Self-modifying Code de-obfuscation
[1] decoder(0x8048e91,0x8048ea8,0x18)
[2] decoder(0x8048f0e,0x8048f25,0x21)
[3] decoder(0x8049774,0x804978b,0x9b)
[4] decoder(0x804a025,0x804a03c,0x8e)
[5] decoder(0x8049085,0x804909c,0xf3)
[6] decoder(0x8049981,0x8049998,0x8f)
[7] decoder(0x8048d97,0x8048dae,0x9c)
[8] decoder(0x8049d1e,0x8049d35,0xfd)
[9] decoder(0x80492dd,0x80492f4,0x81)
[10] decoder(0x804af48,0x804af5f,0x6a)
[11] decoder(0x804ac73,0x804ac8a,0xb)
[12] decoder(0x804a3c2,0x804a3d9,0x2d)
[13] decoder(0x804a59d,0x804a5b4,0x8)
[14] decoder(0x8049102,0x8049119,0x96)
[15] decoder(0x804a183,0x804a19a,0x4f)
[16] decoder(0x8048964,0x804897b,0x4d)
[17] decoder(0x804ac0f,0x804ac26,0xf7)
[18] decoder(0x804b010,0x804b027,0x9a)
[19] decoder(0x804ad86,0x804ad9d,0x67)
[20] decoder(0x80485c7,0x80485de,0x3f)
[21] decoder(0x804a840,0x804a857,0x63)
[22] decoder(0x804881f,0x8048836,0x3d)
[23] decoder(0x80495fd,0x8049614,0xcf)
[24] decoder(0x804a8bd,0x804a8d4,0x8b)
[25] decoder(0x80487ed,0x8048804,0x70)
[26] decoder(0x8049742,0x8049759,0x69)
[27] decoder(0x8048a2c,0x8048a43,0x60)
[28] decoder(0x80482f2,0x8048309,0x17)
[29] decoder(0x804a9b7,0x804a9ce,0xab)
[30] decoder(0x80489c8,0x80489df,0x6f)
[31] decoder(0x80491fc,0x8049213,0xc9)
[32] decoder(0x804a520,0x804a537,0xfb)
[33] decoder(0x8049855,0x804986c,0xc7)
[34] decoder(0x804862b,0x8048642,0x6d)
[35] decoder(0x804adb8,0x804adcf,0x13)
[36] decoder(0x804830b,0x8048322,0xfc)
[37] decoder(0x804aa66,0x804aa7d,0xe8)
[38] decoder(0x804a4a3,0x804a4ba,0x6a)
[39] decoder(0x8048e14,0x8048e2b,0x98)
[40] decoder(0x804980a,0x8049821,0x13)
[41] decoder(0x8048531,0x8048548,0x78)
[42] decoder(0x80491e3,0x80491fa,0x5d)
[43] decoder(0x804914d,0x8049164,0xf4)
[44] decoder(0x804ad6d,0x804ad84,0xeb)
[45] decoder(0x80496c5,0x80496dc,0x6e)
[46] decoder(0x8049db4,0x8049dcb,0x2d)
[47] decoder(0x804a9d0,0x804a9e7,0x4e)
[48] decoder(0x8049a7b,0x8049a92,0x57)
[49] decoder(0x804a7dc,0x804a7f3,0x82)
[50] decoder(0x804909e,0x80490b5,0x91)
[51] decoder(0x80496de,0x80496f5,0x9e)
[52] decoder(0x8048aa9,0x8048ac0,0xab)
[53] decoder(0x8049b5c,0x8049b73,0x98)
[54] decoder(0x804b2f0,0x804b307,0x42)
[55] decoder(0x8049215,0x804922c,0x15)
[56] decoder(0x804894b,0x8048962,0x15)
[57] decoder(0x804a539,0x804a550,0x57)
[58] decoder(0x8048b58,0x8048b6f,0x85)
[59] decoder(0x8049c88,0x8049c9f,0xaa)
[60] decoder(0x80480b3,0x80480ca,0x4c)
[61] decoder(0x80499b3,0x80499ca,0xc7)
[62] decoder(0x8048612,0x8048629,0xc5)
[63] decoder(0x804b074,0x804b08b,0x6d)
[64] decoder(0x804b0bf,0x804b0d6,0x88)
[65] decoder(0x804ab47,0x804ab5e,0x1d)
[66] decoder(0x804b110,0x804b11d,0xd6)
[67] decoder(0x8049ff3,0x804a00a,0xac)
[68] decoder(0x804b029,0x804b040,0x10)
[69] decoder(0x8048900,0x8048917,0xd)
[70] decoder(0x80486a8,0x80486bf,0x90)
[71] decoder(0x80499fe,0x8049a15,0x96)
[72] decoder(0x8048211,0x8048228,0x65)
[73] decoder(0x80492ab,0x80492c2,0x50)
[74] decoder(0x8048f59,0x8048f70,0xc)
[75] decoder(0x804a151,0x804a168,0x65)
[76] decoder(0x8048c6b,0x8048c82,0xf5)
[77] decoder(0x804ad09,0x804ad20,0x59)
[78] decoder(0x804817b,0x8048192,0x7d)
[79] decoder(0x8048e5f,0x8048e76,0xec)
[80] decoder(0x8048c39,0x8048c50,0x83)
[81] decoder(0x804994f,0x8049966,0xd4)
[82] decoder(0x804b1f0,0x804b1fa,0x84)
[83] decoder(0x804a7f5,0x804a80c,0x31)
[84] decoder(0x804a1ce,0x804a1e5,0x4e)
[85] decoder(0x80493f0,0x8049407,0xc2)
[86] decoder(0x804a200,0x804a217,0xa3)
[87] decoder(0x804a633,0x804a64a,0xed)
[88] decoder(0x804849b,0x80484b2,0x2e)
[89] decoder(0x804a32c,0x804a343,0x83)
[90] decoder(0x80494ea,0x8049501,0x64)
[91] decoder(0x8049f5d,0x8049f74,0x55)
[92] decoder(0x804873e,0x8048755,0xf2)
[93] decoder(0x804a1e7,0x804a1fe,0x8c)
[94] decoder(0x80497bf,0x80497d6,0x69)
[95] decoder(0x804b270,0x804b27a,0xcb)
As you can see, there are some repetitive XoRs BBs in code:
Blocks in the code that I have missed the general pattern were as follow:
[1] JNZ instruction in \x804b2f4
[2] JMP instructions without any XOR MOV CMP chain
[3] Finally we stopped in this place :D
**Our next goal is to remove bogus/junk code
[*] At first we've made a MatchGraphJoker so as to be a representative of the detected pattern
[*] finally we can reach to this graph which we've remove junk codes by making edges between the predecessors of parent AsmCfG matched pattern to the successors of AsmCfG tails matched pattern.
**Generated CFG with fuzzing implementation in unpackMe.py file using simple MEMORY_ACCESS_VIOLATION handling by exploiting a dichotomy searchalgorithm like binary search :P / Actually, my goal was to somehow deducing input size by handling this exception as a constraint (next goal will be using SAT solver)
[*]Again using our AsmCFG simplifier but this this because of this we shouldset False restrict_in edges to middle node as well
And Finally we've got this CFG which is so simplified :D
flag is: Alph4t3stf0rc3mille!!!!!!!!!
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent