Skip to content

Fix all remaining issues: CFF refactor, junkcode cleanup, naming, constants, func2rva - #21

Merged
sondt99 merged 1 commit into
mainfrom
fix/remaining-issues-5-17
Aug 2, 2026
Merged

Fix all remaining issues: CFF refactor, junkcode cleanup, naming, constants, func2rva#21
sondt99 merged 1 commit into
mainfrom
fix/remaining-issues-5-17

Conversation

@sondt99

@sondt99 sondt99 commented Aug 2, 2026

Copy link
Copy Markdown
Owner

Summary

Comprehensive refactoring covering all remaining open issues (#5, #6, #7, #10, #12, #13, #15, #16).

obfuscatecff (#5)

  • Remove using namespace asmjit; from header — all types now fully qualified
  • Move ZydisFormatter/ZydisDecoder from file-scope globals to class members
  • Remove dead private forward declarations
  • Pass create_functions vector by const& (was copying entire vector)
  • Use const auto& in loops (was copying each element)
  • Replace visited_rvas vector with unordered_set (O(1) vs O(n) lookup)
  • Add const to get_added_size()

cfflattening (#6)

  • Fix is_first_instruction — set to true on push_rax (was always false after CFF)
  • Add null-check after find_if for last_inst (was UB when end() returned)

junkcode (#7, #16)

  • Extract duplicated junk patching loops into patch_junk_region() helper
  • Replace silent data corruption on INT32 overflow with warning + skip
  • Remove all dead std::cout << "" statements
  • Make junk instruction vectors static const (was rebuilt on every call)

Naming (#10)

  • Rename ctfflattening → cff_flattening across all files (typo fix)
  • Qualify asmjit:: prefix in REG_PAIR macro

func2rva (#12)

  • Extract duplicated display code into display_function_table() method
  • Replace static std::vector<FunctionInfo> empty_list with throw on uninitialized access

Constants (#15)

  • Create constants.h with all named constants (PE, CFF, junk, PDB)

Files Changed (11 files, +263 -308)

File Changes
constants.h New — all named constants
obfuscatecff.h Remove using namespace, add members, const, naming
obfuscatecff.cpp Match .h changes, const ref, unordered_set, qualify asmjit
cfflattening.cpp Fix is_first_instruction, add find_if null-check
junkcode.h Add patch_junk_region declaration
junkcode.cpp Extract helper, static const pools, fix overflow handling
func2rva.h Add display_function_table declaration
func2rva.cpp Extract display helper, throw on uninitialized
pdbparser.h Rename ctfflattening → cff_flattening
ObfuGuard.vcxproj Add constants.h
ObfuGuard.vcxproj.filters Add constants.h to Header Files

Checklist

  • using namespace asmjit; removed, all types qualified
  • Zydis globals moved to class members
  • create_functions takes const std::vector& (no copy)
  • visited_rvas uses unordered_set (O(1) lookup)
  • is_first_instruction set correctly on new first instruction
  • find_if results checked before dereferencing
  • Junk patching duplicated loops extracted to patch_junk_region()
  • Dead std::cout << "" removed
  • INT32 overflow: warning + skip instead of silent corruption
  • Junk pools are static const (initialized once)
  • ctfflattening → cff_flattening everywhere
  • display_function_table() extracted, display code deduplicated
  • static empty_list → throw std::runtime_error
  • constants.h created with named constants

Test plan

  • Build succeeds in Release|x64
  • Build succeeds in Debug|x64
  • CFF mode: obfuscate test binary → verify output runs
  • Junk mode (auto): obfuscate test binary → verify output runs
  • Junk mode (manual): select functions → verify output
  • Run match_check.py on full 60-binary test suite
  • Verify CFF shuffle is non-deterministic
  • Test with PE lacking debug directory

Closes #5, Closes #6, Closes #7, Closes #10, Closes #12, Closes #13, Closes #15, Closes #16

@sondt99
Fix all remaining issues: #5 #6 #7 #10 #12 #13 #15 #16
e9610df 
Issue #5 — obfuscatecff refactoring:
- Remove `using namespace asmjit;` from header, qualify all types
- Move ZydisFormatter/ZydisDecoder from file scope to class members
- Remove dead private forward declarations of instruction_t/function_t
- Pass create_functions param by const-reference (was copying entire vector)
- Use const auto& in loop iterations (was copying each element)
- Replace visited_rvas vector with unordered_set (O(1) vs O(n) lookup)
- Add const to get_added_size()

Issue #6 — cfflattening fixes:
- Fix is_first_instruction: set to true on push_rax (was always false)
- Add null-check after find_if for last_inst (was UB on end())

Issue #7 — junkcode refactoring:
- Extract duplicated junk patching loops into patch_junk_region() helper
- Replace silent data corruption on INT32 overflow with warning + skip
- Remove all dead `std::cout << ""` output statements

Issue #10 — naming consistency:
- Rename ctfflattening → cff_flattening across all files
- Qualify asmjit types with namespace prefix
- Update REG_PAIR macro to use asmjit::x86::

Issue #12 — func2rva refactoring:
- Extract duplicated display code into display_function_table() method
- Replace static empty_list with throw on uninitialized access

Issue #15 — constants:
- Create constants.h with all named constants (PE, CFF, junk, PDB)
- Add to vcxproj and vcxproj.filters

Issue #16 — junk instruction pool:
- Make junk instruction vectors static const (was rebuilt every call)
- Keep only safe, verified semantically-neutral patterns

Closes #5, Closes #6, Closes #7, Closes #10, Closes #12, Closes #13,
Closes #15, Closes #16
@sondt99
sondt99 merged commit 805e4eb into main Aug 2, 2026
2 of 3 checks passed
@sondt99
sondt99 deleted the fix/remaining-issues-5-17 branch August 2, 2026 10:19
sondt99 added a commit that referenced this pull request Aug 10, 2026
@sondt99
Merge pull request #21 from sondt99/fix/remaining-issues-5-17
68932be 
Fix all remaining issues: CFF refactor, junkcode cleanup, naming, constants, func2rva
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment