Reverse engineered code for Microsoft's WARBIRD obfuscator
Microsoft developed Warbird to obfuscate different system components, mostly relating to DRM and licensing.
Warbird code has even been integrated into the kernel to obfuscate components (ci, peauth, clipsp, etc).
Warbird can support different forms of code obfuscation like:
- virtual machine obfuscation
- section encryption/packing (labeled
PAGEwxsections which are excluded from PatchGuard) - constant obfuscation
- runtime code execution on the heap (
SystemControlFlowTransitioninfo class forNtQuerySystemInformationsystem call)
Some system images that are publicly known to use Warbird are:
ci.dllclipsp.syspeauth.sysntoskrnl.exeClipSVC.dllClipUp.exeWindows.Media.Protection.PlayReady.dllGenValObj.exeManageCI.dll
There are other images that make calls to NtQuerySystemInformation passing the SystemPolicyInformation info class that rely on the Warbird Feistel cipher to encrypt/decrypt parameters.
The call stack of those calls generally look like:
nt!SpCall2ServerInternal -> nt!g_kernelCallbacks -> clipsp.sys!ClipSp*.
More information can be found on that here.
WarbirdRuntime::CTerminationWarbirdRuntime::CMemoryAllocator::CBlockWarbirdRuntime::CEncryptionWarbirdRuntime::CPrivateRelocationsTableWarbirdRuntime::CHeapExecutionWarbirdRuntime::AutoEnableDynamicCodeGenWarbirdRuntime::CUtilWarbirdRuntime::CRWLockWarbirdRuntime::CMemoryProtectionChangeHelperWarbirdRuntime::WarbirdRuntime__HEAP_EXECUTION_CALL_ARGUMENTSWarbirdRuntime::WarbirdRuntime__HEAP_EXECUTION_CONDITIONAL_BRANCH_ARGUMENTSWarbirdRuntime::ENCRYPTED_SEGMENT_DATA_CONSTWarbirdRuntime::ENCRYPTED_SEGMENT_DATA_READ_WRITEWarbirdRuntime::RuntimeInitWarbirdRuntime::NewEntryMain
The project cannot be used as-is and is merely intended to be used for educational purposes to further public understanding.
Warbird cannot be integrated into personal projects since the actual runtime dlls are not present.
A custom Warbird obfuscator toolset could be partially integrated by passing the /wbrddll: MSVC compiler flag and exporting the GetObfuscator and CreateObfuscator2 routines.
UPDATE: As of 6/11/24, it is possible to integrate the leaked warbird.dll to build applications.
The project could be loosely modified to support calls to NtQuerySystemInformation with the SystemPolicyInformation class but you would have to reimplement the cipher, get the encryption/decryption keys, etc... :)