meme / hellscape Goto Github PK
View Code? Open in Web Editor NEWGIMPLE obfuscator for C, C++, Go, ... all supported GCC targets and front-ends that use GIMPLE.
License: GNU General Public License v3.0
GIMPLE obfuscator for C, C++, Go, ... all supported GCC targets and front-ends that use GIMPLE.
License: GNU General Public License v3.0
Hi,I found a way to select functions by attributes.
New files: Utils.h and Utils.cpp
Utils.h
#pragma once
#include <gcc-plugin.h>
#include <basic-block.h>
#include <tree.h>
#include <function.h>
#include <iostream>
bool toObfuscate(bool flag, function *f, std::string attribute);
Utils.cpp
#include "Utils.h"
#include <stringpool.h>
#include <attribs.h>
using namespace std;
bool toObfuscate(bool flag, function *f, string attribute)
{
/* skip declaration*/
//return false;
/*skip external linkage*/
//return false;
/*skip some functions that cannot currently be handled */
//return false;
/*check attribute*/
std::string attr = attribute;
std::string attrNo = "no" + attr;
tree attri = DECL_ATTRIBUTES(f->decl);
if(attri)
{
tree q = lookup_attribute("obfus", attri);
if(q)
{
tree qq = q;
while(qq)
{
std::string name = TREE_STRING_POINTER (TREE_VALUE(TREE_VALUE(qq)));
if(!name.empty())
{
if(name.find(attrNo) != string::npos)
{
std::cerr << "in " << function_name(f) <<" find " << name << "\n";
return false;
}
if(name.find(attr) != string::npos)
{
std::cerr << "in " << function_name(f) <<" find " << name << "\n";
return true;
}
}
qq = TREE_CHAIN (qq);
}
}
}
if (flag == true) {
return true;
}
return false;
}
Then modify the PluginManager.cpp:
static tree
handle_obfus_attribute (tree *node, tree name, tree args, int flags, bool *no_add_attrs)
{
return NULL_TREE;
}
/* Attribute definition */
static struct attribute_spec fla_attr =
{ "obfus", 1, 1, false, false, false, false, handle_obfus_attribute, NULL};
/* Plugin callback called during attribute registration */
static void
register_attributes (void *event_data, void *data)
{
register_attribute (&fla_attr);
}
register it:
register_callback (info->base_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
finally, write one demo:
__attribute__((obfus("nofla"))) char* hello( char *list, const char *oid, size_t len )
{
while( list != NULL )
{
if(memcmp( list, oid, len ) == 0 )
{
break;
}
list = (char *)TEST_P;
}
return( list );
}
__attribute__((obfus("nobcf"))) __attribute__((obfus("fla"))) void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
int i;
unsigned char c = l[0], carry = c >> 7, cnext;
for (i = 0; i < bl - 1; i++, c = cnext)
k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);
k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}
the log:
in hello find nofla
in make_kn find nobcf
in make_kn find fla
Produce an Android NDK "crackme" or the like using the obfuscation.
Rather than applying to a percentage of the binary or the entire binary, obfuscate selectively (or force the obfuscation of a specific function)
-perFLA=X
-perSUB=X
-perBCF=X
Show how to obfuscate a gccgo
-compiled program.
@meme thanks for sharing hellscape. It is very illustrative to have running code in parallel to the plugin documentation.
I was able to compile and run hellscape with Ubuntu's GCC 10.0.1. Now that I have it running I'd like to set some breakpoints to explore things.
I saw that this note in the readme:
Additionally: If you experience crashes when developing your plug-in, you can debug them by passing -wrapper gdb,--args to gcc. (Run gcc in gdb, effectively.)
However, it is not very clear to me how to do it. I get this gdb error:
$ gcc -wrapper gdb foo.c
gdb: unrecognized option '-imultiarch'
Use `gdb --help' for a complete list of options.
I also tried setting a breakpoint as follows but does not stop in the dummy NXPass that I just created.
$ gdb gcc
...
Reading symbols from gcc...
(No debugging symbols found in gcc)
(gdb) b Quit
(gdb) b NXPass::execute
Function "NXPass::execute" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (NXPass::execute) pending.
(gdb) r -fplugin=./hellscape.so -fplugin-arg-hellscape-nx foo.c -fdump-tree-all-graph
Starting program: /usr/bin/gcc -fplugin=./hellscape.so -fplugin-arg-hellscape-nx foo.c -fdump-tree-all-graph
[Detaching after vfork from child process 8598]
[Detaching after vfork from child process 8599]
[Detaching after vfork from child process 8600]
[Inferior 1 (process 8594) exited normally]
(gdb)
When executed directly the NX pass generates an output so it is working.
Can you please share how you debug hellscape?
Bitwise operators are supported for now, also support addition and subtraction for INTEGERS ONLY.
Currently the BCF "junk" is a GIMPLE NOP which is pretty ineffective at deterring reversing by itself (since it is clear which block is the opaque path)
$ cat bug.c
#include <stdio.h>
#include <stdint.h>
static void AddMatch(size_t distance, size_t len) {
}
int target(size_t min_length)
{
AddMatch((min_length ? 68 : 4), min_length + 1);
return 0;
}
$ /usr/local/bin/gcc -fPIC -fplugin=hellscape/build/hellscape.so -fplugin-arg-hellscape-seed=deadbeef -fplugin-arg-hellscape-fla bug.c -c -o test
bug.c: In function ‘target’:
bug.c:11:1: error: definition in block 6 does not dominate use in block 9
11 | }
| ^
for SSA_NAME: _1 in statement:
# .MEM_14 = VDEF <.MEM_8>
AddMatch (iftmp.0_2, _1);
*** WARNING *** there are active plugins, do not report this as a bug unless you can reproduce it without enabling any plugins.
Event | Plugins
PLUGIN_FINISH | hellscape
during GIMPLE pass: ssa
bug.c:11:1: internal compiler error: verify_ssa failed
0x120b8e2 verify_ssa(bool, bool)
../../gcc/tree-ssa.c:1208
0xf06565 execute_function_todo
../../gcc/passes.c:1992
0xf072ac do_per_function
../../gcc/passes.c:1640
0xf072ac execute_todo
../../gcc/passes.c:2039
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$ /usr/local/bin/gcc --version
gcc (GCC) 10.1.0
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
$ /usr/local/bin/gcc -v
Using built-in specs.
COLLECT_GCC=/usr/local/bin/gcc
COLLECT_LTO_WRAPPER=/usr/local/libexec/gcc/x86_64-pc-linux-gnu/10.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --enable-checking=yes,rtl,tree
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 10.1.0 (GCC)
How to fix this error?
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff754a71d in single_succ_edge (bb=0x7ffff76246e8)
at /usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/plugin/include/basic-block.h:341
341 return EDGE_SUCC (bb, 0);
(gdb) bt
#0 0x00007ffff754a71d in single_succ_edge (bb=0x7ffff76246e8)
at /usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/plugin/include/basic-block.h:341
#1 0x00007ffff754b072 in FLAPass::execute (this=0x23ae370, f=0x7ffff75e60b0)
at /code/hellscape/FLA.cpp:149
Hello, I try to fla process the following function,
void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
int i;
unsigned char c = l[0], carry = c >> 7, cnext;
for (i = 0; i < bl - 1; i++, c = cnext)
k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);
k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}
But the error is reported, the error information is as follows:
demo/test1.c: In function ‘make_kn’:
demo/test1.c:20:5: internal compiler error: Segmentation fault
int make_kn(unsigned char *k1, const unsigned char *l, int bl)
^~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-7/README.Bugs> for instructions.
I tried to print out the cfg(test.dot), and it looks normal.
digraph cfg {
subgraph fun_0x7f260e938a50 {
bb_0x7f260e938a50_0[label="ENTRY: make_kn
demo/test1.c:21"];
bb_0x7f260e938a50_0 -> bb_0x7f260e938a50_9;
bb_0x7f260e938a50_9[label="switchVar.1 = 1181241669;
"];
bb_0x7f260e938a50_9 -> bb_0x7f260e938a50_10;
bb_0x7f260e938a50_10[label="GIMPLE_NOP
switch (switchVar.1) <default: <L7> [0.00%], case 262431419: <L9> [0.00%], case 381899955: <L12> [0.00%], case 517503240: <L14> [0.00%], case 1181241669: <L8> [0.00%], case 1186855106: <L10> [0.00%], case 1198866764: <L13> [0.00%], case 1477094765: <L11> [0.00%]>
"];
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_12;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_2;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_3;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_4;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_5;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_6;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_7;
bb_0x7f260e938a50_10 -> bb_0x7f260e938a50_8;
bb_0x7f260e938a50_12[label="<L7> [0.00%]:
GIMPLE_NOP
"];
bb_0x7f260e938a50_12 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_11[label="GIMPLE_NOP
"];
bb_0x7f260e938a50_11 -> bb_0x7f260e938a50_10;
bb_0x7f260e938a50_2[label="<L8> [0.00%]:
c = *l;
carry = c >> 7;
i = 0;
switchVar.1 = 1186855106;
"];
bb_0x7f260e938a50_2 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_3[label="<L9> [0.00%]:
_1 = (int) c;
_2 = _1 << 1;
_3 = (signed char) _2;
_4 = (sizetype) i;
_5 = _4 + 1;
_6 = l + _5;
cnext = *_6;
_7 = cnext >> 7;
_8 = (signed char) _7;
_9 = _3 | _8;
_10 = (sizetype) i;
_11 = k1 + _10;
_12 = (unsigned char) _9;
*_11 = _12;
i = i + 1;
c = cnext;
switchVar.1 = 1186855106;
"];
bb_0x7f260e938a50_3 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_4[label="<L10> [0.00%]:
_13 = bl + -1;
switchVar.1 = i < _13 ? 262431419 : 1477094765;
"];
bb_0x7f260e938a50_4 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_5[label="<L11> [0.00%]:
_14 = (int) c;
_15 = _14 << 1;
_16 = (signed char) _15;
_17 = -carry;
_18 = (signed char) _17;
switchVar.1 = bl == 16 ? 381899955 : 1198866764;
"];
bb_0x7f260e938a50_5 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_6[label="<L12> [0.00%]:
iftmp.0 = -121;
switchVar.1 = 517503240;
"];
bb_0x7f260e938a50_6 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_7[label="<L13> [0.00%]:
iftmp.0 = 27;
switchVar.1 = 517503240;
"];
bb_0x7f260e938a50_7 -> bb_0x7f260e938a50_11;
bb_0x7f260e938a50_8[label="<L14> [0.00%]:
_19 = iftmp.0 & _18;
_20 = _16 ^ _19;
_21 = (sizetype) i;
_22 = k1 + _21;
_23 = (unsigned char) _20;
*_22 = _23;
D.2716 = 0;
return D.2716;
"];
bb_0x7f260e938a50_8 -> bb_0x7f260e938a50_1;
bb_0x7f260e938a50_1[label="EXIT: make_kn
demo/test1.c:32"];
}
}
dot -Tpng test.dot > test.png
Do you have any ideas?
It would be nice to be able to use this plugin in MinGW
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.