// play.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "sdk\SDK.h"
#include <Windows.h>
#include <iostream>
#include <string>
#include <fstream>

typedef unsigned int u32;
typedef unsigned char* memo;

class vm{
private:
	static std::ofstream dump_;
	static long handler_1;
	static long handler_2;
	static long vm_out;
	static long temp;
	static LPPROCESS_INFORMATION ProcessInfo;
	static void cbOnCreate_dump(LPCREATE_PROCESS_DEBUG_INFO lpCreateProcInfo);
	static void cbOnCreate_dump_h(LPCREATE_PROCESS_DEBUG_INFO lpCreateProcInfo);
	static void cbOn_get_h();
	static void cbOn_h1();
	static void cbOn_h2();
	static void cbOn_quit();


	//handlers
	static void cbOnPush();
	static void cbOnPush_8();
	static void cbOnPush32();

public:
	vm(std::string full_path);
	void dump_handlers(std::string dump_file);
	void dump_instructions(std::string dump_file);
};

std::ofstream vm::dump_{};
long vm::handler_1 = 0;
long vm::handler_2 = 0;
long vm::vm_out = 0;
long vm::temp = 0;
LPPROCESS_INFORMATION vm::ProcessInfo = NULL;

u32 Load32(memo loc){
	return (loc[3] << (8 * 3)) | (loc[2] << (8 * 2)) | (loc[1] << 8) | loc[0];
}

void vm::cbOn_h1(){
	long next_handler = 0;
	unsigned char stack[8];

	next_handler = (long)GetContextData(UE_ESP);
	ReadProcessMemory(ProcessInfo->hProcess, (void*)next_handler, stack, 4, NULL);
	dump_ << "handle: " << std::hex << Load32(stack) << std::endl;
}

void vm::cbOn_h2(){
	long next_handler = 0;
	unsigned char stack[8];

	next_handler = (long)GetContextData(UE_ESP);
	ReadProcessMemory(ProcessInfo->hProcess, (void*)next_handler, stack, 4, NULL);
	dump_ << "handle: " << std::hex << Load32(stack) << std::endl;
}

void vm::cbOn_quit(){
	dump_ << "vm_quit" << std::endl;
	dump_.close();
	StopDebug();
}

void vm::cbOnCreate_dump(LPCREATE_PROCESS_DEBUG_INFO lpCreateProcInfo){
	SetCustomHandler(UE_CH_CREATEPROCESS, NULL);
	SetBPX(handler_1, UE_BREAKPOINT, &cbOn_h1);
	SetBPX(handler_2, UE_BREAKPOINT, &cbOn_h2);
	SetBPX(vm_out, UE_BREAKPOINT, &cbOn_quit);
}


vm::vm(std::string full_path){
	char* c_str = (char*)full_path.c_str();
	ProcessInfo = (LPPROCESS_INFORMATION)InitDebug(c_str, NULL, NULL);
	//assumes standard values
	vm_out = 0x4011d8;
	handler_1 = 0x40510d;
	handler_2 = 0x4059c7;
}

void vm::dump_handlers(std::string dump_file){
	dump_.open(dump_file);
	SetCustomHandler(UE_CH_CREATEPROCESS, &cbOnCreate_dump);
	DebugLoop();
}

void vm::dump_instructions(std::string dump_file){
	dump_.open(dump_file);
	SetCustomHandler(UE_CH_CREATEPROCESS, &cbOnCreate_dump_h);
	DebugLoop();
}

void vm::cbOnCreate_dump_h(LPCREATE_PROCESS_DEBUG_INFO lpCreateProcInfo){
	SetCustomHandler(UE_CH_CREATEPROCESS, NULL);
	SetBPX(handler_1, UE_BREAKPOINT, &cbOn_get_h);
	SetBPX(handler_2, UE_BREAKPOINT, &cbOn_get_h);
	SetBPX(vm_out, UE_BREAKPOINT, &cbOn_quit);
}


void vm::cbOn_get_h(){
	long next_handler = 0;
	unsigned char stack[8];

	next_handler = (long)GetContextData(UE_ESP);
	ReadProcessMemory(ProcessInfo->hProcess, (void*)next_handler, stack, 4, NULL);

	switch (Load32(stack)){
	case 0x4058e6: //PUSH
		temp = 0x4049ca;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "POP_32 ";
		break;
	case 0x4051ca: //PUSH_32
		temp = 0x4061ce;
		SetBPX(0x4061ce, UE_BREAKPOINT, &cbOnPush32);
		dump_ << "PUSH_32 0x";
		break;
	case 0x40586d:
		dump_ << "ADD_32		;cf" << std::endl;
		break;
	case 0x40606f: //push
		temp = 0x4060a4;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "PUSH_32 ";
		break;
	case 0x40414e:
		dump_ << "NOR_32		;cf" << std::endl;
		break;
	case 0x405931:
		dump_ << "FETCH_32" << std::endl;
		break;
	case 0x405eda:
		dump_ << "PUSH ESP" << std::endl;
		break;
	case 0x405430:
		dump_ << "FETCH_32" << std::endl;
		break;
	case 0x405e40:
		temp = 0x404d87;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "PUSH_8 ";
		break;
	case 0x4042f3:
		dump_ << "FETCH_32_1" << std::endl;
		break;
	case 0x406324:
		dump_ << "DROP_32" << std::endl << "DROP_32" << std::endl;
		break;
	case 0x40509c:
		dump_ << "NOR_16		;cf" << std::endl;
		break;
	case 0x404f60:
		temp = 0x406290;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "POP_16 ";
		break;
	case 0x404d25:
		temp = 0x405eff;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "PUSH_16 ";
		break;
	case 0x40487b:
		temp = 0x405131;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush_8);
		dump_ << "PUSH_8 ";
		break;
	case 0x4057a8:
		temp = 0x405827;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush);
		dump_ << "POP_8";
		break;
	case 0x404f77:
		dump_ << "SHR_8		;CF" << std::endl;
		break;
	case 0x4011d8:
		temp = 0x405a36;
		SetBPX(temp, UE_BREAKPOINT, &cbOnPush32);
		dump_ << "PUSH_16" << std::endl;
		break;
	default:
		dump_ << "handler desconhecido: " << std::hex << Load32(stack) << std::endl;
	}
}

void vm::cbOnPush_8(){
	long REG = (long)GetContextData(UE_EAX);
	REG = REG / 4;
	dump_ << "r" << std::dec << REG << "&0xff" << std::endl;
	DisableBPX(temp);
	temp = 0;
}

void vm::cbOnPush(){
	long REG = (long)GetContextData(UE_EAX);
	REG = REG / 4;
	dump_ << "r" << std::dec << REG << std::endl;
	DisableBPX(temp);
	temp = 0;
}

void vm::cbOnPush32(){
	long p32 = (long)GetContextData(UE_EAX);
	dump_ << std::hex << p32 << std::endl;
	DisableBPX(temp);
}

class foo{
private:
	int salt;
public:
	foo(int);
	~foo();
};

foo::foo(int x){
	std::cout << "a new foo was born for great vengeance!" << std::endl;
	salt = x;
}

foo::~foo(){
	std::cout << "a foo was lost" << std::endl;
}
int _tmain(int argc, _TCHAR* argv[])
{
	vm Standard = vm("C:\\Users\\JOAO\\Favorites\\Desktop\\crackmes\\test.vmp_.exe");
	Standard.dump_instructions("dumped.txt");
	return 0;
}