39 lines
816 B
C
39 lines
816 B
C
|
#define _CRT_SECURE_NO_WARNINGS
|
||
|
|
#pragma warning(disable : 4152) /* casting func ptr to void */
|
||
|
|
#include <stdbool.h>
|
||
|
|
#include <windows.h>
|
||
|
|
#include "obfuscate.h"
|
||
|
|
|
||
|
|
#define LOWER_HALFBYTE(x) ((x) & 0xF)
|
||
|
|
#define UPPER_HALFBYTE(x) (((x) >> 4) & 0xF)
|
||
|
|
|
||
|
|
static void deobfuscate_str(char *str, uint64_t val)
|
||
|
|
{
|
||
|
|
uint8_t *dec_val = (uint8_t*)&val;
|
||
|
|
int i = 0;
|
||
|
|
|
||
|
|
while (*str != 0) {
|
||
|
|
int pos = i / 2;
|
||
|
|
bool bottom = (i % 2) == 0;
|
||
|
|
uint8_t *ch = (uint8_t*)str;
|
||
|
|
uint8_t xor = bottom ?
|
||
|
|
LOWER_HALFBYTE(dec_val[pos]) :
|
||
|
|
UPPER_HALFBYTE(dec_val[pos]);
|
||
|
|
|
||
|
|
*ch ^= xor;
|
||
|
|
|
||
|
|
if (++i == sizeof(uint64_t) * 2)
|
||
|
|
i = 0;
|
||
|
|
|
||
|
|
str++;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
void *get_obfuscated_func(HMODULE module, const char *str, uint64_t val)
|
||
|
|
{
|
||
|
|
char new_name[128];
|
||
|
|
strcpy(new_name, str);
|
||
|
|
deobfuscate_str(new_name, val);
|
||
|
|
return GetProcAddress(module, new_name);
|
||
|
|
}
|