Matches for instructions that fetch memory from the virtual stack. Constraints: dst: the destination register. size: the size of the destination

Matches for a PUSH %reg instruction. Constraints: %reg: the register pushed.

Determines whether or not the register's bases are equal. e.g. RAX == AH, as base( RAX ) == AL, and base( AH ) == AL.

Match via instruction id. Optionally returns a non-owning pointer to the instruction.

Templates for double register-operand instructions.

Aligns a given uint64_t to the given modulus.

Matches for instructions that fetch memory from the vip stream. Constraints: reg: the register the memory is stored in. size: the size of the mem

Matches for instructions that stores memory into the virtual stack. Constraints: src: the source register. Comparison via base. size: the size of

Computes the next handler from the bridge, updating the context in respect. Returns the next handler's rva.

Compute the output for a given input, by applying each operation on said input.

Templates for single register-operand instructions.

Generates an arithmetic expression for the given register, advancing the stream to wherever the encryption sequence ends.

Disassembles at the effective address, negotating jumps according to the flags.

Gets the register's largest architecture equivalent.

Initializes the analysis context's arithmetic expression, and starts recording the given register's arithmetic operations. Then invokes the provided f

Matches an instruction that loads the "flow" (ie. the rip of the current instruction) into a register. Constraints: reg: the register the flow is w

Matches for an instruction that adds an immediate value to the VSP register. Constraints: imm: the immediate value added.

Get the stream base

Matches for a mov / movzx of memory at a register into another register. Constraints: dst: the destination register. src: the memory source regi

Getter to the handle.

Useful utilities.

Fetches the appropriate arithmetic operation descriptor for the given instruction, or nullptr otherwise.

Disassembler bases instructions via RVA, thus base == rva.

Matches for instructions that stores memory into the virtual context, optionally offsetted by a register. Constraints: src: the source register. Co

Converts the instruction to human-readable format.

Matches for instructions that either increment or decrement the a given register. via ADD or SUB instructions, using a immedaite value. Constraints: i

Adds a handler to the vm_instace.

Matches an instruction that allocates the VM's stack by subtracting and immediate value from rsp. Constraints: imm: the immediate valued subtracted

Matches for an instruction which begins an encryption/obfuscation sequence, by XORing the given register by the rolling key. Constraints: reg: the

Decodes and updates the context to construct a vm_instruction describing the instruction's details.

Disassembles at the offset from the base, simply disassembling every instruction in order.

Matches for instructions that fetch memory from the virtual context, optionally displaced by a register. Constraints: dst: the destination register

Matches an instruction that fetches the encrypted vip ("stub") from the stack. Constraints: reg: the register the stub is written into. offset: the

Attempts to find a handler, given an rva.

Matches for a generic instruciton with 1 register and 1 immediate operand. Constraints: id: the instruction's id. reg: the first operand's regi

Matches for a generic instruciton with 2 register operands. If argument match_bases is true, reigster comparison is done via bases. Otherwise, it is d

Returns a vector of registers this instruction writes to and reads from. Read is returned in the first part of the pair, Written in the second.

Creates an initial vm_context for this instance, given an entry stub and the image's load delta. The created vm_context is initialized at the first ha

Performs the specified lifting job, returning a raw, unoptimized vtil routine.

Advances the stream, incrementing index and returning the instruction ptr.

Matches for instructions that offset the given register via either a lea or add instruction. Constraints: id: the id of the matched instru

Matches for a push of memory at a register Constraints: src: the memory source register. size: the size of the source.

Still hate c++

Scans the given code section for VM entries. Returns a list of results, of [root rva, lifting_job]

Templates for triple register-operand instructions.

Matches for a mov / movzx of a register into memory at another register. Constraints: dst: the destination register. src: the memory source regi

Adds the specified vm_instance to the cached list, exersizing thread-safe behaviour in doing so.

Construct the analysis_context via an instruction_stream pointer. The pointer must stay valid for the lifetime of the object.

Performs an analysis on the specified vmentry stub rva, returning relevant information.

Construct via backing descriptor and additional operand vector.

Constructor.

Cannot be copied or moved. Only one disassembler can exist per thread.

Matches for an instruction which ends an encryption/obfuscation sequence, by either 1) pushing the rolling key for it to later be XORed, or 2) directl

Construct vm_instruction from its handler and a context.

Construct via instruction and descriptor. If construction failed, returns empty object.

Attempts to construct a vm_instance from the VMEntry instruction stream. If fails, returns empty {}.

Construct a vm_handler from its instruction stream. Updates vm_state if required by the descriptor. If the operation fails, returns empty {}.

Construct a vm_bridge from an initial state and its instruction stream. If the operation fails, returns empty {}.

Matches for a generic instruciton with 1 register operand. If argument match_bases is true, reigster comparison is done via bases. Otherwise, it is do

Matches for a generic instruciton with 3 register operands. If argument match_bases is true, reigster comparison is done via bases. Otherwise, it is d

Copy constructor.

Default constructor / move / copy.

Is the instruction a conditional jump?

Determines whether this instruction is any type of jump.

Lifts a single basic block, given the appropriate information.

Performs the specified lifting job, returning a raw, unoptimized vtil routine. Optionally takes in a previous block to fork. If null, creates a new bl

Constructor.

Attempts to find a vm_instance for the specified rva. If succeeded, returns said instance. Otherwise returns nullptr.

Matches for instructions that offset the vip register via either a lea or add instruction. Constraints: id: the id of the matched instruct

Processes the instruction, updating any properties that the instruction may change.

Resets index to 0

Constructor.

Matches for an explicitly matched mov of another register into the vip register. Constraints: reg: the register that is mov'ed into vip.