xoshiro256**. fast, good enough, deterministic. all per-seed randomness flows through this.

ALU bin helper: ADD/SUB/AND/OR/XOR shared encoding: opcode | dst slot | width | tag | slot or imm data

accumulates plaintext bytecode. tracks branch fixups

CWD/CDQ/CQO. sign-extend AX/EAX/RAX into DX/EDX/RDX

cipher families. per-seed choice.

real CMOVcc doesn't touch EFLAGS but our AND/OR codecs always do

one codec per IR op family. subclasses define the bytecode shape via encode() and the runtime handler via emit_handler(). everything routes through th

registry of codecs, one per family.

branch conditions, mapped from the x86 cc nibble at lift time.

turn a Zydis register id into XReg + Width. is_high_byte is set when the register is AH/CH/DH/BH.

decode insns from `bytes` until total length >= 5

dispatcher shape

which physical host regs hold the dispatcher's hot state. picked per seed

scalar fields, placed in random order.

tags for X64Emitter rel32 fixups. packager resolves these at layout time.

last flag-setting op. BR_CC uses this plus the cached operands to compute the condition lazily. same idea as QEMU's lazy flags

basic block. straight-line ops up to a terminator.

helper used by lifters

one insn. up to 4 operands in an inline array so we don't heap-alloc per instruction.

op tags. each one names a codec family.

the whole lifted program

operand variants

iat slot for a named import like kernel32!CreateThread

one subclass per mnemonic family. lifters are stateless and emit pure IR. they never touch bytecode state afaik

JCXZ family. short jump if r/e/cx is zero

LEAVE. mov rsp,rbp then pop rbp on x64, same with esp/ebp on x86

tegistry indexes concrete lifters by Zydis mnemonic.

per-codec encoding shape. codec asks VMConfig for one of these so the same codec source emits wildly different bytecode under different seeds.

view into the PE. all offsets are file offsets.

remember the exact push order so the exit handler can pop in reverse. keyed off the emitter pointer to avoid TLS bullshit.

self-locate strategy for the PIC prologue

PUSHAD and POPAD. push or pop all 8 x86 GPRs

same save/restore shape as the inline wrapper but the body is CreateThread, NULL, 0, vm_blob, NULL, 0, NULL through the iat slot

x86 threaded wrapper uses absolute addressing for the indirect iat call

emits the PIC scaffolding around the codec handlers

master config for one VM build. fully derived from the seed

field offsets in the on-stack VMState. order is shuffled per seed so reverse engineers don't get a free structural skeleton. i mean i kinda am holding

one VM register slot. slot count and which XReg maps where is randomized per seed.

operand width. LOAD/STORE size, CMP width, ADD width, etc.

x64 wrapper

small x64 emitter

ALU bin handler

remember the push order so the exit handler pops in reverse. keyed off the emitter pointer since emitters are single-use.

logical x86 reg names the IR uses. physical width is 32 or 64 depending on arch. sub-register stuff gets lowered to width-typed ops.