{"action":"created","comment":{"url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/comments/23888877","id":23888877,"diff_hunk":"@@ -0,0 +1,979 @@\n+===============================================\n+Turning Regular Code Into Attrocities With LLVM\n+===============================================\n+\n+Objective\n+=========\n+The objective of this post is to explain the basics of LLVM bytecode obfuscation through an out-of-source build single pass.\n+*'But why obfuscate the LLVM bytecode? Why not the source code? Or the binary?'*, you may ask.\n+\n+Well it's because LLVM is *super swag* right now and using it is cool.\n+But, regarding the engineering aspects, it is because there are lots of front-ends converting different languages into the same LLVM bytecode (Clang/Clang++ for C/C++, Mono LLVM for C#, Pyston for... Python and so on).\n+Hence by working at the bytecode level we can obfuscate programs produced by many languages without even knowing them.\n+Another good thing is that the obfuscation can be easily integrated with the existing compilation chain.\n+\n+Now let's talk about what we're going to do.\n+Our mission (and we have no choice but to accept it) is to obfuscate all null literals in the code.\n+It means that we are going to replace (almost) all the zeroes in the code by a non-trivial boolean expression always false.\n+\n+        prime1 * ((x | any1)**2) != prime2 * ((y | any2)**2)\n+\n+    - prime1 and prime2 are *distinct* prime numbers\n+    - any1 and any2 are *distinct* strictly positive random numbers\n+    - x and y are two variables picked from the program (they have to be reachable from the obfuscation instructions)\n+\n+This expression will always return a boolean zero (false). The idea is to insert this test into our code, just before the 0 we want to obfuscate and to replace this 0 by the result of our comparison.\n+As you have probably noticed we will have to pay attention to the type of the original 0 and make sure we cast the result of our expression to its type.\n+\n+This obfuscation may not be the most sophisticated ever written but it's enough to learn the basics of LLVM bytecode obfuscation and maybe to annoy our friends in reverse engineering for a few minutes... until they use `miasm <https://code.google.com/p/miasm/>`_...\n+\n+Requirements\n+============\n+\n+Programming background\n+**********************\n+To go through this tutorial you only need to be able to read C/C++ code. We will learn the basics of LLVM API and LLVM bytecode together.\n+\n+Environment\n+***********\n+If you want to experiment along with this tutorial (which is strongly recommended) you will need to set up an LLVM development environment.\n+\n+    * First let's download the LLVM sources...\n+        ``>$ git clone --depth=1 --branch=release_35 https://github.com/llvm-mirror/llvm llvm_src``\n+\n+    * Now download the clang sources inside the llvm_src/tools directory.\n+        ``>$ cd llvm_src/tools && git clone --depth=1 --branch=release_35 https://github.com/llvm-mirror/clang``\n+\n+    * Create a build directory somewhere *out of the llvm source tree*:\n+        ``>$ mkdir path/to/llvm/build/llvm``\n+\n+    * Let's build LLVM:\n+        ``>$ cd ~/llvm && cmake path/to/llvm/sources``\n+        ``>$ make -j``","path":"doc/llvm_obfuscation_tutorial.rst","position":52,"original_position":52,"commit_id":"8221ee71a07ce8ce7a20d3126533907a871e1f38","original_commit_id":"8221ee71a07ce8ce7a20d3126533907a871e1f38","user":{"login":"artas360","id":1293130,"avatar_url":"https://avatars.githubusercontent.com/u/1293130?v=3","gravatar_id":"","url":"https://api.github.com/users/artas360","html_url":"https://github.com/artas360","followers_url":"https://api.github.com/users/artas360/followers","following_url":"https://api.github.com/users/artas360/following{/other_user}","gists_url":"https://api.github.com/users/artas360/gists{/gist_id}","starred_url":"https://api.github.com/users/artas360/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artas360/subscriptions","organizations_url":"https://api.github.com/users/artas360/orgs","repos_url":"https://api.github.com/users/artas360/repos","events_url":"https://api.github.com/users/artas360/events{/privacy}","received_events_url":"https://api.github.com/users/artas360/received_events","type":"User","site_admin":false},"body":"My bad, I'll do that","created_at":"2015-01-31T13:37:34Z","updated_at":"2015-01-31T13:37:34Z","html_url":"https://github.com/quarkslab/llvm-passes/pull/3#discussion_r23888877","pull_request_url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3","_links":{"self":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/comments/23888877"},"html":{"href":"https://github.com/quarkslab/llvm-passes/pull/3#discussion_r23888877"},"pull_request":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3"}}},"pull_request":{"url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3","id":28279129,"html_url":"https://github.com/quarkslab/llvm-passes/pull/3","diff_url":"https://github.com/quarkslab/llvm-passes/pull/3.diff","patch_url":"https://github.com/quarkslab/llvm-passes/pull/3.patch","issue_url":"https://api.github.com/repos/quarkslab/llvm-passes/issues/3","number":3,"state":"open","locked":false,"title":"Adding LLVM obuscation tutorial","user":{"login":"artas360","id":1293130,"avatar_url":"https://avatars.githubusercontent.com/u/1293130?v=3","gravatar_id":"","url":"https://api.github.com/users/artas360","html_url":"https://github.com/artas360","followers_url":"https://api.github.com/users/artas360/followers","following_url":"https://api.github.com/users/artas360/following{/other_user}","gists_url":"https://api.github.com/users/artas360/gists{/gist_id}","starred_url":"https://api.github.com/users/artas360/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artas360/subscriptions","organizations_url":"https://api.github.com/users/artas360/orgs","repos_url":"https://api.github.com/users/artas360/repos","events_url":"https://api.github.com/users/artas360/events{/privacy}","received_events_url":"https://api.github.com/users/artas360/received_events","type":"User","site_admin":false},"body":"Adding tutorial & Modifying an outdated comment in ObfuscateZero.cpp","created_at":"2015-01-29T13:41:31Z","updated_at":"2015-01-31T13:37:34Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c68f62a1d5f3955dd1688903c1dcf2e7f1e91612","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3/commits","review_comments_url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3/comments","review_comment_url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/comments/{number}","comments_url":"https://api.github.com/repos/quarkslab/llvm-passes/issues/3/comments","statuses_url":"https://api.github.com/repos/quarkslab/llvm-passes/statuses/8221ee71a07ce8ce7a20d3126533907a871e1f38","head":{"label":"artas360:master","ref":"master","sha":"8221ee71a07ce8ce7a20d3126533907a871e1f38","user":{"login":"artas360","id":1293130,"avatar_url":"https://avatars.githubusercontent.com/u/1293130?v=3","gravatar_id":"","url":"https://api.github.com/users/artas360","html_url":"https://github.com/artas360","followers_url":"https://api.github.com/users/artas360/followers","following_url":"https://api.github.com/users/artas360/following{/other_user}","gists_url":"https://api.github.com/users/artas360/gists{/gist_id}","starred_url":"https://api.github.com/users/artas360/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artas360/subscriptions","organizations_url":"https://api.github.com/users/artas360/orgs","repos_url":"https://api.github.com/users/artas360/repos","events_url":"https://api.github.com/users/artas360/events{/privacy}","received_events_url":"https://api.github.com/users/artas360/received_events","type":"User","site_admin":false},"repo":{"id":29475401,"name":"llvm-passes","full_name":"artas360/llvm-passes","owner":{"login":"artas360","id":1293130,"avatar_url":"https://avatars.githubusercontent.com/u/1293130?v=3","gravatar_id":"","url":"https://api.github.com/users/artas360","html_url":"https://github.com/artas360","followers_url":"https://api.github.com/users/artas360/followers","following_url":"https://api.github.com/users/artas360/following{/other_user}","gists_url":"https://api.github.com/users/artas360/gists{/gist_id}","starred_url":"https://api.github.com/users/artas360/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artas360/subscriptions","organizations_url":"https://api.github.com/users/artas360/orgs","repos_url":"https://api.github.com/users/artas360/repos","events_url":"https://api.github.com/users/artas360/events{/privacy}","received_events_url":"https://api.github.com/users/artas360/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/artas360/llvm-passes","description":"Collection of various llvm passes","fork":true,"url":"https://api.github.com/repos/artas360/llvm-passes","forks_url":"https://api.github.com/repos/artas360/llvm-passes/forks","keys_url":"https://api.github.com/repos/artas360/llvm-passes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/artas360/llvm-passes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/artas360/llvm-passes/teams","hooks_url":"https://api.github.com/repos/artas360/llvm-passes/hooks","issue_events_url":"https://api.github.com/repos/artas360/llvm-passes/issues/events{/number}","events_url":"https://api.github.com/repos/artas360/llvm-passes/events","assignees_url":"https://api.github.com/repos/artas360/llvm-passes/assignees{/user}","branches_url":"https://api.github.com/repos/artas360/llvm-passes/branches{/branch}","tags_url":"https://api.github.com/repos/artas360/llvm-passes/tags","blobs_url":"https://api.github.com/repos/artas360/llvm-passes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/artas360/llvm-passes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/artas360/llvm-passes/git/refs{/sha}","trees_url":"https://api.github.com/repos/artas360/llvm-passes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/artas360/llvm-passes/statuses/{sha}","languages_url":"https://api.github.com/repos/artas360/llvm-passes/languages","stargazers_url":"https://api.github.com/repos/artas360/llvm-passes/stargazers","contributors_url":"https://api.github.com/repos/artas360/llvm-passes/contributors","subscribers_url":"https://api.github.com/repos/artas360/llvm-passes/subscribers","subscription_url":"https://api.github.com/repos/artas360/llvm-passes/subscription","commits_url":"https://api.github.com/repos/artas360/llvm-passes/commits{/sha}","git_commits_url":"https://api.github.com/repos/artas360/llvm-passes/git/commits{/sha}","comments_url":"https://api.github.com/repos/artas360/llvm-passes/comments{/number}","issue_comment_url":"https://api.github.com/repos/artas360/llvm-passes/issues/comments/{number}","contents_url":"https://api.github.com/repos/artas360/llvm-passes/contents/{+path}","compare_url":"https://api.github.com/repos/artas360/llvm-passes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/artas360/llvm-passes/merges","archive_url":"https://api.github.com/repos/artas360/llvm-passes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/artas360/llvm-passes/downloads","issues_url":"https://api.github.com/repos/artas360/llvm-passes/issues{/number}","pulls_url":"https://api.github.com/repos/artas360/llvm-passes/pulls{/number}","milestones_url":"https://api.github.com/repos/artas360/llvm-passes/milestones{/number}","notifications_url":"https://api.github.com/repos/artas360/llvm-passes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/artas360/llvm-passes/labels{/name}","releases_url":"https://api.github.com/repos/artas360/llvm-passes/releases{/id}","created_at":"2015-01-19T14:47:09Z","updated_at":"2015-01-30T21:28:54Z","pushed_at":"2015-01-30T21:28:52Z","git_url":"git://github.com/artas360/llvm-passes.git","ssh_url":"git@github.com:artas360/llvm-passes.git","clone_url":"https://github.com/artas360/llvm-passes.git","svn_url":"https://github.com/artas360/llvm-passes","homepage":null,"size":191,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"quarkslab:master","ref":"master","sha":"1b0b9ea145cf27a038495dc7cb1cdc97bbf6e1bf","user":{"login":"quarkslab","id":3357711,"avatar_url":"https://avatars.githubusercontent.com/u/3357711?v=3","gravatar_id":"","url":"https://api.github.com/users/quarkslab","html_url":"https://github.com/quarkslab","followers_url":"https://api.github.com/users/quarkslab/followers","following_url":"https://api.github.com/users/quarkslab/following{/other_user}","gists_url":"https://api.github.com/users/quarkslab/gists{/gist_id}","starred_url":"https://api.github.com/users/quarkslab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quarkslab/subscriptions","organizations_url":"https://api.github.com/users/quarkslab/orgs","repos_url":"https://api.github.com/users/quarkslab/repos","events_url":"https://api.github.com/users/quarkslab/events{/privacy}","received_events_url":"https://api.github.com/users/quarkslab/received_events","type":"Organization","site_admin":false},"repo":{"id":29474475,"name":"llvm-passes","full_name":"quarkslab/llvm-passes","owner":{"login":"quarkslab","id":3357711,"avatar_url":"https://avatars.githubusercontent.com/u/3357711?v=3","gravatar_id":"","url":"https://api.github.com/users/quarkslab","html_url":"https://github.com/quarkslab","followers_url":"https://api.github.com/users/quarkslab/followers","following_url":"https://api.github.com/users/quarkslab/following{/other_user}","gists_url":"https://api.github.com/users/quarkslab/gists{/gist_id}","starred_url":"https://api.github.com/users/quarkslab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quarkslab/subscriptions","organizations_url":"https://api.github.com/users/quarkslab/orgs","repos_url":"https://api.github.com/users/quarkslab/repos","events_url":"https://api.github.com/users/quarkslab/events{/privacy}","received_events_url":"https://api.github.com/users/quarkslab/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/quarkslab/llvm-passes","description":"Collection of various llvm passes","fork":false,"url":"https://api.github.com/repos/quarkslab/llvm-passes","forks_url":"https://api.github.com/repos/quarkslab/llvm-passes/forks","keys_url":"https://api.github.com/repos/quarkslab/llvm-passes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/quarkslab/llvm-passes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/quarkslab/llvm-passes/teams","hooks_url":"https://api.github.com/repos/quarkslab/llvm-passes/hooks","issue_events_url":"https://api.github.com/repos/quarkslab/llvm-passes/issues/events{/number}","events_url":"https://api.github.com/repos/quarkslab/llvm-passes/events","assignees_url":"https://api.github.com/repos/quarkslab/llvm-passes/assignees{/user}","branches_url":"https://api.github.com/repos/quarkslab/llvm-passes/branches{/branch}","tags_url":"https://api.github.com/repos/quarkslab/llvm-passes/tags","blobs_url":"https://api.github.com/repos/quarkslab/llvm-passes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/quarkslab/llvm-passes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/quarkslab/llvm-passes/git/refs{/sha}","trees_url":"https://api.github.com/repos/quarkslab/llvm-passes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/quarkslab/llvm-passes/statuses/{sha}","languages_url":"https://api.github.com/repos/quarkslab/llvm-passes/languages","stargazers_url":"https://api.github.com/repos/quarkslab/llvm-passes/stargazers","contributors_url":"https://api.github.com/repos/quarkslab/llvm-passes/contributors","subscribers_url":"https://api.github.com/repos/quarkslab/llvm-passes/subscribers","subscription_url":"https://api.github.com/repos/quarkslab/llvm-passes/subscription","commits_url":"https://api.github.com/repos/quarkslab/llvm-passes/commits{/sha}","git_commits_url":"https://api.github.com/repos/quarkslab/llvm-passes/git/commits{/sha}","comments_url":"https://api.github.com/repos/quarkslab/llvm-passes/comments{/number}","issue_comment_url":"https://api.github.com/repos/quarkslab/llvm-passes/issues/comments/{number}","contents_url":"https://api.github.com/repos/quarkslab/llvm-passes/contents/{+path}","compare_url":"https://api.github.com/repos/quarkslab/llvm-passes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/quarkslab/llvm-passes/merges","archive_url":"https://api.github.com/repos/quarkslab/llvm-passes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/quarkslab/llvm-passes/downloads","issues_url":"https://api.github.com/repos/quarkslab/llvm-passes/issues{/number}","pulls_url":"https://api.github.com/repos/quarkslab/llvm-passes/pulls{/number}","milestones_url":"https://api.github.com/repos/quarkslab/llvm-passes/milestones{/number}","notifications_url":"https://api.github.com/repos/quarkslab/llvm-passes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/quarkslab/llvm-passes/labels{/name}","releases_url":"https://api.github.com/repos/quarkslab/llvm-passes/releases{/id}","created_at":"2015-01-19T14:26:01Z","updated_at":"2015-01-23T20:17:00Z","pushed_at":"2015-01-23T20:17:00Z","git_url":"git://github.com/quarkslab/llvm-passes.git","ssh_url":"git@github.com:quarkslab/llvm-passes.git","clone_url":"https://github.com/quarkslab/llvm-passes.git","svn_url":"https://github.com/quarkslab/llvm-passes","homepage":null,"size":147,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":1,"forks":3,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3"},"html":{"href":"https://github.com/quarkslab/llvm-passes/pull/3"},"issue":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/issues/3"},"comments":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/issues/3/comments"},"review_comments":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3/comments"},"review_comment":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/pulls/3/commits"},"statuses":{"href":"https://api.github.com/repos/quarkslab/llvm-passes/statuses/8221ee71a07ce8ce7a20d3126533907a871e1f38"}}}}