C/C++ BeaEngine 反匯編引擎

反匯編引擎有很多，這個引擎沒有Dll，是純靜態鏈接庫，適合r3-r0環境，你可以將其編譯為DLL文件，驅動強制注入到游戲進程中，讓其快速反匯編，讀取出反匯編代碼並保存為txt文本，本地分析。

地址：https://github.com/BeaEngine/beaengine

BeaEngine 反匯編特定字符串

#include <stdio.h>
#include <Windows.h>
#define BEA_ENGINE_STATIC  // 指明使用靜態Lib庫
#define BEA_USE_STDCALL    // 指明使用stdcall調用約定

extern "C"
{
	#include "G:/beaengine/x64/BeaEngine.h"
	#pragma comment(lib, "G:/BeaEngine/x64/lib_static/BeaEngine.lib")
}

void DisassembleCode(char *start_offset, int size)
{
	DISASM Disasm_Info;
	int len;
	char *end_offset = (char*)start_offset + size;
	(void)memset(&Disasm_Info, 0, sizeof(DISASM));
	Disasm_Info.EIP = (UInt64)start_offset;
	Disasm_Info.Archi = 1;
	Disasm_Info.Options = MasmSyntax;
	while (!Disasm_Info.Error)
	{
		Disasm_Info.SecurityBlock = (UInt64)end_offset - Disasm_Info.EIP;
		if (Disasm_Info.SecurityBlock <= 0)
			break;
		len = Disasm(&Disasm_Info);
		switch (Disasm_Info.Error)
		{
		case OUT_OF_BLOCK:
			break;
		case UNKNOWN_OPCODE:
			printf("%s \n", &Disasm_Info.CompleteInstr);
			Disasm_Info.EIP += 1;
			Disasm_Info.Error = 0;
			break;
		default:
			printf("%s \n", &Disasm_Info.CompleteInstr);
			Disasm_Info.EIP += len;
		}
	}
}

int main(int argc,char *argv)
{
	char *buffer = "\x55\x8b\xec\x81\xec\x24\x03\x00\x00\x6a\x17";
	DisassembleCode(buffer, 11);
	
	BYTE bTest[] = { 0x68, 0x37, 0x31, 0x40, 0x00, 0xFF, 0x15, 0x0C, 0x20, 0x40 };
	DisassembleCode(buffer, 14);

	system("pause");
	return 0;
}

反匯編字節數組

// 反匯編字節數組
void DisassembleCodeByte(BYTE *ptr,int len)
{
	
	DISASM Disasm_Info;
	char *end_offset = (char*)ptr + 10;
	(void)memset(&Disasm_Info, 0, sizeof(DISASM));
	Disasm_Info.EIP = (UInt64)ptr;
	Disasm_Info.Archi = 1;                      // 1 = 表示反匯編32位 / 0 = 表示反匯編64位
	Disasm_Info.Options = MasmSyntax;           // 指定語法格式 MASM

	while (!Disasm_Info.Error)
	{
		Disasm_Info.SecurityBlock = (UInt64)end_offset - Disasm_Info.EIP;
		if (Disasm_Info.SecurityBlock <= 0)
			break;
		len = Disasm(&Disasm_Info);
		switch (Disasm_Info.Error)
		{
		case OUT_OF_BLOCK:
			break;
		case UNKNOWN_OPCODE:
			Disasm_Info.EIP += 1;
			Disasm_Info.Error = 0;
			break;
		default:
			printf("%s \n", &Disasm_Info.CompleteInstr);
			Disasm_Info.EIP += len;
		}
	}
}


int main(int argc, char *argv)
{
	BYTE bTest[] = { 0x55, 0x8b, 0xec, 0x81, 0xec, 0x24, 0x03, 0x00, 0x00, 0x6a, 0x17 };
	DisassembleCodeByte(bTest,10);
	system("pause");
	return 0;
}

反匯編時，顯示虛擬地址

void DisassembleCodeInstr(char *start_offset, char *end_offset, int virtual_address)
{
	DISASM Disasm_Info;
	int len;
	(void)memset(&Disasm_Info, 0, sizeof(DISASM));
	Disasm_Info.EIP = (UINT64)start_offset;
	Disasm_Info.VirtualAddr = (UINT64)virtual_address;
	Disasm_Info.Archi = 0;
	Disasm_Info.Options = MasmSyntax;

	while (!Disasm_Info.Error)
	{
		Disasm_Info.SecurityBlock = (UInt64)end_offset - Disasm_Info.EIP;
		if (Disasm_Info.SecurityBlock <= 0)
			break;
		len = Disasm(&Disasm_Info);
		switch (Disasm_Info.Error)
		{
		case OUT_OF_BLOCK:
			break;
		case UNKNOWN_OPCODE:
			Disasm_Info.EIP += 1;
			Disasm_Info.VirtualAddr += 1;
			break;
		default:
			printf("%.16llx > %s\n", Disasm_Info.VirtualAddr,&Disasm_Info.CompleteInstr);
			Disasm_Info.EIP += len;
			Disasm_Info.VirtualAddr += len;
		}
	}
}

int main(int argc,char *argv)
{
	
	/*
	char *buffer = "\x55\x8b\xec\x81\xec\x24\x03\x00\x00\x6a\x17";
	DisassembleCode(buffer, 11);
	*/
	void *pBuffer = malloc(200);
	memcpy(pBuffer, main, 200);
	DisassembleCodeInstr((char *)pBuffer, (char *)pBuffer + 200, 0x401000);
	system("pause");
	return 0;
}

檢查EAX寄存器狀態： 如何只檢索修改寄存器eax的指令，也就是說，當我們的寄存器REG0零號，發生寫入請求時，將自動獲取到此處的匯編代碼位置。

void DisassembleCodeInstr(char *start_offset, char *end_offset, int virtual_address)
{
	DISASM Disasm_Info;
	int len;
	(void)memset(&Disasm_Info, 0, sizeof(DISASM));
	Disasm_Info.EIP = (UINT64)start_offset;
	Disasm_Info.VirtualAddr = (UINT64)virtual_address;
	Disasm_Info.Archi = 0;
	Disasm_Info.Options = MasmSyntax;

	while (!Disasm_Info.Error)
	{
		Disasm_Info.SecurityBlock = (UInt64)end_offset - Disasm_Info.EIP;
		if (Disasm_Info.SecurityBlock <= 0)
			break;
		len = Disasm(&Disasm_Info);
		switch (Disasm_Info.Error)
		{
		case OUT_OF_BLOCK:
			break;
		case UNKNOWN_OPCODE:
			Disasm_Info.EIP += 1;
			Disasm_Info.VirtualAddr += 1;
			break;
		default:
			if (
				((Disasm_Info.Operand1.AccessMode == WRITE) && (Disasm_Info.Operand1.Registers.gpr & REG0)) ||
				((Disasm_Info.Operand2.AccessMode == WRITE) && (Disasm_Info.Operand2.Registers.gpr & REG0)) ||
				(Disasm_Info.Instruction.ImplicitModifiedRegs.gpr & REG0)
				)
			{
				printf("%.16llx > %s \n", Disasm_Info.VirtualAddr, &Disasm_Info.CompleteInstr);
			}
			Disasm_Info.EIP += len;
			Disasm_Info.VirtualAddr += len;
		}
	}
}

解碼第三方可執行文件：

void DisassembleCodeRange(unsigned char *StartCodeSection, unsigned char *EndCodeSection, int(Virtual_Address))
{
	DISASM Disasm_Info;
	int len;
	memset(&Disasm_Info, 0, sizeof(DISASM));
	Disasm_Info.EIP = (UInt64)StartCodeSection;
	Disasm_Info.VirtualAddr = (UInt64)Virtual_Address;
	Disasm_Info.Archi = 0;
	Disasm_Info.Options = MasmSyntax;

	while (!Disasm_Info.Error)
	{
		Disasm_Info.SecurityBlock = (int)EndCodeSection - Disasm_Info.EIP;
		len = Disasm(&Disasm_Info);
		if (Disasm_Info.Error >= 0)
		{
			printf("%.16llx > %s \n", Disasm_Info.VirtualAddr, &Disasm_Info.CompleteInstr);
			Disasm_Info.EIP += len;
			Disasm_Info.VirtualAddr += len;
		}
	}
}

int main(int argc, char *argv)
{
	void *uBuffer;
	FILE *fp  = fopen("c://main.exe", "rb+");
	fseek(fp, 0, SEEK_END);

	DWORD FileSize = ftell(fp);
	rewind(fp);

	uBuffer = malloc(FileSize);
	memset(uBuffer, 0, sizeof(uBuffer));
	fread(uBuffer, 1, FileSize, fp);
	fclose(fp);

	// 反匯編文件偏移為1025-1099處的機器指令.
	DisassembleCodeRange((unsigned char*)uBuffer + 1025, (unsigned char*)uBuffer + 1099, 0x401000);
	system("pause");
	return 0;
}

XEDPARSE 匯編引擎: 將匯編代碼匯編為機器碼，keystone 匯編引擎也可，https://www.keystone-engine.org/download

#include <stdio.h>
#include <Windows.h>
#define BEA_ENGINE_STATIC  // 指明使用靜態Lib庫
#define BEA_USE_STDCALL    // 指明使用stdcall調用約定

extern "C"
{
	#include "G:/XEDParse/XEDParse.h"
	#pragma comment(lib, "G:/XEDParse/XEDParse_x86.lib")
}
void printOpcode(const unsigned char* pOpcode, int nSize)
{
	for (int i = 0; i < nSize; ++i)
	{
		printf("%02X ", pOpcode[i]);
	}
}

int main(int argc, char *argv)
{
	XEDPARSE xed = { 0 };

	xed.x64 = TRUE;
	scanf_s("%llx", &xed.cip);

	// 獲取匯編字符串
	gets_s(xed.instr, XEDPARSE_MAXBUFSIZE);
	if (XEDPARSE_OK != XEDParseAssemble(&xed))
	{
		printf("指令錯誤: %s\n", xed.error);
	}

	// 輸出匯編機器碼
	printf("%s : ", xed.instr);
	printOpcode(xed.dest, xed.dest_size);
	system("pause");
	return 0;
}

一次匯編多條指令

#include <stdio.h>
#include <Windows.h>
#define BEA_ENGINE_STATIC  // 指明使用靜態Lib庫
#define BEA_USE_STDCALL    // 指明使用stdcall調用約定

extern "C"
{
#include "G:/XEDParse/XEDParse.h"
#pragma comment(lib, "G:/XEDParse/XEDParse_x86.lib")
}
void printOpcode(const unsigned char* pOpcode, int nSize)
{
	for (int i = 0; i < nSize; ++i)
	{
		printf("%02X ", pOpcode[i]);
	}
	printf("\n");
}

int main(int argc, char *argv)
{
	XEDPARSE xed = { 0 };

	xed.x64 = FALSE;
	char *abc[] = {
		"xor eax,eax",
		"xor ebx,ebx",
		"push eax",
		"push ebx",
		"mov ecx,3"
	};

	for (int x = 0; x < 5; x++)
	{
		strcpy(xed.instr, abc[x]);
		if (XEDPARSE_OK != XEDParseAssemble(&xed))
		{
			printf("指令錯誤: %s\n", xed.error);
		}

		// 輸出匯編機器碼
		printf("%s : ", xed.instr);
		printOpcode(xed.dest, xed.dest_size);
	}

	system("pause");
	return 0;
}

匯編引擎實現轉ShellCode：

#include <stdio.h>
#include <Windows.h>

extern "C"
{
#include "G:/XEDParse/XEDParse.h"
#pragma comment(lib, "G:/XEDParse/XEDParse_x86.lib")
}

int main(int argc, char *argv)
{

	XEDPARSE xed = { 0 };
	xed.x64 = FALSE;
	

	unsigned char *p;
	p = (unsigned char *)malloc(256);

	char *OpCode[15] = {
		"push ebp",
		"push ebp",
		"xor eax,eax",
		"mov eax,1",
		"endp"
	};

	for (int x = 0; x < sizeof(OpCode) / sizeof(OpCode[0]); x++)
	{
		if (strcmp(OpCode[x], "endp") == 0)
			break;

		strcpy(xed.instr, OpCode[x]);
		if (XEDPARSE_OK != XEDParseAssemble(&xed))
			break;

		// 將匯編機器碼生成為ShellCode
		for (int y = 0; y < xed.dest_size; y++)
		{
			p[y] = xed.dest[y];
		}	
	}

	system("pause");
	return 0;
}