Awesome
WarBird Obfuscate
An analysis of WarBird obfuscation in the MSVC compiler
Disclaimer: This repository is not complete and will be continuously updated.
Background
WarBird is an obfuscation framework used by Microsoft in their DRM technology. It supports multiple forms of obfuscation including code packing and virtual-machine obfuscation. It is used to protect critical components such as PatchGuard and licensing information from reverse engineers.
WarBird functionality is also exposed through the NtQuerySystemInformation
system call when supplied with the SystemControlFlowTransition
(185) information class. It dispatches to WbDispatchOperation
where it supports functionality to decrypt and execute a signed feistel cipher payload on the heap. More information regarding it can be found in Alex Ionescu's talk. Other research has provided insight in its usage to protect client licensing and code integrity images.
Given its prevalent usage by Microsoft, one should be curious enough to investigate whether any references are found in the MSVC compiler. String references can be discovered in the backend compiler (c2.dll
) and linker (link.exe
) images.
In ProcessLinkerSwitches
, there are four linker flags related to WarBird: /wbrdcfg
, /wbrddll
, /wbrdlog
, and /wbrdschema
with options to test encryption or to provide a log schema.
If the configuration and dll WarBird linker flags are supplied during the building process of the executable then it will call Warbird::CWarbirdServer::CreateObfuscator2
. The routine will load the DLL supplied by the flag and call an exported function named CreateObfuscator2
with the linker flag arguments, the machine type and the obfuscator base.
Other WarBird function names reveals that there are code transformations similar to the ones mentioned earlier.
void __fastcall Enclave::CObfuscationEnclave::Initialize(Enclave::CObfuscationEnclave *this)
{
if ( (int)Enclave::CEnclave::AddRuntimeSymbol((__int64)this, (__int64)"NtQuerySystemInformation", 0, 2) >= 0
&& (int)Enclave::CEnclave::AddRuntimeSymbol((__int64)this, (__int64)"WarbirdRuntime::EnclaveWrapper", 1, 1) >= 0 )
{
Enclave::CEnclave::AddRuntimeSymbol((__int64)this, (__int64)"WarbirdRuntime::g_ulSubSystemCallID", 2, 3);
}
}
Example
cl /Zi .\example\main.cpp /link /wbrddll:warbird-obfuscate.dll /wbrdcfg:wbrd.cfg
Compiler Info
cl.exe: aa9374078fcdce84bca034fd1bb395fdd3825614656e898017435ced17ff1061
link.exe: 849e7bd1f234957b5e9be65f94a864e45ea4e05fea598b2164523b398603f615
- Version:
14.28.29336.0