Initial commit.

This code is a COMPLETE MESS. The disassembler will MAKE YOUR EYES
BLEED!

So far it's just a simple in-place substitution engine, most .exes don't
provide relocations, and it would be completely unsafe to attempt an
incomplete relocation. Atm we only have limited static analysis, we have
no way to know where CALL EAX is going to take us, even if the address
is a plaintext constant moved into EAX two bytes ago.
We assume no self-modifying code, and attempt to follow the code flow
throught the branching instructions.

The analysis atm is just builds a list of all branching instructions
(regardless of the fact that we don't know where some of them lead), a
multimap of known xref-ed addresses, and an IDA-like jump flow graph
(doesn't take calls/ints into account, every block is "jump-atomic").

If your program is packed but not protected by fancy obfuscations such
as having the EP directly trigger a SEH or bypassing R^X and jumping
outside of the .text, you're in trouble. Hopefully the disassembler will
land on something it can't handle and throw an exception. You can use -f
to continue anyway, but you probably don't want to.

Also right now it can't handle anything that doesn't have its entry
point in the .text section. Having a CODE section will fail, and an
.itext section merged with the .text section will fail horribly.

The only transform is dirt-simple inplace substitution of some
instructions by equivalent instructions. E.g swapping 0x80 with 0x82,
randomizing the scale of the SIB when the index is EBP (or removing the
SIB), swapping src/dst registers and using an instruction that reads
src/dst backwards, etc.

Somehow, it works.
Work on whole image, not just .text

Now loads the whole image with all its sections at their respective
virtual addresses, instead of just the .text section.

We now try to disassemble any section that is flagged as code, starting
from the entry point. Images with .text,.itext merged section should now
work.

We still can't detect basic stuff like noreturn functions, so we might
still end up reading data as code. Next step marking all obvious
references to data to avoid trying to disassemble those later.
Disable analysis, add simple data detection

Add a simple detection of data to the disassembler : An address
referenced in a MOV Zv Iv instruction, but not referenced by a branching
instruction will be marked as possible data, and we won't attempt to
decompile it.

Also disables the separate analysis (branches list, jump flow graph)
since the simple inplace substitution isn't using them.

We still can't detect noreturn functions, but if there's referenced data
after the noreturn call, we might still detect it and stop.
Add option to encrypt a section

Add option "-e sectionName" that will encrypt a section (currently a
simple xor, since it shouldn't be too suspicious. Everyone uses xor for
everything).

It picks a decryptor template (currently only 2 available : one not
obfuscated and not too suspicious, and one that obfuscates the original
entry point a little), and fills the gaps.

The key is always random, and some decryptor templates can have other
random elements as well, so the resulting code never has the same
checksum.

Note that this is only intended to block simple static analysis, not to
be a FUD polymorphic crypter, any AV for example could just sandbox us
until we finish decrypting ourselves.

The purpose it to have a basic checksum-breaking algorythm on the data,
since we can already use substitutions on the code.

The decryptor is in its own section, and flagged as the new entry point.

Almost all the pointers to the virtual image were replaced by offsets.
We can now add sections to the image, but this requires a realloc of the
data and virtual image.
General update, add new transform

Add Shuffle transform.
Improve Disassembler a lot.
Misc fixes and improvments.
Polymorphism is now considered harmful and may crash at runtime due to
design decisions.  May be dangerous on non-trivial objects.
Update .gitignore
Merge branch 'master' of https://github.com/tux3/Ditto