meme / hellscape Goto Github PK

View Code? Open in Web Editor NEW

387.0 15.0 34.0 30 KB

GIMPLE obfuscator for C, C++, Go, ... all supported GCC targets and front-ends that use GIMPLE.

License: GNU General Public License v3.0

C++ 89.51% C 8.95% CMake 1.54%

gcc obfuscator compilers

hellscape's People

Contributors

Stargazers

Watchers

hellscape's Issues

Add percentage coverage options

-perFLA=X
-perSUB=X
-perBCF=X

Add Go example

Show how to obfuscate a gccgo-compiled program.

[Question] Debugging hellscape

@meme thanks for sharing hellscape. It is very illustrative to have running code in parallel to the plugin documentation.

I was able to compile and run hellscape with Ubuntu's GCC 10.0.1. Now that I have it running I'd like to set some breakpoints to explore things.

I saw that this note in the readme:

Additionally: If you experience crashes when developing your plug-in, you can debug them by passing -wrapper gdb,--args to gcc. (Run gcc in gdb, effectively.)

However, it is not very clear to me how to do it. I get this gdb error:

$ gcc -wrapper gdb foo.c
gdb: unrecognized option '-imultiarch'
Use `gdb --help' for a complete list of options.

I also tried setting a breakpoint as follows but does not stop in the dummy NXPass that I just created.

$ gdb gcc
...
Reading symbols from gcc...
(No debugging symbols found in gcc)
(gdb) b Quit
(gdb) b NXPass::execute
Function "NXPass::execute" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (NXPass::execute) pending.
(gdb) r -fplugin=./hellscape.so -fplugin-arg-hellscape-nx foo.c -fdump-tree-all-graph
Starting program: /usr/bin/gcc -fplugin=./hellscape.so -fplugin-arg-hellscape-nx foo.c -fdump-tree-all-graph
[Detaching after vfork from child process 8598]
[Detaching after vfork from child process 8599]
[Detaching after vfork from child process 8600]
[Inferior 1 (process 8594) exited normally]
(gdb)

When executed directly the NX pass generates an output so it is working.

Can you please share how you debug hellscape?

fla problem

Hello, I try to fla process the following function,

void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
    int i;
    unsigned char c = l[0], carry = c >> 7, cnext;

    for (i = 0; i < bl - 1; i++, c = cnext)
        k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);

    k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}

But the error is reported, the error information is as follows:

demo/test1.c: In function ‘make_kn’:
demo/test1.c:20:5: internal compiler error: Segmentation fault
 int make_kn(unsigned char *k1, const unsigned char *l, int bl)
     ^~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-7/README.Bugs> for instructions.

I tried to print out the cfg(test.dot), and it looks normal.

digraph cfg {
subgraph fun_0x7f260e938a50 {
bb_0x7f260e938a50_0[label="ENTRY: make_kn
demo/test1.c:21"];
bb_0x7f260e938a50_0 -> bb_0x7f260e938a50_9;
bb_0x7f260e938a50_9[label="switchVar.1 = 1181241669;
"];
bb_0x7f260e938a50_9 -> bb_0x7f260e938a50_10;
bb_0x7f260e938a50_10[label="GIMPLE_NOP
switch (switchVar.1) <default: <L7> [0.00%], case 262431419: <L9> [0.00%], case 381899955: <L12> [0.00%], case 517503240: <L14> [0.00%], case 1181241669: <L8> [0.00%], case 1186855106: <L10> [0.00%], case 1198866764: <L13> [0.00%], case 1477094765: <L11> [0.00%]>
"];
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_12;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_2;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_3;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_4;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_5;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_6;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_7;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_8;
bb_0x7f260e938a50_12[label="<L7> [0.00%]:
GIMPLE_NOP
"];
bb_0x7f260e938a50_12 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_11[label="GIMPLE_NOP
"];
bb_0x7f260e938a50_11 -> bb_0x7f260e938a50_10;
bb_0x7f260e938a50_2[label="<L8> [0.00%]:
c = *l;
carry = c >> 7;
i = 0;
switchVar.1 = 1186855106;
"];
bb_0x7f260e938a50_2 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_3[label="<L9> [0.00%]:
_1 = (int) c;
_2 = _1 << 1;
_3 = (signed char) _2;
_4 = (sizetype) i;
_5 = _4 + 1;
_6 = l + _5;
cnext = *_6;
_7 = cnext >> 7;
_8 = (signed char) _7;
_9 = _3 | _8;
_10 = (sizetype) i;
_11 = k1 + _10;
_12 = (unsigned char) _9;
*_11 = _12;
i = i + 1;
c = cnext;
switchVar.1 = 1186855106;
"];
bb_0x7f260e938a50_3 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_4[label="<L10> [0.00%]:
_13 = bl + -1;
switchVar.1 = i < _13 ? 262431419 : 1477094765;
"];
bb_0x7f260e938a50_4 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_5[label="<L11> [0.00%]:
_14 = (int) c;
_15 = _14 << 1;
_16 = (signed char) _15;
_17 = -carry;
_18 = (signed char) _17;
switchVar.1 = bl == 16 ? 381899955 : 1198866764;
"];
bb_0x7f260e938a50_5 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_6[label="<L12> [0.00%]:
iftmp.0 = -121;
switchVar.1 = 517503240;
"];
bb_0x7f260e938a50_6 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_7[label="<L13> [0.00%]:
iftmp.0 = 27;
switchVar.1 = 517503240;
"];
bb_0x7f260e938a50_7 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_8[label="<L14> [0.00%]:
_19 = iftmp.0 & _18;
_20 = _16 ^ _19;
_21 = (sizetype) i;
_22 = k1 + _21;
_23 = (unsigned char) _20;
*_22 = _23;
D.2716 = 0;
return D.2716;
"];
bb_0x7f260e938a50_8 -> bb_0x7f260e938a50_1;
bb_0x7f260e938a50_1[label="EXIT: make_kn
demo/test1.c:32"];
}
}

dot -Tpng test.dot > test.png
Do you have any ideas?

Add Android example

Produce an Android NDK "crackme" or the like using the obfuscation.

Addition and subtraction substitution

Bitwise operators are supported for now, also support addition and subtraction for INTEGERS ONLY.

Crash under `gccgo` example

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff754a71d in single_succ_edge (bb=0x7ffff76246e8)
    at /usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/plugin/include/basic-block.h:341
341	 return EDGE_SUCC (bb, 0);
(gdb) bt
#0  0x00007ffff754a71d in single_succ_edge (bb=0x7ffff76246e8)
    at /usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/plugin/include/basic-block.h:341
#1  0x00007ffff754b072 in FLAPass::execute (this=0x23ae370, f=0x7ffff75e60b0)
    at /code/hellscape/FLA.cpp:149

Junk for BCF

Currently the BCF "junk" is a GIMPLE NOP which is pretty ineffective at deterring reversing by itself (since it is clear which block is the opaque path)

FLA error: definition in block 6 does not dominate use in block 9

$ cat bug.c
#include <stdio.h>
#include <stdint.h>

static void AddMatch(size_t distance, size_t len) {
}

int target(size_t min_length)
{
  AddMatch((min_length ? 68 : 4), min_length + 1);
  return 0;
}
$ /usr/local/bin/gcc -fPIC -fplugin=hellscape/build/hellscape.so -fplugin-arg-hellscape-seed=deadbeef -fplugin-arg-hellscape-fla bug.c -c -o test
bug.c: In function ‘target’:
bug.c:11:1: error: definition in block 6 does not dominate use in block 9
   11 | }
      | ^
for SSA_NAME: _1 in statement:
# .MEM_14 = VDEF <.MEM_8>
AddMatch (iftmp.0_2, _1);
*** WARNING *** there are active plugins, do not report this as a bug unless you can reproduce it without enabling any plugins.
Event                            | Plugins
PLUGIN_FINISH                    | hellscape
during GIMPLE pass: ssa
bug.c:11:1: internal compiler error: verify_ssa failed
0x120b8e2 verify_ssa(bool, bool)
        ../../gcc/tree-ssa.c:1208
0xf06565 execute_function_todo
        ../../gcc/passes.c:1992
0xf072ac do_per_function
        ../../gcc/passes.c:1640
0xf072ac execute_todo
        ../../gcc/passes.c:2039
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$ /usr/local/bin/gcc --version
gcc (GCC) 10.1.0
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ /usr/local/bin/gcc -v
Using built-in specs.
COLLECT_GCC=/usr/local/bin/gcc
COLLECT_LTO_WRAPPER=/usr/local/libexec/gcc/x86_64-pc-linux-gnu/10.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --enable-checking=yes,rtl,tree
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 10.1.0 (GCC)

How to fix this error?

Add function selectors (attribute and by name)

Rather than applying to a percentage of the binary or the entire binary, obfuscate selectively (or force the obfuscation of a specific function)

Feature Request: Add support for MinGW

It would be nice to be able to use this plugin in MinGW

Add function selectors

Hi，I found a way to select functions by attributes.
New files: Utils.h and Utils.cpp
Utils.h

#pragma once

#include <gcc-plugin.h>
#include <basic-block.h>
#include <tree.h>
#include <function.h>
#include <iostream>

bool toObfuscate(bool flag, function *f, std::string attribute);

Utils.cpp

#include "Utils.h"
#include <stringpool.h>
#include <attribs.h>

using namespace std;

bool toObfuscate(bool flag, function *f, string attribute)
{
    /* skip declaration*/
    //return false;

    /*skip external linkage*/
    //return false;

    /*skip some functions that cannot currently be handled */
    //return false;

    /*check attribute*/
    std::string attr = attribute;
    std::string attrNo = "no" + attr;

    tree attri = DECL_ATTRIBUTES(f->decl);
    if(attri)
    {
        tree q = lookup_attribute("obfus", attri);
        if(q)
        {
            tree qq = q;
            while(qq)
            {
                std::string name = TREE_STRING_POINTER (TREE_VALUE(TREE_VALUE(qq)));
                if(!name.empty())
                {
                    if(name.find(attrNo) != string::npos)
                    {
                        std::cerr << "in " << function_name(f) <<" find " << name << "\n";
                        return false;
                    }

                    if(name.find(attr) != string::npos)
                    {
                        std::cerr << "in " << function_name(f) <<" find " << name << "\n";
                        return true;
                    }
                    
                }
                qq = TREE_CHAIN (qq);
            }
        }
    }
    if (flag == true) {
        return true;
    } 
    return false;
}

Then modify the PluginManager.cpp:

static tree
handle_obfus_attribute (tree *node, tree name, tree args, int flags, bool *no_add_attrs)
{
    return NULL_TREE;
}

/* Attribute definition */

static struct attribute_spec fla_attr =
{ "obfus", 1, 1, false,  false, false, false, handle_obfus_attribute, NULL};


/* Plugin callback called during attribute registration */

static void 
register_attributes (void *event_data, void *data) 
{
    register_attribute (&fla_attr);
}

finally, write one demo:

__attribute__((obfus("nofla"))) char* hello( char *list, const char *oid, size_t len )
{
    while( list != NULL )
    {
        if(memcmp( list, oid, len ) == 0 )
        {
            break;
        }

        list = (char *)TEST_P;
    }

    return( list );
}

__attribute__((obfus("nobcf"))) __attribute__((obfus("fla"))) void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
    int i;
    unsigned char c = l[0], carry = c >> 7, cnext;
    for (i = 0; i < bl - 1; i++, c = cnext)
        k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);

    k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}

the log:

in hello find nofla
in make_kn find nobcf
in make_kn find fla

meme / hellscape Goto Github PK

hellscape's People

Contributors

Stargazers

Watchers

Forkers

hellscape's Issues

Recommend Projects

Recommend Topics

Recommend Org