Professional Documents
Culture Documents
Deobfuscator:
Math on EDX
Resolves to:
Emulate Result
NOP
Unnecessary
Instructions
Obfuscated Pop
Unref’d Instruction
Obfuscated Jump
Obfuscated Push
Obfuscated Jump
Obfuscated Jump
After Deobfuscation:
NOP’d Jumps
EDX = 401033
After Deobfuscation:
Emulated
Result
NOP’d Pop &
Math
EAX Math
After Deobfuscation:
Emulated
Result
NOP’d Math
After Deobfuscation:
NOP’d Math
Before Deobfuscation:
EDX Math
POP EDX
After Deobfuscation:
… NOP’d Math
After Deobfuscation:
Emulated
Result
EDX Math
After Deobfuscation:
Emulated
Result
NOP’d Move
OB Jump
After Deobfuscation:
Jump Resolved
• Two matching
patterns
– JNZ_JZ
– JMP_INTO_INSTR
• Two matching
patterns
– JNZ_JZ
– JMP_INTO_INSTR
• The result is a better
control flow graph
…
Same
Destination
After Deobfuscation:
Unconditional
… Jump
EB FF E0
Before Deobfuscation:
Jump One Byte
EB FF E0
After Deobfuscation:
Real Jump
• Unreferenced instructions
• One matching pattern
– MOV_JMP
OB Jump
After Deobfuscation:
Jump Resolved
New Code
Region Defined
ECX Unused
After Deobfuscation:
NOP’d Move /
Encountered
Retn
After Deobfuscation:
Emulated
Result
After Deobfuscation:
NOP’d Move
NOP’d Move
Deobfuscated!
A Simple Problem:
return 1;
}
}
return 0;
}
• Grammar
• Iterative patching of IDA database
• Black-box control flow
• Code Collapsing
• Visit us online:
http://www.rri-usa.org/isrsoftware.html
RIVERSIDE RESEARCH INSTITUTE