1
#include "llvm/IR/Function.h"
2
#include "llvm/IR/Module.h"
3
#include "llvm/Pass.h"
4
#include "llvm/Support/raw_ostream.h"
5
#include "llvm/IR/Instructions.h"
6
#include "llvm/Support/CommandLine.h"
7
#include <vector>
8
#include <cstdlib>
9
#include <ctime>
10
#include "Utils.h"
11
using namespace llvm;
12
using std::vector;
13

14
#define MAX_RAND 32767
15
#define NUMBER_CONST_SUBST 2
16

17
// 混淆次数，混淆次数越多混淆结果越复杂
18
static cl::opt<int> obfuTimes("csub_loop", cl::init(1), cl::desc("Obfuscate a function <obfu_time> time(s)."));
19

20
namespace{
21

22
    class ConstantSubstitution : public FunctionPass {
23
        public:
24
            static char ID;
25

26
            ConstantSubstitution() : FunctionPass(ID) {
27
                srand(time(NULL));
28
            }
29

30
            bool runOnFunction(Function &F);
31

32
            // 对单个指令 BI 进行替换
33
            void substitute(BinaryOperator *BI);
34

35
            // 线性替换：val -> ax + by + c
36
            // 其中 val 为原常量 a, b 为随机常量 x, y 为随机全局变量 c = val - (ax + by)
37
            void linearSubstitute(BinaryOperator *BI, int i);
38

39
            // 按位运算替换：val -> (x << 5 | y >> 3) ^ c
40
            // 其中 val 为原常量x, y 为随机全局变量 c = val ^ (x << 5 | y >> 3)
41
            void bitwiseSubstitute(BinaryOperator *BI, int i);
42
    };
43
}
44

45
bool ConstantSubstitution::runOnFunction(Function &F){
46
    INIT_CONTEXT(F);
47
    for(int i = 0;i < obfuTimes;i ++){
48
        for(BasicBlock &BB : F){
49
            vector<Instruction*> origInst;
50
            for(Instruction &I : BB){
51
                origInst.push_back(&I);
52
            }
53
            for(Instruction *I : origInst){
54
                // 只对二元运算指令中的常量进行替换
55
                if(BinaryOperator *BI = dyn_cast<BinaryOperator>(I)){
56
                    // 仅对整数进行替换
57
                    if(BI->getType()->isIntegerTy(32)){
58
                        substitute(BI);
59
                    }
60
                }
61
            }
62
        }
63
    }
64
}
65

66
void ConstantSubstitution::linearSubstitute(BinaryOperator *BI, int i){
67
    Module &M = *BI->getModule();
68
    ConstantInt *val = cast<ConstantInt>(BI->getOperand(i));
69
    // 随机生成 x, y, a, b
70
    // MAX_RAND 防止溢出
71
    int randX = rand() % MAX_RAND, randY = rand() % MAX_RAND;
72
    int randA = rand() % MAX_RAND, randB = rand() % MAX_RAND;
73
    // 计算 c = val - (ax + by)
74
    // val->getValue()获取到的值是 APInt 类型
75
    APInt c = val->getValue() - (randA * randX + randB * randY);
76
    ConstantInt *constX = CONST(val->getType(), randX);
77
    ConstantInt *constY = CONST(val->getType(), randY);
78
    ConstantInt *constA = CONST(val->getType(), randA);
79
    ConstantInt *constB = CONST(val->getType(), randB);
80
    ConstantInt *constC = (ConstantInt*)CONST(val->getType(), c);
81
    // 创建全局变量 x, y
82
    // PrivateLinkage 只能在模块内生效，私有链接
83
    GlobalVariable *x = new GlobalVariable(M, val->getType(), false, GlobalValue::PrivateLinkage, constX, "x");
84
    GlobalVariable *y = new GlobalVariable(M, val->getType(), false, GlobalValue::PrivateLinkage, constY, "y");
85
    LoadInst *opX = new LoadInst(val->getType(), x, "", BI);
86
    LoadInst *opY = new LoadInst(val->getType(), y, "", BI);
87
    // 构造 op = ax + by + c 表达式
88
    BinaryOperator *op1 = BinaryOperator::CreateMul(opX, constA, "", BI);
89
    BinaryOperator *op2 = BinaryOperator::CreateMul(opY, constB, "", BI);
90
    BinaryOperator *op3 = BinaryOperator::CreateAdd(op1, op2, "", BI);
91
    BinaryOperator *op4 = BinaryOperator::CreateAdd(op3, constC, "", BI);
92
    // 用表达式 ax + by + c 替换原常量操作数
93
    BI->setOperand(i, op4);
94
}
95

96
void ConstantSubstitution::bitwiseSubstitute(BinaryOperator *BI, int i){
97
    Module &M = *BI->getModule();
98
    ConstantInt *val = cast<ConstantInt>(BI->getOperand(i));
99
    // 随机生成 x, y
100
    unsigned randX = rand() % MAX_RAND, randY = rand() % MAX_RAND;
101
    // 计算 c = val ^ (x << 5 | y >> 3)
102
    APInt c = val->getValue() ^ (randX << 5 | randY >> 3);
103
    ConstantInt *constX = CONST(val->getType(), randX);
104
    ConstantInt *constY = CONST(val->getType(), randY);
105
    ConstantInt *const5 = CONST(val->getType(), 5);
106
    ConstantInt *const3 = CONST(val->getType(), 3);
107
    ConstantInt *constC = (ConstantInt*)CONST(val->getType(), c);
108
    // 创建全局变量 x, y
109
    GlobalVariable *x = new GlobalVariable(M, val->getType(), false, GlobalValue::PrivateLinkage, constX, "x");
110
    GlobalVariable *y = new GlobalVariable(M, val->getType(), false, GlobalValue::PrivateLinkage, constY, "y");
111
    LoadInst *opX = new LoadInst(val->getType(), x, "", BI);
112
    LoadInst *opY = new LoadInst(val->getType(), y, "", BI);
113
    // 构造 op = (x << 5 | y >> 3) ^ c 表达式
114
    BinaryOperator *op1 = BinaryOperator::CreateShl(opX, const5, "", BI);
115
    BinaryOperator *op2 = BinaryOperator::CreateLShr(opY, const3, "", BI);
116
    BinaryOperator *op3 = BinaryOperator::CreateOr(op1, op2, "", BI);
117
    BinaryOperator *op4 = BinaryOperator::CreateXor(op3, constC, "", BI);
118
    // 用表达式 (x << 5 | y >> 3) ^ c 替换原常量操作数
119
    BI->setOperand(i, op4);
120
}
121

122
void ConstantSubstitution::substitute(BinaryOperator *BI){
123
    int operandNum = BI->getNumOperands();
124
    for(int i = 0;i < operandNum;i ++){
125
        if(isa<ConstantInt>(BI->getOperand(i))){
126
            int choice = rand() % NUMBER_CONST_SUBST;
127
            switch (choice) {
128
                case 0:
129
                    linearSubstitute(BI, i);
130
                    break;
131
                case 1:
132
                    bitwiseSubstitute(BI, i);
133
                    break;
134
                default:
135
                    break;
136
            }
137
        }
138
    }
139
}
140

141
char ConstantSubstitution::ID = 0;
142
static RegisterPass<ConstantSubstitution> X("csub", "Replace a constant value with equivalent instructions.");