vm.cpp

Ollydbg环境下的一款插件源代码

        break;

    case MC_SHR:
        lVal_dest >>= lVal_src;
        break;

    case MC_CMP:
        m_Cpu.eflags.cf = lVal_dest < lVal_src;
        m_Cpu.eflags.zf = (0 == (lVal_dest - lVal_src));
        goto Exit1;

    default:
        goto Exit0;
    }

    m_Cpu.reg[*rt_dest] = lVal_dest;

Exit1:
    nRetCode = SetODReg(rt_dest, lVal_dest);
    OM_PROCESS_ERROR(nRetCode);
    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::SetODReg(
    /* [in] */  const REGISTERTYPE *rt_dest,
    /* [in] */  const long lVal_dest
)
{
    ASSERT(rt_dest);

    int nRetResult = 0;

    t_thread* pt = Findthread(Getcputhreadid());
    OM_PROCESS_ERROR(pt);

    switch (*rt_dest)
    {
    case OD_REG_EAX:
        pt->reg.r[0] = lVal_dest;
        break;
    case OD_REG_ECX:
        pt->reg.r[1] = lVal_dest;
        break;
    case OD_REG_EDX:
        pt->reg.r[2] = lVal_dest;
        break;
    case OD_REG_EBX:
        pt->reg.r[3] = lVal_dest;
        break;
    case OD_REG_ESP:
        pt->reg.r[4] = lVal_dest;
        break;
    case OD_REG_EBP:
        pt->reg.r[5] = lVal_dest;
        break;
    case OD_REG_ESI:
        pt->reg.r[6] = lVal_dest;
        break;
    case OD_REG_EDI:
        pt->reg.r[7] = lVal_dest;
        break;
    case OD_REG_EIP:
        pt->reg.ip = lVal_dest;
        break;
    case OD_REG_EFLAGS_CF:
        pt->reg.flags &= ~(1 << 0);
        pt->reg.flags |= (!!lVal_dest) << 0;
        break;
    case OD_REG_EFLAGS_PF:
        pt->reg.flags &= ~(1 << 2);
        pt->reg.flags |= (!!lVal_dest) << 2;
        break;
    case OD_REG_EFLAGS_AF:
        pt->reg.flags &= ~(1 << 4);
        pt->reg.flags |= (!!lVal_dest) << 4;
        break;
    case OD_REG_EFLAGS_ZF:
        pt->reg.flags &= ~(1 << 6);
        pt->reg.flags |= (!!lVal_dest) << 6;
        break;
    case OD_REG_EFLAGS_SF:
        pt->reg.flags &= ~(1 << 7);
        pt->reg.flags |= (!!lVal_dest) << 7;
        break;
    case OD_REG_EFLAGS_DF:
        pt->reg.flags &= ~(1 << 10);
        pt->reg.flags |= (!!lVal_dest) << 10;
        break;
    case OD_REG_EFLAGS_OF:
        pt->reg.flags &= ~(1 << 11);
        pt->reg.flags |= (!!lVal_dest) << 11;
        break;
    }

    Broadcast(WM_USER_CHREG, 0, 0);

    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::IRR(
    /* [in] */  const long eip,
    /* [in] */  const MNEMONICTYPE MneType
)
{
    int nRetCode;

    REGISTERTYPE rt_dest;
    REGISTERTYPE rt_src;
    long lVal_dest;
    long lVal_src;

    nRetCode = GetODReg();
    if (0 == nRetCode)
        return 0;

    rt_dest = (REGISTERTYPE)*(long *)&m_Code[eip + 2];
    rt_src = (REGISTERTYPE)*(long *)&m_Code[eip + 6];
    lVal_dest = m_Cpu.reg[rt_dest];
    lVal_src = m_Cpu.reg[rt_src];

    return SetReg(&rt_dest, &rt_src, lVal_dest, lVal_src, MneType);
}

int CVM::IRC(
    /* [in] */  const long eip,
    /* [in] */  const MNEMONICTYPE MneType
)
{
    int nRetCode;

    REGISTERTYPE rt_dest;
    long lVal_dest;
    long lVal_src;

    nRetCode = GetODReg();
    if (0 == nRetCode)
        return 0;

    rt_dest = (REGISTERTYPE)*(long *)&m_Code[eip + 2];
    lVal_src = *(long *)&m_Code[eip + 6];
    lVal_dest = m_Cpu.reg[rt_dest];

    return SetReg(&rt_dest, NULL, lVal_dest, lVal_src, MneType);
}

int CVM::DoArithmetic(
    /* [in] */  const long eip,
    /* [in] */  const MNEMONICTYPE MneType
)
{
    int nRetResult = 0;
    int nRetCode;

    m_Cpu.modrm = *(unsigned char *)&m_Code[eip + 1];

    switch (m_Cpu.modrm)
    {
    case MR_MEM:
        nRetCode = IRC(eip, MneType);
        OM_PROCESS_ERROR(nRetCode);
        break;
    case MR_REG:
        nRetCode = IRR(eip, MneType);
        OM_PROCESS_ERROR(nRetCode);
        break;
    default:
        goto Exit0;
    }

    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoInputText()
{
    int nRetResult = 0;
    int nRetCode;

    long lDataOffset;
    char szTitle[TEXTLEN];
    int nTitleLen;

    nRetCode = Pop(&lDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lDataOffset))
        {
            nTitleLen = strlen((char *)lDataOffset);
            if (nTitleLen >= TEXTLEN)
                goto Exit0;
            strcpy(szTitle, (char *)lDataOffset);
        }
        else
            goto Exit0;
    }
    else
    {
        nTitleLen = strlen(&m_Data[lDataOffset]);
        if (nTitleLen >= TEXTLEN)
            goto Exit0;
        strcpy(szTitle, &m_Data[lDataOffset]);
    }

    nRetCode = Gettext(
        szTitle,
        m_FreeBuffer,
        0,  // init letter
        NM_COMMENT,
        FIXEDFONT
    );
    if (-1 == nRetCode) // user pressed CANCEL
    {
        nRetCode = SetFreeBuffer(0);
        OM_PROCESS_ERROR(nRetCode);
        SetRetVal(0);
    }
    else
    {
        nRetCode = SetFreeBuffer(nRetCode);
        OM_PROCESS_ERROR(nRetCode);
        SetRetVal(1);
    }

    nRetResult = 1;
Exit0:
    if (0 == nRetResult)
        SetRetVal(0);
    return nRetResult;
}

int CVM::DoInputHexLong()
{
    int nRetResult = 0;
    int nRetCode;

    long lDataOffset;
    long lValue;
    char szTitle[TEXTLEN];
    int nTitleLen;

    nRetCode = Pop(&lValue);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lDataOffset))
        {
            nTitleLen = strlen((char *)lDataOffset);
            if (nTitleLen >= TEXTLEN)
                goto Exit0;
            strcpy(szTitle, (char *)lDataOffset);
        }
        else
            goto Exit0;
    }
    else
    {
        nTitleLen = strlen(&m_Data[lDataOffset]);
        if (nTitleLen >= TEXTLEN)
            goto Exit0;
        strcpy(szTitle, &m_Data[lDataOffset]);
    }

    nRetCode = Getlong(
        szTitle,
        (unsigned long *)&lValue,
        4,  // datasize
        0,  // init letter
        DIA_HEXONLY
    );
    if (-1 == nRetCode) // fails or user pressed CANCEL
        goto Exit0;

    m_Cpu.reg[REG_00] = lValue;

    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoPrintNum()
{
    int nRetResult = 0;
    int nRetCode;

    long lRadix;
    long lValue;
    char szValue[100];

    nRetCode = Pop(&lValue);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lRadix);
    OM_PROCESS_ERROR(nRetCode);

    ltoa(lValue, szValue, lRadix);
    ShowMsg(szValue);

    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoPrintBuf()
{
    int nRetResult = 0;
    int nRetCode;

    long lAddr;
    long lLen;
    long i;
    char ch;
    char dump[4];
    CString strBuf;

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lLen);
    OM_PROCESS_ERROR(nRetCode);

    strBuf.Format(
        "Starting Address: 0x%08lX\nLength bytes: 0x%lX\n\n",
        lAddr,
        lLen
    );

    for (i = 0; i < lLen; ++i)
    {
        nRetCode = Readmemory(&ch, lAddr + i, 1, MM_SILENT);
        OM_PROCESS_ERROR(nRetCode);
        sprintf(dump, "%02X ", ch);
        strBuf += dump;
    }

    ShowMsg(strBuf);

    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoMsg()
{
    int nRetResult = 0;
    int nRetCode;

    long lDataOffset;

    nRetCode = Pop(&lDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lDataOffset))
        {
            ShowMsg((char *)lDataOffset);
            goto Exit1;
        }
        goto Exit0;
    }

    ShowMsg(&m_Data[lDataOffset]);

Exit1:
    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoMsgYN()
{
    int nRetResult = 0;
    int nRetCode;

    long lDataOffset;

    nRetCode = Pop(&lDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lDataOffset))
        {
            ShowQuestionMsg((char *)lDataOffset);
            SetRetVal((IDYES == nRetCode));
            goto Exit1;
        }
        goto Exit0;
    }

    nRetCode = ShowQuestionMsg(&m_Data[lDataOffset]);
    SetRetVal((IDYES == nRetCode));

Exit1:
    nRetResult = 1;
Exit0:
    return nRetResult;
}

int CVM::DoReadMemLong()
{
    int nRetResult = 0;
    int nRetCode;

    long lValue = 0;
    long lCount;
    long lAddr;

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lCount);
    OM_PROCESS_ERROR(nRetCode);

    if (lCount < 1)
        lCount = 1;
    if (lCount > 4)
        lCount = 4;

    nRetCode = Readmemory(&lValue, lAddr, lCount, MM_SILENT);
    OM_PROCESS_ERROR(nRetCode);

    SetRetVal(lValue);

    nRetResult = 1;
Exit0:
    if (0 == nRetResult)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoWriteMemLong()
{
    int nRetResult = 0;
    int nRetCode;

    long lValue;
    long lAddr;
    long lCount;

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lValue);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lCount);
    OM_PROCESS_ERROR(nRetCode);

    if (lCount < 1)
        lCount = 1;
    if (lCount > 4)
        lCount = 4;

    nRetCode = Writememory(&lValue, lAddr, lCount, MM_DELANAL | MM_SILENT);
    OM_PROCESS_ERROR(nRetCode);

    nRetResult = 1;
Exit0:
    SetRetVal(nRetResult);
    return nRetResult;
}

int CVM::DoWriteMemHexes()
{
    int nRetResult = 0;
    int nRetCode;

    long lAddr;
    long lHexOffset;
    int nHexLen;
    int i;
    char *szHex = NULL;
    char szTemp[3];
    long lHex;

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lHexOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lHexOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lHexOffset))
        {
            nHexLen = strlen((char *)lHexOffset);
            if (nHexLen % 2)
                goto Exit0;
            szHex = (char *)malloc(nHexLen);
            OM_PROCESS_ERROR(szHex);
            memcpy(szHex, (char *)lHexOffset, nHexLen);
        }
        else
            goto Exit0;
    }
    else
    {
        nHexLen = strlen(&m_Data[lHexOffset]);
        if (nHexLen % 2)
            goto Exit0;
        szHex = (char *)malloc(nHexLen);
        OM_PROCESS_ERROR(szHex);
        memcpy(szHex, &m_Data[lHexOffset], nHexLen);
    }

    szTemp[2] = '\0';
    for (i = 0; i < nHexLen; i += 2)
    {
        szTemp[0] = szHex[i];
        szTemp[1] = szHex[i + 1];
        lHex = strtol(szTemp, NULL, 16);
        nRetCode = Writememory(&lHex, lAddr + i / 2, 1, MM_DELANAL | MM_SILENT);
        OM_PROCESS_ERROR(nRetCode);
    }

    nRetResult = 1;
Exit0:
    if (szHex)
    {
        free(szHex);
        szHex = NULL;
    }
    SetRetVal(nRetResult);
    return nRetResult;
}

int CVM::DoFill()
{
    int nRetResult = 0;
    int nRetCode;

    long lValue;
    long lLen;
    long lAddr;
    long i;

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lLen);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lValue);
    OM_PROCESS_ERROR(nRetCode);

    // get byte
    lValue = lValue & 0xFF;

    for (i = 0; i < lLen; ++i)
    {
        nRetCode = Writememory(&lValue, lAddr + i, 1, MM_DELANAL | MM_SILENT);
        OM_PROCESS_ERROR(nRetCode);
    }

    nRetResult = 1;
Exit0:
    SetRetVal(nRetResult);
    return nRetResult;
}

inline int CVM::GetOpcodeSize(
    /* [in] */  const long lOpcode
)
{
    int nRetCode;

    nRetCode = lOpcode & 0x00ff0000;
    if (nRetCode)
        return 3;
    nRetCode = lOpcode & 0x00ffff00;
    if (nRetCode)
        return 2;
    nRetCode = lOpcode & 0x00ffffff;
    if (nRetCode)
        return 1;

    return 0;
}

inline int CVM::GetLongSize(
    /* [in] */  const long lValue
)
{
    int nRetCode;

    nRetCode = lValue & 0xff000000;
    if (nRetCode)
        return 4;
    nRetCode = lValue & 0x00ff0000;
    if (nRetCode)
        return 3;
    nRetCode = lValue & 0x00ffff00;