ASM code hook/patching with trampoline function

Question

I am stuck on making (my little self-task for learning) that thing:

Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM code between pointers, obfuscate it etc, and write it to some DLL. On original application, we have a patched trampoline with generated by our "disasm tool" function... Hmm, any example how to make that? =)

Maybe it is not a good idea of protection software code or something like that, i just do that for learning. I know how ASM pointers works in theory. For example, i can do all of that manually with Olly, but how to do that programatically like VMProtect, Enigma or Themida "compiler tools" do this? Never tried to make a something like that by my self. And did not find any examples, because that is "arcane" level of programming, and also such things hard to find on opensource =(

So to questions:

1)How to search programmatically ASM pointer inside compiled application?

2)How to "cut" & disasm code between 2 ASM pointers programmatically?

3)How to paste them back (after edit) programmatically?

Answer 1

1) If by pointer you mean "pattern" or "watermark" the first thing that comes into my mind is BlackMagic (read FindPattern function)

2)

• A program is a file that have a certain structure (PE file format), so you have to read it as an array since all you want to do is replacing bytes withing a range
• after obtaining the Start offset and End offset (which are the address of the "Begin" and "End" respectively) you disassemble the bytes between them, you can use for example Distorm or Olly disasm (this one can assemble back your code)
• the original code should replaced by something like (don't forget to replace the remaining bytes)

push offset dllName    
call LoadLibraryA    ; load the dll

push offset FunctionName     
push eax  
call GetProcAddress   ; obtain the address of the moved function

call/jmp eax ; call or jump to the moved function

3) At this point the disassembled code should have been obfuscated/encrypted, and since it will be moved to another dll it's there (inside the dll) where it should be compiled back, you can either choose to assemble it manually (on memory) with (for example) Olly disasm (your program should manually generate a dll which is a lot of effort) or compile it (to disk) with (for example) MASM32

Notes :

• you should check that addresses inside the moved function is not called/reference somewhere else
• in case of presence of relocation (i.e the program doesn't have fixed image base) the addresses referenced by the moved function should be updated at runtime (for example : patched by the decryption routine)
• You should learn more about PE structure since you'll have to deal a lot with it in your project.
• this are some hints and not the only way to do it

Answer 2

The answer is LLVM. It allows to load the assembly and manipulate it. If you own the source code of the program, which you want to protect, it's even easier, because you'll be able to compile it via LLVM and have higher level of code manipulation. See LLVM pass there's an example on modifying the binary code during the compilcation