Add operator randomizer for xor obfuscator

internal/literals/obfuscators.go

@@ -4,6 +4,7 @@ import (
 	cryptrand "crypto/rand"
 	"fmt"
 	"go/ast"
+	"go/token"
 	mathrand "math/rand"
 	"os"
 	"strings"
@@ -51,3 +52,42 @@ func genRandIntSlice(max, count int) []int {
 	}
 	return indexes
 }
+
+var allOperators = []token.Token{token.XOR, token.ADD, token.SUB}
+
+func genRandOperator() token.Token {
+	return allOperators[mathrand.Intn(len(allOperators))]
+}
+
+func evalOperator(t token.Token, x, y byte) byte {
+	switch t {
+	case token.XOR:
+		return x ^ y
+	case token.ADD:
+		return x + y
+	case token.SUB:
+		return x - y
+	default:
+		panic("unknown operator")
+	}
+}
+
+func getReversedOperator(t token.Token, x, y ast.Expr) *ast.BinaryExpr {
+	expr := &ast.BinaryExpr{
+		X: x,
+		Y: y,
+	}
+
+	switch t {
+	case token.XOR:
+		expr.Op = token.XOR
+	case token.ADD:
+		expr.Op = token.SUB
+	case token.SUB:
+		expr.Op = token.ADD
+	default:
+		panic("unknown operator")
+	}
+
+	return expr
+}

internal/literals/xor.go

@@ -16,8 +16,9 @@ func (x xor) obfuscate(data []byte) *ast.BlockStmt {
 	key := make([]byte, len(data))
 	genRandBytes(key)
 
+	op := genRandOperator()
 	for i, b := range key {
-		data[i] = data[i] ^ b
+		data[i] = evalOperator(op, data[i], b)
 	}
 
 	return &ast.BlockStmt{List: []ast.Stmt{
@@ -40,11 +41,7 @@ func (x xor) obfuscate(data []byte) *ast.BlockStmt {
 				&ast.AssignStmt{
 					Lhs: []ast.Expr{ah.IndexExpr("data", ah.Ident("i"))},
 					Tok: token.ASSIGN,
-					Rhs: []ast.Expr{&ast.BinaryExpr{
-						X:  ah.IndexExpr("data", ah.Ident("i")),
-						Op: token.XOR,
-						Y:  ah.Ident("b"),
-					}},
+					Rhs: []ast.Expr{getReversedOperator(op, ah.IndexExpr("data", ah.Ident("i")), ah.Ident("b"))},
 				},
 			}},
 		},

testdata/scripts/literals.txt

@@ -36,8 +36,8 @@ cmp stderr normal.stderr
 
 # Check obfuscators
 
-# Xor obfuscator. Detect a[i] = a[i] ^ b[i]
-grep '^\s+\w+\[\w+\] = \w+\[\w+\] \^ \w+$' .obf-src/main/z0.go
+# Xor obfuscator. Detect a[i] = a[i] (^|-|+) b[i]
+grep '^\s+\w+\[\w+\] = \w+\[\w+\] [\^\-+] \w+$' .obf-src/main/z0.go
 
 # Swap obfuscator. Detect [...]byte|uint16|uint32|uint64{...}
 grep '^\s+\w+ := \[\.{3}\](byte|uint16|uint32|uint64)\{[0-9\s,]+\}$' .obf-src/main/z0.go