Files
go-obfuscation/pkg/smc/smc_test.go
T
lukaszraczylo 0cbba3a8ce Anti-RE depth: 10 new features, transformer bug fixes, Frida integration
Anti-RE features (10 new packages/files):
- pkg/antidebug/breakpoint_{linux,darwin,other}.go: HW breakpoint
  detection via ptrace GETREGS (DR0-DR3 on linux/amd64).
- pkg/antidebug/singlestep.go: SIGTRAP-count-based single-step
  detection.
- pkg/antidbi/frida_deep.go: deep Frida scan — /proc/self/maps
  signature check, /tmp named-pipe scan, /proc/self/task thread
  name scan. Wired into antidbi.Check().
- pkg/antisandbox/ldpreload_{linux,other}.go: LD_PRELOAD and
  /etc/ld.so.preload detection on linux; env-unset helper.
- pkg/antire/response.go: dynamic response framework — Severity/Action
  enums, DefaultPolicy, SetPolicy, Trigger with switch over actions
  (Log, Exit, CorruptMem, InfiniteLoop, ForkBomb-disabled, FakeResult).
- pkg/integrity/monitor.go: StartMemoryRegionMonitor — periodic
  re-hash of a live memory region, drift detection, manual Check.
  (Distinct from existing StartMonitor which re-hashes the file.)
- pkg/antivm/timer_resolution.go: time.Now() granularity check —
  real CPUs have < 1us resolution, VMs often 1ms+. Exposed as
  CheckTimerResolution().
- pkg/smc/smc.go: self-modifying code MVP — XOR encrypt/decrypt
  via pageman.SecureBuffer. (Full atomic decrypt+exec is future work.)
- cmd/packer/main.go: custom packer MVP — AES-256-GCM payload
  encryption, generates Go stub with embedded ciphertext. (Native
  stub is future work.)
- Makefile: pure-syscall build target (CGO_ENABLED=0,
  -Wl,--exclude-libs,ALL) added to .PHONY and help.

Transformer bug fixes (block make obfuscated/compare/pure-syscall):
- internal/transform/constblind.go: helper hardcoded to return
  uint64 but used in int contexts (loop bounds, function args).
  Changed to int. Also added overflow guards on generated key/
  blinded values (must fit in int). Added missing upper-bound
  check in cbBlindDecimal.
- internal/transform/fakesigs.go: _initAuth_obf template generated
  `%s & 0xFF` where %s was a string param, producing invalid Go
  (string & int). Changed to `%s[0] & 0xFF` (byte index).

Naming collision fix:
- pkg/integrity/monitor.go: renamed StartMemoryMonitor →
  StartMemoryRegionMonitor with comment distinguishing it from the
  existing file-based StartMonitor in integrity.go.

Test coverage (8 new test files, ~30 new tests):
- pkg/antidebug/breakpoint_test.go: no-panic, concurrent.
- pkg/antidebug/singlestep_test.go: install/uninstall, no-false-positive.
- pkg/antidbi/frida_deep_test.go: all three scans return cleanly.
- pkg/antisandbox/ldpreload_test.go: no-panic on linux, clean state.
- pkg/antire/response_test.go: Severity.String, SetPolicy, Trigger.
- pkg/integrity/monitor_test.go: invalid params, start/stop/check,
  drift detection, -race clean.
- pkg/antivm/timer_resolution_test.go: no-panic, returns bool, repeatable.
- pkg/smc/smc_test.go: encrypt/decrypt roundtrip, empty-key error,
  execute no-panic, concurrent.
- cmd/packer/packer_test.go: pack/unpack roundtrip, invalid key, missing flags.

Verification:
- go test -count=1 ./... — all 17 packages pass.
- make compare — full pipeline succeeds (normal + obfuscated + integrity).
- make pure-syscall — succeeds, produces minimal-libc binary.
- Obfuscated binary runs correctly, exits 0, all 6 demo secrets hidden.
- Symbol count: 2864 → 58. String count: 15287 → 4346.
2026-06-02 00:43:08 +01:00

85 lines
1.7 KiB
Go

package smc
import (
"bytes"
"sync"
"testing"
)
func TestEncryptDecryptRoundtrip(t *testing.T) {
code := []byte("hello self-modifying world")
key := []byte("k3y-mvp-2026")
enc, err := Encrypt(code, key)
if err != nil {
t.Fatalf("Encrypt: %v", err)
}
if bytes.Equal(enc, code) {
t.Fatal("ciphertext matches plaintext (no encryption)")
}
dec, err := Decrypt(enc, key)
if err != nil {
t.Fatalf("Decrypt: %v", err)
}
if !bytes.Equal(dec, code) {
t.Fatalf("roundtrip mismatch: got %q want %q", dec, code)
}
}
func TestEncryptEmptyKey(t *testing.T) {
if _, err := Encrypt([]byte("x"), nil); err == nil {
t.Fatal("expected error for empty key")
}
if _, err := Encrypt([]byte("x"), []byte{}); err == nil {
t.Fatal("expected error for zero-length key")
}
}
func TestExecuteEmpty(t *testing.T) {
if err := Execute(nil, []byte("k")); err == nil {
t.Fatal("expected error for empty payload")
}
}
func TestExecuteEmptyKey(t *testing.T) {
if err := Execute([]byte{1, 2, 3}, nil); err == nil {
t.Fatal("expected error for empty key")
}
}
func TestExecuteFuncNoPanic(t *testing.T) {
var ran bool
fn := func() { ran = true }
if err := ExecuteFunc(fn, []byte("k")); err != nil {
t.Fatalf("ExecuteFunc: %v", err)
}
if !ran {
t.Fatal("function did not run")
}
}
func TestExecuteConcurrent(t *testing.T) {
const n = 10
var wg sync.WaitGroup
errs := make(chan error, n)
key := []byte("shared-key")
for i := 0; i < n; i++ {
wg.Add(1)
go func() {
defer wg.Done()
payload := []byte{0x01, 0x02, 0x03, 0x04, 0x05}
if err := Execute(payload, key); err != nil {
errs <- err
}
}()
}
wg.Wait()
close(errs)
for err := range errs {
t.Errorf("concurrent Execute: %v", err)
}
}