-
-
[分享]某团间接跳转混淆还原
-
发表于: 2023-3-27 16:35
-
前阵子分析某团，so层有比较重的混淆，除了一些简单的可整体nop的花指令以外，还有大量的间接跳转混淆（原理参考https://github.com/amimo/goron），刚好前阵子在龙哥那学了几招，三下五除二，就把间接跳转处理干净了，这里做个脚本分享：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 | import keystoneimport ida_bytesimport ida_idaimport ida_segmentimport ida_uaimport idaapiimport idautilsimport idc# 初始化汇编器的架构和模式ks = keystone.Ks(keystone.KS_ARCH_ARM64, keystone.KS_MODE_LITTLE_ENDIAN)def getAddrRange(): start = ida_ida.inf_get_min_ea() size = ida_ida.inf_get_max_ea() - start # 将地址范围限定于text节 for seg in idautils.Segments(): seg = idaapi.getseg(seg) segName = ida_segment.get_segm_name(seg) if segName == ".text": start = seg.start_ea size = seg.size() return start, sizedef binSearch(start, end, pattern): matches = [] addr = start if end == 0: end = idc.BADADDR if end != idc.BADADDR: end = end + 1 while True: addr = ida_bytes.bin_search(addr, end, bytes.fromhex(pattern), None, idaapi.BIN_SEARCH_FORWARD, idaapi.BIN_SEARCH_NOCASE) if addr == idc.BADADDR: break else: matches.append(addr) addr = addr + 1 return matchesdef generate(code, addr): encoding, _ = ks.asm(code, addr) return encoding# 不一定全，可以碰到再处理full_nop_list = [ "FF0301D1E0FB00A90100009480000010FE0300AAFF030191C0035FD6E0FB7CA9", "FFC300D1E07B01A90100009480000010FE0300AAFFC30091C0035FD6E07B7EA9", "FF4301D1E07B02A90100009480000010FE0300AAFF430191C0035FD6E07B7DA9", "FF4301D1E0FB00A90100009480000010FE0300AAFF430191C0035FD6E0FB7BA9", "FF4301D1E0FB01A90100009480000010FE0300AAFF430191C0035FD6E0FB7CA9", "E0FB3EA90100009460000010FE0300AAC0035FD6E0FB7EA9", "E07B3EA90100009460000010FE0300AAC0035FD6E07B7EA9", "E07B3FA90100009460000010FE0300AAC0035FD6E07B7FA9"]for i in range(len(full_nop_list)): matches = binSearch(0, 0, full_nop_list[i]) for matche in matches: print("flower" + str(i) + ":", hex(matche)) nopCode = generate("nop", 0) ida_bytes.patch_bytes(matche, bytes(nopCode) * int(len(full_nop_list[i]) / 8))# 获取代码段的起始地址和长度start, size = getAddrRange()insn = ida_ua.insn_t()indirect_jump_addr = []for i in range(0, size, 4): addr = start + i # decode_insn 返回长度，ARM64即4，无法解析则返回0 if idaapi.decode_insn(insn, addr): mnemonic = insn.get_canon_mnem() if mnemonic == "BL" and insn.Op1.addr == 0x14DFC: indirect_jump_addr.append(addr) # print(hex(addr))for i in range(0, size, 4): addr = start + i # decode_insn 返回长度，ARM64即4，无法解析则返回0 if idaapi.decode_insn(insn, addr): mnemonic = insn.get_canon_mnem() local_addr = insn.Op1.addr if mnemonic == "B" and local_addr in indirect_jump_addr: firstinsn = ida_ua.insn_t() idaapi.decode_insn(firstinsn, addr - 4) if firstinsn.get_canon_mnem() == 'MOV': value = firstinsn.Op2.value elif firstinsn.get_canon_mnem() == 'LDR': value = ida_bytes.get_dword(firstinsn.Op2.addr) else: print("需要额外处理") offset_addr = local_addr + 4 + 4 * value target_addr = local_addr + 4 + ida_bytes.get_dword(offset_addr) print("flower_indirect local_addr",hex(addr),"target_addr",hex(target_addr)) code = f"B {hex(target_addr)}" bCode = generate(code, addr) ida_bytes.patch_bytes(addr, bytes(bCode)) |
最后放一下龙哥星球的邀请链接~IDA脚本反混淆系列文章真心赞！
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
