dobf

dobf is a binary patching tool used to primarily deal with obfuscation.
Current features include:

• Nop instruction optimizing (90 90 becomes 66 90 and so forth)
• Fast pattern matching
• Easily configurable with toml configs

Building

git clone https://github.com/brunph/dobf-rs.git
cargo build --release

Usage

dobf works with toml to specify the types of patches to be done. Below is an example of such a patch.

name = "example"

[obfret]
# asm:
# lea     rsp, [rsp+0x8]
# jmp     qword [rsp-0x8]
# ->
# ret
pattern = "48 8D 64 24 08 FF 64 24 F8"
patch = "C3 90 90 90 90 90 90 90 90" # adding these nops are optional, but a good way to get rid of the remaining junk after the patch
order = 0 # optional; defaults to 0. Use it to control the order of multiple transforms

Then simply run your compiled version of dobf

dobf.exe -i test.asm -c example.toml

Embedded patcher executables

Create a standalone patcher whose TOML configuration is embedded in the executable:

dobf.exe --config example.toml --create-patcher example-patcher.exe

The generated executable no longer needs example.toml at runtime:

example-patcher.exe --input target.exe --output target-patched.exe

Applications can generate patchers through the library API. The first argument is a compiled dobf executable used as the platform-specific template:

use dobf::create_embedded_patcher;

create_embedded_patcher("dobf.exe", "example.toml", "example-patcher.exe")?;

The template determines the generated program's operating system and architecture. Appending the configuration invalidates an existing executable signature, so sign the generated executable after creation.

Before

After

Todo

• Nested matching to improve correctness