1
0

obfuscate.c 807 B

1234567891011121314151617181920212223242526272829303132333435363738
  1. #ifdef _MSC_VER
  2. #pragma warning(disable : 4152) /* casting func ptr to void */
  3. #endif
  4. #include <stdbool.h>
  5. #include <windows.h>
  6. #include "obfuscate.h"
  7. #define LOWER_HALFBYTE(x) ((x) & 0xF)
  8. #define UPPER_HALFBYTE(x) (((x) >> 4) & 0xF)
  9. static void deobfuscate_str(char *str, uint64_t val)
  10. {
  11. uint8_t *dec_val = (uint8_t *)&val;
  12. int i = 0;
  13. while (*str != 0) {
  14. int pos = i / 2;
  15. bool bottom = (i % 2) == 0;
  16. uint8_t *ch = (uint8_t *)str;
  17. uint8_t xor = bottom ? LOWER_HALFBYTE(dec_val[pos]) : UPPER_HALFBYTE(dec_val[pos]);
  18. *ch ^= xor;
  19. if (++i == sizeof(uint64_t) * 2)
  20. i = 0;
  21. str++;
  22. }
  23. }
  24. void *ms_get_obfuscated_func(HMODULE module, const char *str, uint64_t val)
  25. {
  26. char new_name[128];
  27. strcpy(new_name, str);
  28. deobfuscate_str(new_name, val);
  29. return GetProcAddress(module, new_name);
  30. }