Functions — github.com/D7EAD/mkPIVM

CodeHub MCPcopy Create free account

hub / github.com/D7EAD/mkPIVM / functions

Functions458 in github.com/D7EAD/mkPIVM

⨍ Functions 458◇ Types & classes 95

↓ 1 callersFunctionenc_imm_n_obfuscated

hide sensitive immediates so the plaintext value doesn't show up as a contiguous run after the stream cipher decrypts

src/codec.cpp:43

↓ 1 callersFunctionfind_iat_slot

look up an iat slot for module!sym. module match is case-insensitive, trailing ".dll" is tolerated.

src/pe_embed.cpp:199

↓ 1 callersFunctionfmt_b64

src/main.cpp:815

↓ 1 callersFunctionfmt_c

src/main.cpp:769

↓ 1 callersFunctionfmt_hex

src/main.cpp:760

↓ 1 callersFunctionfmt_nasm

src/main.cpp:844

↓ 1 callersFunctionfmt_ps1

src/main.cpp:800

↓ 1 callersFunctionfmt_py

src/main.cpp:785

↓ 1 callersFunctionir_op_name

src/lifter.cpp:405

↓ 1 callersMethodlift

src/lifter.cpp:537

↓ 1 callersMethodlift_program

src/lifter.cpp:261

↓ 1 callersFunctionlooks_like_text

every byte past an optional utf-8 bom is printable ascii or common whitespace

src/main.cpp:128

↓ 1 callersMethodmnemonics

src/lifter.cpp:533

↓ 1 callersMethodmovzx_r32_r16

src/x64_emit.cpp:889

↓ 1 callersFunctionobfuscate_ir_dead_inject

dead-IR injection

src/packager.cpp:105

↓ 1 callersFunctionobfuscate_ir_opaque_predicates

opaque predicates via block splitting

src/packager.cpp:136

↓ 1 callersFunctionpackage_shellcode

src/packager.cpp:236

↓ 1 callersFunctionparse_format

src/main.cpp:749

↓ 1 callersFunctionparse_input_format

src/main.cpp:260

↓ 1 callersFunctionparse_pe

src/pe_embed.cpp:103

↓ 1 callersFunctionparse_ranges

parse a:b,c:d,... into a sorted, non-overlapping range list

src/main.cpp:337

↓ 1 callersFunctionpick_section_name

pick a plausible-looking section name derived from the blob bytes

src/pe_embed.cpp:34

↓ 1 callersMethodpos

include/mkpivm/bytecode.h:15

↓ 1 callersFunctionread_file

src/main.cpp:108

↓ 1 callersFunctionread_file_bytes

src/pe_embed.cpp:67

↓ 1 callersFunctionresolve_branch_targets

fixes up every branch target_va to target_block_id

src/packager.cpp:22

↓ 1 callersFunctionrun_scan

--scan: build the cfg and dump every call-target function that's eligible for --ranges virtualization

src/main.cpp:376

↓ 1 callersFunctionsection_for_rva

returns the section covering rva, or nullptr.

src/pe_embed.cpp:167

↓ 1 callersFunctionseg_to_id

src/lifter.cpp:114

↓ 1 callersMethodset_coro_prelo

include/mkpivm/vm_isa.h:126

↓ 1 callersMethodset_heap_stack

include/mkpivm/vm_isa.h:143

↓ 1 callersMethodset_lifted_ranges

↓ 1 callersMethodset_pack_mode

include/mkpivm/vm_isa.h:118

↓ 1 callersMethodset_range_leak_nvs

include/mkpivm/vm_isa.h:122

↓ 1 callersMethodset_vm_sp_headroom

include/mkpivm/vm_isa.h:151

↓ 1 callersFunctionsetcc_to_cond

src/lifter.cpp:988

↓ 1 callersMethodu32

src/x86_emit.cpp:11

↓ 1 callersFunctionvalidate_displaced

reject displaced insns we can't safely move to a new section

src/pe_embed.cpp:330

↓ 1 callersFunctionzmn_to_cond

src/lifter.cpp:837

MethodCFGBuilder

MethodCFGBuilder

include/mkpivm/cfg.h:34

MethodCodecRegistry

CodecRegistry stuff

src/codec.cpp:4003

MethodIRBuilder

include/mkpivm/ir.h:246

include/mkpivm/ir.h:183

MethodLifterRegistry

src/lifter.cpp:219

include/mkpivm/seed.h:13

MethodVMCodeGen

src/vm_codegen.cpp:14

src/vm_isa.cpp:8

MethodX64Emitter

include/mkpivm/x64_emit.h:48

MethodX86Emitter

include/mkpivm/x86_emit.h:15

Methodadd_fixup

include/mkpivm/x86_emit.h:49

Methodadd_reg_imm32

src/x86_emit.cpp:404

Methodadd_reg_reg

src/x86_emit.cpp:334

Methodand_reg_imm32

src/x86_emit.cpp:422

Methodand_reg_reg

src/x86_emit.cpp:361

include/mkpivm/vm_isa.h:95

Functionarch_ptr_bits

include/mkpivm/arch.h:20

Functionas_span

include/mkpivm/util.h:87

src/x86_emit.cpp:55

src/x64_emit.cpp:47

src/x86_emit.cpp:47

Methodbswap_reg

src/x86_emit.cpp:544

Methodby_opcode

src/codec.cpp:4081

src/x86_emit.cpp:19

include/mkpivm/bytecode.h:31

Methodcall_label

src/x64_emit.cpp:870

Methodcall_label

src/x86_emit.cpp:629

src/x64_emit.cpp:802

src/x86_emit.cpp:568

Methodcall_rel32

src/x86_emit.cpp:578

Methodcall_stack_depth

include/mkpivm/vm_isa.h:180

Methodcmp_reg_imm32

src/x86_emit.cpp:449

Methodcmp_reg_reg

src/x86_emit.cpp:379

Methodcodec_rng

src/vm_isa.cpp:188

Functioncond_name

include/mkpivm/ir.h:76

Methoddata_chunk_for

src/lifter.cpp:394

src/x86_emit.cpp:529

Methoddispatch_style

include/mkpivm/vm_isa.h:108

Methodemit_all_handlers

src/vm_codegen_x86.cpp:764

Methodemit_all_handlers

src/vm_codegen.cpp:841

Methodemit_exit_handler

src/vm_codegen_x86.cpp:786

Methodemit_exit_handler

src/vm_codegen.cpp:865

Methodemit_full

src/vm_codegen_x86.cpp:819

Methodemit_handler

src/codec_x86.cpp:384

Methodemit_handler_table

src/vm_codegen_x86.cpp:762

Methodemit_handler_table

src/vm_codegen.cpp:839

Functionemit_junk

polymorphic NOP filler.

src/codec_x86.cpp:366

Methodemit_modrm_mem

32-bit has no rip-relative addressing. base == rx::none here means an absolute disp32, encoded as mod=00 rm=101.

src/x86_emit.cpp:87

Methodemit_prologue

src/vm_codegen_x86.cpp:21

Methodemit_prologue

src/vm_codegen.cpp:79

Methodemit_range_entry

x86 version of --ranges hybrid mode

src/vm_codegen_x86.cpp:529

Methodemit_range_entry

--ranges hybrid mode entry stub

src/vm_codegen.cpp:668

Methodemit_rel32_fixup

src/x86_emit.cpp:69

low-level encoding primitives. no REX in 32-bit.

include/mkpivm/x86_emit.h:55

src/x86_emit.cpp:81

Methodemit_state_init

src/vm_codegen_x86.cpp:68

Methodemit_state_init

src/vm_codegen.cpp:111

Methodemit_trampoline

src/vm_codegen_x86.cpp:696

Functionencode_bytecode

runs the IR through the codecs and hands back raw plaintext bytecode.

src/packager.cpp:217

Functionencrypt_bytecode

shortcut so callers can encrypt a buffer without dragging in the whole codec stack. real cipher work happens in vm_isa.cpp and codec.cpp.

include/mkpivm/crypto.h:11

← previous next →201–300 of 458, ranked by callers