = sectionStart; j < sectionStart + sectionSize - 10; ++j) {
                        if ((unsigned char)data[j] == 0x40 && (unsigned char)data[j+1] == 0x83 && (unsigned char)data[j+2] == 0xF8) {
                            if (j + 15 < sectionStart + sectionSize) { data[j] = 0x40; data[j+1] = 0x40; data[j+2] = 0x40; data[j+3] = 0x90; data[j+4] = 0x90; j += 4; }
                        }
                    }
                }
                if (opts.control_flow_flattening) {
                    for (size_t j = sectionStart; j + 6 <= sectionStart + sectionSize; ++j) {
                        if ((unsigned char)data[j] == 0x90 && (unsigned char)data[j+1] == 0x90 && (unsigned char)data[j+2] == 0x90 && (unsigned char)data[j+3] == 0x90 && (unsigned char)data[j+4] == 0x90 && (unsigned char)data[j+5] == 0x90) {
                            data[j] = 0x85; data[j+1] = 0xC0; data[j+2] = 0x75; data[j+3] = 0x05; data[j+4] = 0x31; data[j+5] = 0xC0;
                            j += 5;
                        }
                    }
                }
            }
        }
        if (sectionName.find(".rdata") == 0) {
            rdataSecPtr = &section;
        }
    }
    if (opts.string_encryption && ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC && textSecPtr && rdataSecPtr) {
        size_t tStart = textSecPtr->PointerToRawData;
        size_t mapSpan = (size_t)textSecPtr->SizeOfRawData < (size_t)textSecPtr->Misc.VirtualSize ? (size_t)textSecPtr->SizeOfRawData : (size_t)textSecPtr->Misc.VirtualSize;
        size_t mappedEnd = tStart + mapSpan;
        size_t stubNeed = 80;
        size_t stubOffset = 0;
        size_t run = 0;
        for (size_t j = tStart; j < mappedEnd; ++j) {
            if ((unsigned char)data[j] == 0x00) { ++run; if (run >= stubNeed) { stubOffset = j - run + 1; break; } }
            else run = 0;
        }
        if (stubOffset && (stubOffset + stubNeed <= mappedEnd)) {
            rdataSecPtr->Characteristics |= IMAGE_SCN_MEM_WRITE;
            uint32_t rva_rdata = rdataSecPtr->VirtualAddress;
            uint32_t rva_oep = ntHeader->OptionalHeader.AddressOfEntryPoint;
            uint32_t rdata_size = (uint32_t)rdataSecPtr->Misc.VirtualSize;
            std::vector<unsigned char> stub;
            auto emit32 = [&](uint32_t v){ stub.push_back((unsigned char)(v & 0xFF)); stub.push_back((unsigned char)((v >> 8) & 0xFF)); stub.push_back((unsigned char)((v >> 16) & 0xFF)); stub.push_back((unsigned char)((v >> 24) & 0xFF)); };
            // mov rax, gs:[0x60]
            unsigned char p1[] = {0x65,0x48,0x8B,0x04,0x25,0x60,0x00,0x00,0x00};
            stub.insert(stub.end(), std::begin(p1), std::end(p1));
            // mov rbx, [rax+0x10]
            unsigned char p2[] = {0x48,0x8B,0x58,0x10};
            stub.insert(stub.end(), std::begin(p2), std::end(p2));
            // lea rsi, [rbx + rva_rdata]
            unsigned char p3[] = {0x48,0x8D,0xB3};
            stub.insert(stub.end(), std::begin(p3), std::end(p3)); emit32(rva_rdata);
            // mov ecx, rdata_size
            stub.push_back(0xB9); emit32(rdata_size);
            // body start
            size_t bodyStart = stub.size();
            unsigned char body[] = {
                0x8A,0x06,       // mov al,[rsi]
                0x3C,0x20,       // cmp al,0x20
                0x72,0x08,       // jb skip (rel8=8)
                0x3C,0x7F,       // cmp al,0x7F
                0x73,0x04,       // jae skip (rel8=4)
                0x34, (unsigned char)0xAA, // xor al,0xAA
                0x88,0x06,       // mov [rsi],al
                // skip:
                0x48,0xFF,0xC6,  // inc rsi
                0xE2,0xF0        // loop back (rel8 = -16)
            };
            stub.insert(stub.end(), std::begin(body), std::end(body));
            // mov rax, rbx ; add rax, oep ; jmp rax
            unsigned char tail1[] = {0x48,0x89,0xD8};
            stub.insert(stub.end(), std::begin(tail1), std::end(tail1));
            unsigned char tail2[] = {0x48,0x05};
            stub.insert(stub.end(), std::begin(tail2), std::end(tail2)); emit32(rva_oep);
            unsigned char tail3[] = {0xFF,0xE0};
            stub.insert(stub.end(), std::begin(tail3), std::end(tail3));
            if (stub.size() <= stubNeed) {
                std::memcpy(&data[stubOffset], stub.data(), stub.size());
                uint32_t stubRva = textSecPtr->VirtualAddress + (uint32_t)(stubOffset - textSecPtr->PointerToRawData);
                ntHeader->OptionalHeader.AddressOfEntryPoint = stubRva;
                decoder_injected = true;
            }
        }
    }
    if (opts.string_encryption) {
        IMAGE_SECTION_HEADER* rdataSec = nullptr;
        IMAGE_SECTION_HEADER* textSec = nullptr;
        for (int i = 0; i < ntHeader->FileHeader.NumberOfSections; ++i) {
            IMAGE_SECTION_HEADER& s = sectionHeaders[i];
            std::string nm(reinterpret_cast<char*>(s.Name), 8); size_t p = nm.find('\0'); if (p != std::string::npos) nm = nm.substr(0, p);
            if (nm.find(".rdata") == 0) rdataSec = &s;
            if (nm.find(".text") == 0) textSec = &s;
        }
        std::vector<unsigned char> protectedMap;
        if (rdataSec && textSec) {
            protectedMap.assign(rdataSec->SizeOfRawData, 0);
            size_t tStart = textSec->PointerToRawData, tEnd = tStart + textSec->SizeOfRawData;
            size_t tRvaBase = textSec->VirtualAddress;
            size_t rVA = rdataSec->VirtualAddress, rVEnd = rVA + rdataSec->Misc.VirtualSize;
            size_t rStart = rdataSec->PointerToRawData, rEnd = rStart + rdataSec->SizeOfRawData;
            if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
                for (size_t pos = tStart; pos + 4 <= tEnd; pos += 4) {
                    uint32_t val = *reinterpret_cast<uint32_t*>(&data[pos]);
                    if (val >= rVA && val < rVEnd) {
                        size_t off = rStart + (val - rVA);
                        if (off < rEnd) {
                            size_t k = off;
                            while (k < rEnd && data[k] != '\0') { protectedMap[k - rStart] = 1; ++k; }
                        }
                    }
                }
            } else if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
                for (size_t pos = tStart; pos + 7 <= tEnd; ++pos) {
                    unsigned char b = static_cast<unsigned char>(data[pos]);
                    size_t i = pos;
                    bool hasRex = (b >= 0x40 && b <= 0x4F);
                    if (hasRex) { ++i; if (i >= tEnd) break; }
                    unsigned char op = static_cast<unsigned char>(data[i]);
                    if (op == 0x8D || op == 0x8B) {
                        if (i + 6 <= tEnd) {
                            unsigned char modrm = static_cast<unsigned char>(data[i+1]);
                            if ((modrm & 0xC7) == 0x05) {
                                int32_t disp = *reinterpret_cast<int32_t*>(&data[i+2]);
                                size_t instrLen = (hasRex ? 1 : 0) + 1 + 1 + 4;
                                size_t instrRva = tRvaBase + (i - tStart);
                                int64_t tgtRvaSigned = static_cast<int64_t>(instrRva) + static_cast<int64_t>(instrLen) + static_cast<int64_t>(disp);
                                if (tgtRvaSigned >= 0) {
                                    size_t tgtRva = static_cast<size_t>(tgtRvaSigned);
                                    if (tgtRva >= rVA && tgtRva < rVEnd) {
                                        size_t off = rStart + (tgtRva - rVA);
                                        if (off < rEnd) {
                                            size_t k = off;
                                            while (k < rEnd && data[k] != '\0') { protectedMap[k - rStart] = 1; ++k; }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
        for (int i = 0; i < ntHeader->FileHeader.NumberOfSections; ++i) {
            IMAGE_SECTION_HEADER& section = sectionHeaders[i];
            std::string sectionName(reinterpret_cast<char*>(section.Name), 8);
            if (sectionName.find(".rdata") == 0) {
                size_t s = section.PointerToRawData, n = section.SizeOfRawData;
                if (s + n <= data.size()) {
                    for (size_t j = s; j + 4 < s + n; ++j) {
                        if (!decoder_injected) {
                            if (!protectedMap.empty()) { if (protectedMap[j - s]) continue; } else { if (!(j >= s + 2 && data[j-1] == 0x00 && data[j-2] == 0x00)) continue; }
                        }
                        if (isprint((unsigned char)data[j]) && isprint((unsigned char)data[j+1]) && isprint((unsigned char)data[j+2]) && isprint((unsigned char)data[j+3])) {
                            size_t k = j;
                            while (k < s + n && isprint((unsigned char)data[k])) { data[k] ^= 0xAA; ++k; }
                            j = k - 1;
                        }
                    }
                }
            }
        }
    }
    if (ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress != 0) {
        size_t importRVA = ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
        size_t importSize = ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size;
        for (int i = 0; i < ntHeader->FileHeader.NumberOfSections; ++i) {
            IMAGE_SECTION_HEADER& section = sectionHeaders[i];
            if (importRVA >= section.VirtualAddress && importRVA < section.VirtualAddress + section.Misc.VirtualSize) {
                size_t importOffset = section.PointerToRawData + (importRVA - section.VirtualAddress);
                if (importOffset + importSize <= data.size()) {
                    size_t currentOffset = importOffset;
                    while (currentOffset + sizeof(IMAGE_IMPORT_DESCRIPTOR) <= importOffset + importSize) {
                        IMAGE_IMPORT_DESCRIPTOR* importDesc = reinterpret_cast<IMAGE_IMPORT_DESCRIPTOR*>(&data[currentOffset]);
                        if (importDesc->Name == 0) break;
                        if (opts.dll_name_encryption) {
                            importDesc->TimeDateStamp ^= 0xBB;
                        }
                        if (opts.function_name_encryption && importDesc->OriginalFirstThunk >= section.VirtualAddress && importDesc->OriginalFirstThunk < section.VirtualAddress + section.Misc.VirtualSize) {
                            size_t thunkOffset = section.PointerToRawData + (importDesc->OriginalFirstThunk - section.VirtualAddress);
                            size_t thunkIndex = 0;
                            while (thunkOffset + thunkIndex * 8 + 8 <= data.size()) {
                                uint64_t thunkValue = *reinterpret_cast<uint64_t*>(&data[thunkOffset + thunkIndex * 8]);
                                if (thunkValue == 0) break;
                                if ((thunkValue & 0x8000000000000000ULL) == 0) {
                                    size_t nameRVA = (size_t)(thunkValue & 0xFFFFFFFFULL);
                                    if (nameRVA >= section.VirtualAddress && nameRVA < section.VirtualAddress + section.Misc.VirtualSize) {
                                        size_t hintOffset = section.PointerToRawData + (nameRVA - section.VirtualAddress);
                                        if (hintOffset + 2 <= data.size()) {
                                            data[hintOffset] ^= 0xCC;
                                            data[hintOffset + 1] ^= 0xCC;
                                        }
                                    }
                                }
                                ++thunkIndex;
                                if (thunkIndex > 1000) break;
                            }
                        }
                        if (opts.function_name_encryption && importDesc->FirstThunk >= section.VirtualAddress && importDesc->FirstThunk < section.VirtualAddress + section.Misc.VirtualSize) {
                            size_t ftOffset = section.PointerToRawData + (importDesc->FirstThunk - section.VirtualAddress);
                            if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
                                size_t idx = 0;
                                while (ftOffset + idx * 8 + 8 <= data.size()) {
                                    uint64_t v = *reinterpret_cast<uint64_t*>(&data[ftOffset + idx * 8]);
                                    if (v == 0) break;
                                    v ^= 0x5A5A5A5A5A5A5A5AULL;
                                    *reinterpret_cast<uint64_t*>(&data[ftOffset + idx * 8]) = v;
                                    ++idx; if (idx > 1000) break;
                                }
                            } else {
                                size_t idx = 0;
                                while (ftOffset + idx * 4 + 4 <= data.size()) {
                                    uint32_t v = *reinterpret_cast<uint32_t*>(&data[ftOffset + idx * 4]);
                                    if (v == 0) break;
                                    v ^= 0x5A5A5A5AU;
                                    *reinterpret_cast<uint32_t*>(&data[ftOffset + idx * 4]) = v;
                                    ++idx; if (idx > 2000) break;
                                }
                            }
                        }
                        currentOffset += sizeof(IMAGE_IMPORT_DESCRIPTOR);
                    }
                }
                break;
            }
        }
    }
    if (opts.debug_stripping && ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress != 0) {
        size_t debugRVA = ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
        for (int i = 0; i < ntHeader->FileHeader.NumberOfSections; ++i) {
            IMAGE_SECTION_HEADER& section = sectionHeaders[i];
            if (debugRVA >= section.VirtualAddress && debugRVA < section.VirtualAddress + section.Misc.VirtualSize) {
                size_t debugOffset = section.PointerToRawData + (debugRVA - section.VirtualAddress);
                size_t debugSize = ntHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size;
                if (debugOffset + debugSize <= data.size()) std::fill(data.begin() + debugOffset, data.begin() + debugOffset + debugSize, 0);
                break;
            }
        }
    }
}