/*************************************************************************************************** Zyan Disassembler Library (Zydis) Original Author : Florian Bernd * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal * in the Software without restriction, including without limitation the rights * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, and to permit persons to whom the Software is * furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included in all * copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE * SOFTWARE. ***************************************************************************************************/ /** * @file * @brief Demonstrates basic hooking functionality of the `ZydisFormatter` * class by implementing a custom symbol-resolver. */ #define NDEBUG #include "pch.h" #include "Zycore/Format.h" #include "Zycore/LibC.h" #include "Zydis/Zydis.h" #pragma comment(lib, "Zydis.lib") #pragma comment(lib, "Zycore.lib") // // Global Variables // extern UINT32 g_DisassemblerSyntax; /* ============================================================================================== */ /* Enums and Types */ /* ============================================================================================== */ /** * @brief Defines the `ZydisSymbol` struct. */ typedef struct ZydisSymbol_ { /** * @brief The symbol address. */ ZyanU64 address; /** * @brief The symbol name. */ const char *name; } ZydisSymbol; /* ============================================================================================== */ /* Static data */ /* ============================================================================================== */ /** * @brief A static symbol table with some dummy symbols. */ static const ZydisSymbol SYMBOL_TABLE[3] = { {0x007FFFFFFF401000, "SomeModule.EntryPoint"}, {0x007FFFFFFF530040, "SomeModule.SomeData"}, {0x007FFFFFFF401100, "SomeModule.SomeFunction"}}; /* ============================================================================================== */ /* Hook callbacks */ /* ============================================================================================== */ ZydisFormatterFunc default_print_address_absolute; /** * @brief Print addresses * * @param formatter * @param buffer * @param context * @return ZyanStatus */ static ZyanStatus ZydisFormatterPrintAddressAbsolute(const ZydisFormatter *formatter, ZydisFormatterBuffer *buffer, ZydisFormatterContext *context) { ZyanU64 address; ZYAN_CHECK(ZydisCalcAbsoluteAddress(context->instruction, context->operand, context->runtime_address, &address)); for (ZyanUSize i = 0; i < ZYAN_ARRAY_LENGTH(SYMBOL_TABLE); ++i) { if (SYMBOL_TABLE[i].address == address) { ZYAN_CHECK(ZydisFormatterBufferAppend(buffer, ZYDIS_TOKEN_SYMBOL)); ZyanString *string; ZYAN_CHECK(ZydisFormatterBufferGetString(buffer, &string)); return ZyanStringAppendFormat(string, "<%s>", SYMBOL_TABLE[i].name); } } return default_print_address_absolute(formatter, buffer, context); } /* ============================================================================================== */ /* Helper functions */ /* ============================================================================================== */ /** * @brief Disassemble a user-mode buffer * * @param decoder * @param runtime_address * @param data * @param length */ void DisassembleBuffer(ZydisDecoder *decoder, ZyanU64 runtime_address, ZyanU8 *data, ZyanUSize length) { ZydisFormatter formatter; if (g_DisassemblerSyntax == 1) { ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL); } else if (g_DisassemblerSyntax == 2) { ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_ATT); } else if (g_DisassemblerSyntax == 3) { ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL_MASM); } else { ShowMessages("err, in selecting disassembler syntax\n"); return; } ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE); ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE); // // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that formats // the absolute addresses // default_print_address_absolute = (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute; ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute); ZydisDecodedInstruction instruction; char buffer[256]; while (ZYAN_SUCCESS( ZydisDecoderDecodeBuffer(decoder, data, length, &instruction))) { // ZYAN_PRINTF("%016" PRIX64 " ", runtime_address); ShowMessages("%s", SeparateTo64BitValue(runtime_address).c_str()); // // We have to pass a `runtime_address` different to // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses // ZydisFormatterFormatInstruction(&formatter, &instruction, &buffer[0], sizeof(buffer), runtime_address); // // Show the memory for this instruction // for (size_t i = 0; i < instruction.length; i++) { ZyanU8 MemoryContent = data[i]; ShowMessages(" %02X", MemoryContent); } // // Add padding (we assume that each instruction should be at least 10 bytes) // #define PaddingLength 12 if (instruction.length < PaddingLength) { for (size_t i = 0; i < PaddingLength - instruction.length; i++) { ShowMessages(" "); } } ShowMessages(" %s\n", &buffer[0]); data += instruction.length; length -= instruction.length; runtime_address += instruction.length; } } /* ============================================================================================== */ /* Entry point */ /* ============================================================================================== */ /** * @brief Zydis test * * @return int */ int ZydisTest() { if (ZydisGetVersion() != ZYDIS_VERSION) { fputs("Invalid zydis version\n", ZYAN_STDERR); return EXIT_FAILURE; } ZyanU8 data[] = { 0x48, 0x8B, 0x05, 0x39, 0x00, 0x13, 0x00, // mov rax, qword ptr ds:[] 0x50, // push rax 0xFF, 0x15, 0xF2, 0x10, 0x00, 0x00, // call qword ptr ds:[] 0x85, 0xC0, // test eax, eax 0x0F, 0x84, 0x00, 0x00, 0x00, 0x00, // jz 0x007FFFFFFF400016 0xE9, 0xE5, 0x0F, 0x00, 0x00 // jmp }; ZydisDecoder decoder; ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); DisassembleBuffer(&decoder, 0x007FFFFFFF400000, &data[0], sizeof(data)); return 0; } /* ============================================================================================== */ /* ============================================================================================== */ /* Entry point */ /* ============================================================================================== */ /** * @brief Disassemble x64 assemblies * * @param BufferToDisassemble buffer to disassemble * @param BaseAddress the base address of assembly * @param Size size of byffer * @return int */ int HyperDbgDisassembler64(unsigned char *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size) { if (ZydisGetVersion() != ZYDIS_VERSION) { fputs("Invalid zydis version\n", ZYAN_STDERR); return EXIT_FAILURE; } ZydisDecoder decoder; ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); DisassembleBuffer(&decoder, BaseAddress, &BufferToDisassemble[0], Size); return 0; } /** * @brief Disassemble 32 bit assemblies * * @param BufferToDisassemble buffer to disassemble * @param BaseAddress the base address of assembly * @param Size size of byffer * @return int */ int HyperDbgDisassembler32(unsigned char *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size) { if (ZydisGetVersion() != ZYDIS_VERSION) { fputs("Invalid zydis version\n", ZYAN_STDERR); return EXIT_FAILURE; } ZydisDecoder decoder; ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_ADDRESS_WIDTH_32); DisassembleBuffer(&decoder, (UINT32)BaseAddress, &BufferToDisassemble[0], Size); return 0; } /* ============================================================================================== */