junk.go

package injector

import (
	"bytes"
	"embed"
	"fmt"
	"io"
	"io/fs"
	"strings"
	"text/template"
)

const maxJunkInstShortSize = 64

// The role of the junk code is to make the instruction sequence
// as featureless as possible.
var (
	//go:embed junk/*_x86.asm
	defaultJunkCodeFSx86 embed.FS

	//go:embed junk/*_x64.asm
	defaultJunkCodeFSx64 embed.FS

	defaultJunkCodeX86 = readJunkCodeTemplates(defaultJunkCodeFSx86)
	defaultJunkCodeX64 = readJunkCodeTemplates(defaultJunkCodeFSx64)
)

func readJunkCodeTemplates(efs embed.FS) []string {
	var templates []string
	err := fs.WalkDir(efs, ".", func(name string, entry fs.DirEntry, _ error) error {
		if entry.IsDir() {
			return nil
		}
		file, err := efs.Open(name)
		if err != nil {
			panic(err)
		}
		data, err := io.ReadAll(file)
		if err != nil {
			panic(err)
		}
		templates = append(templates, string(data))
		return nil
	})
	if err != nil {
		panic(err)
	}
	return templates
}

type junkCodeCtx struct {
	// for replace registers
	Reg map[string]string

	// for insert random instruction pair
	Switch map[string]bool

	// for random immediate data
	BYTE  map[string]int8
	WORD  map[string]int16
	DWORD map[string]int32
	QWORD map[string]int64

	// for random immediate data with [0, 32) and [0, 64)
	Less32 map[string]int
	Less64 map[string]int
}

// padding the junk instruction to the extended text
// section or created new text section code cave.
func (inj *Injector) paddingJunkInst(foa, size uint32) {
	rem := size
	for {
		inst := inj.buildJunkInst(true, false)
		l := uint32(len(inst)) // #nosec G115
		if rem < l {
			break
		}
		copy(inj.dup[foa:], inst)
		foa += l
		rem -= l
	}
}

func (inj *Injector) insertJunkInst() string {
	if inj.opts.NoJunkCode {
		return ""
	}
	if inj.ctx.Mode == ModeCodeCave || inj.ctx.Mode == ModeCodeCaveNS {
		return ""
	}
	// must reset seed to ensure that the generation
	// sequence of junk instructions is consistent
	// in both cases, the correct size of the loader
	// can be calculated.
	inj.rand.Seed(inj.ijir.Int63())
	return ";" + toDB(inj.buildJunkInst(false, false))
}

func (inj *Injector) insertJunkInstShort() []byte {
	if inj.opts.NoJunkCode {
		return nil
	}
	if inj.ctx.Mode == ModeCodeCave || inj.ctx.Mode == ModeCodeCaveNS {
		return nil
	}
	// must reset seed to ensure that the generation
	// sequence of junk instructions is consistent
	// in both cases, the correct size of the loader
	// can be calculated.
	inj.rand.Seed(inj.ijir.Int63())
	return inj.buildJunkInst(false, true)
}

func (inj *Injector) buildJunkInst(broken, short bool) []byte {
	if broken && inj.rand.Intn(10) == 0 {
		buf := make([]byte, 1+inj.rand.Intn(8))
		inj.rand.Read(buf) // #nosec
		return buf
	}
	// random not insert junk instruction
	if inj.rand.Intn(10) == 0 {
		return nil
	}
	var numJunkCodes int
	switch inj.arch {
	case "386":
		numJunkCodes = len(inj.getJunkCodeX86())
	case "amd64":
		numJunkCodes = len(inj.getJunkCodeX64())
	}
	// dynamically adjust probability
	switch inj.rand.Intn(1 + numJunkCodes) {
	case 0:
		return inj.junkMultiByteNOP()
	default:
		return inj.junkTemplate(short)
	}
}

func (inj *Injector) junkMultiByteNOP() []byte {
	var nop []byte
	switch inj.rand.Intn(2) {
	case 0:
		nop = []byte{0x90}
	case 1:
		nop = []byte{0x66, 0x90}
	}
	return nop
}

func (inj *Injector) junkTemplate(short bool) []byte {
	var junkCodes []string
	switch inj.arch {
	case "386":
		junkCodes = inj.getJunkCodeX86()
	case "amd64":
		junkCodes = inj.getJunkCodeX64()
	}
	// select random junk code template
	idx := inj.rand.Intn(len(junkCodes))
	src := junkCodes[idx]
	// if source contains the mark about insertJunkInst,
	// not assemble it and return for build faster.
	if short && strings.Contains(src, "{{iji}}") {
		return inj.junkMultiByteNOP()
	}
	// assemble junk code
	asm, err := inj.buildJunkCode(src)
	if err != nil {
		panic(err)
	}
	inst, err := inj.assemble(asm)
	if err != nil {
		panic(fmt.Sprintf("failed to assemble junk code: %s", err))
	}
	if short && len(inst) > maxJunkInstShortSize {
		return inj.junkMultiByteNOP()
	}
	return inst
}

func (inj *Injector) getJunkCodeX86() []string {
	if len(inj.opts.JunkCodeX86) > 0 {
		return inj.opts.JunkCodeX86
	}
	return defaultJunkCodeX86
}

func (inj *Injector) getJunkCodeX64() []string {
	if len(inj.opts.JunkCodeX64) > 0 {
		return inj.opts.JunkCodeX64
	}
	return defaultJunkCodeX64
}

// #nosec G115
func (inj *Injector) buildJunkCode(src string) (string, error) {
	// process assembly source
	tpl, err := template.New("junk_code").Funcs(template.FuncMap{
		"db":  toDB,
		"hex": toHex,
		"iji": inj.insertJunkInst,
		"ijs": inj.insertJunkInstShort,
	}).Parse(src)
	if err != nil {
		return "", fmt.Errorf("invalid junk code template: %s", err)
	}
	// initialize random data
	switches := make(map[string]bool)
	BYTE := make(map[string]int8)
	WORD := make(map[string]int16)
	DWORD := make(map[string]int32)
	QWORD := make(map[string]int64)
	Less32 := make(map[string]int)
	Less64 := make(map[string]int)
	for i := 'A'; i <= 'Z'; i++ {
		b := inj.rand.Intn(2) == 0
		switches[string(i)] = b
		switches[string(i+0x20)] = b
		BYTE[string(i)] = int8(inj.rand.Int31() % 128)
		WORD[string(i)] = int16(inj.rand.Int31() % 32768)
		DWORD[string(i)] = inj.rand.Int31()
		QWORD[string(i)] = inj.rand.Int63()
		Less32[string(i)] = inj.rand.Intn(32)
		Less64[string(i)] = inj.rand.Intn(64)
	}
	ctx := junkCodeCtx{
		Reg:    inj.buildRandomRegisterMap(),
		Switch: switches,
		BYTE:   BYTE,
		WORD:   WORD,
		DWORD:  DWORD,
		QWORD:  QWORD,
		Less32: Less32,
		Less64: Less64,
	}
	buf := bytes.NewBuffer(make([]byte, 0, 512))
	err = tpl.Execute(buf, &ctx)
	if err != nil {
		return "", fmt.Errorf("failed to build junk code assembly source: %s", err)
	}
	return buf.String(), nil
}