[原创] 实战去除安卓应用中的多种混淆-Android安全-看雪安全社区

之前写过了混淆pass和去除案例，但多为windows上的一些样本，所以这篇文章写了三个安卓去混淆案例

## 案例1

应用为小*书，版本是目前最新（936084）

目标去除函数是`sub_81CC4`函数，这是sheid生成算法中比较关键的一个函数，但被大量复杂混淆，无法分析其中逻辑。我们以它为例，演示如何去除这种混淆

在之前的文章中使用idc脚本自动断点的方式来处理间接跳转，安卓逆向中可以使用firda来代替。

先用idc脚本搜集想要hook的跳转地址和寄存器

```c++
#include <idc.idc>

static main()
{
    auto seg;
    for (seg = get_first_seg(); seg != BADADDR; seg = get_next_seg(seg))
    {
        auto seg_name = get_segm_name(seg);
        if (seg_name == ".text")
        {
            auto current_addr = seg;
            auto end_addr = get_next_seg(seg);
            auto lower_op;
            while (current_addr != BADADDR && current_addr < end_addr)
            {
                auto insn_name = print_insn_mnem(current_addr);
                auto op = print_operand(current_addr,0);
                if(insn_name == "BR" && strstr(op,"X") != -1)
                {
                    auto fp = fopen("indirect_jmp.txt", "a");
                    lower_op = tolower(op);
                    fprintf(fp, "{ off: 0x%X, reg : \"%s\"},\n", current_addr, lower_op);
                    fclose(fp);
                }
                current_addr = next_head(current_addr, end_addr);
            }
        }
    }
    msg("success");
}
```

再写firda脚本hook值即可

```js
function hex(num)
{
    if(typeof num === "number")
    {
        return "0x" + num.toString(16);
    }
    return ptr(num).toString();
}

function getContextRegister(context, reg) {
    if (reg === "x30") {
        return context.lr;
    }
    return context[reg];
}

setImmediate(main);
```

部分输出如下

```
1 0x81d88 -> 0x831e8
2 0x831f4 -> 0x831f8
3 0x83230 -> 0x831e8
4 0x831f4 -> 0x8349c
5 0x834d4 -> 0x831c8
6 0x831e4 -> 0x82e20
7 0x82e2c -> 0x82f64
8 0x82fe0 -> 0x81d8c
9 0x81d98 -> 0x82080
10 0x82118 -> 0x83a18
11 0x83a34 -> 0x835ac
12 0x835b8 -> 0x83884
13 0x83904 -> 0x82e20
14 0x82e2c -> 0x83190
15 0x831c4 -> 0x8295c
16 0x81d88 -> 0x831e8
17 0x831f4 -> 0x831f8
18 0x82968 -> 0x82c68
19 0x82cfc -> 0x83a18
20 0x83a34 -> 0x835ac
21 0x835b8 -> 0x835fc
22 0x83230 -> 0x831e8
23 0x831f4 -> 0x8349c
24 0x83688 -> 0x831c8
25 0x834d4 -> 0x831c8
26 0x831e4 -> 0x82e20
27 0x831e4 -> 0x82e20
28 0x82e2c -> 0x82e30
29 0x82e2c -> 0x82f64
30 0x81d88 -> 0x831e8
31 0x82ea4 -> 0x81f68
32 0x81f74 -> 0x822d8
33 0x82334 -> 0x83b08
34 0x831f4 -> 0x831f8
35 0x82fe0 -> 0x81d8c
36 0x81d98 -> 0x82080
37 0x83b24 -> 0x83a38
38 0x83230 -> 0x831e8
39 0x831f4 -> 0x8349c
40 0x834d4 -> 0x831c8
41 0x831e4 -> 0x82e20
42 0x83a44 -> 0x83b28
43 0x82118 -> 0x83a18
44 0x82e2c -> 0x82f64
45 0x82fe0 -> 0x81d8c
46 0x83a34 -> 0x835ac
47 0x835b8 -> 0x83884
48 0x81d98 -> 0x82080
49 0x82118 -> 0x83a18
50 0x83bb0 -> 0x831e8
51 0x831f4 -> 0x833f4
52 0x81d88 -> 0x831e8
53 0x831f4 -> 0x831f8
54 0x81d88 -> 0x831e8
55 0x831f4 -> 0x831f8
56 0x81d88 -> 0x831e8
57 0x831f4 -> 0x831f8
58 0x83904 -> 0x82e20
59 0x83230 -> 0x831e8
60 0x83a34 -> 0x835ac
61 0x83230 -> 0x831e8
62 0x83498 -> 0x8295c
63 0x82968 -> 0x8296c
64 0x82a14 -> 0x8295c
65 0x831f4 -> 0x8349c
66 0x834d4 -> 0x831c8
67 0x831f4 -> 0x8349c
68 0x83230 -> 0x831e8
69 0x82e2c -> 0x83190
70 0x831c4 -> 0x8295c
71 0x835b8 -> 0x83884
72 0x831e4 -> 0x82e20
73 0x834d4 -> 0x831c8
74 0x831f4 -> 0x8349c
75 0x834d4 -> 0x831c8
76 0x82968 -> 0x82c68
77 0x83904 -> 0x82e20
78 0x81d88 -> 0x831e8
79 0x831f4 -> 0x831f8
80 0x831e4 -> 0x82e20
81 0x82e2c -> 0x82f64
82 0x831e4 -> 0x82e20
83 0x82cfc -> 0x83a18
84 0x83a34 -> 0x835ac
85 0x82e2c -> 0x82f64
86 0x83230 -> 0x831e8
87 0x82968 -> 0x82bec
88 0x82fe0 -> 0x81d8c
89 0x81d98 -> 0x82080
90 0x82e2c -> 0x83190
91 0x831c4 -> 0x8295c
92 0x82968 -> 0x82c68
93 0x82cfc -> 0x83a18
94 0x83a34 -> 0x835ac
95 0x82fe0 -> 0x81d8c
96 0x81d88 -> 0x831e8
97 0x831f4 -> 0x831f8
98 0x83230 -> 0x831e8
99 0x831f4 -> 0x8349c
100 0x834d4 -> 0x831c8
```

这个表同时也是执行跳转的顺序，对接下来的恢复很有帮助。

得到跳转表之后，因为循环比较多，所以对跳转表进行一个去重，最后只剩下100条跳转地址

```
0x82c64 -> 0x81d8c
0x82e2c -> 0x83190
0x83d0c -> 0x8293c
0x8285c -> 0x82860
0x8207c -> 0x831e8
0x81d98 -> 0x81d9c
0x82e1c -> 0x8295c
0x83c50 -> 0x83d10
0x833f0 -> 0x8293c
0x81f74 -> 0x82880
0x81d98 -> 0x8211c
0x83880 -> 0x83a38
0x831f4 -> 0x834d8
0x83c50 -> 0x83c54
0x83a44 -> 0x83bb4
0x82e2c -> 0x82e30
0x82e2c -> 0x82ea8
0x83b04 -> 0x83b08
0x81d98 -> 0x821e0
0x81ea4 -> 0x8293c
0x82b08 -> 0x81f68
0x82968 -> 0x82d00
0x82dfc -> 0x81f68
0x82958 -> 0x81d8c
0x82334 -> 0x83b08
0x81d88 -> 0x831e8
0x83ea4 -> 0x83a18
0x82968 -> 0x82a18
0x835b8 -> 0x835fc
0x83338 -> 0x835ac
0x82e2c -> 0x82f64
0x83a44 -> 0x83f5c
0x8287c -> 0x83c44
0x835f8 -> 0x81f68
0x82968 -> 0x82c68
0x81f64 -> 0x81f68
0x83a44 -> 0x83bf8
0x81f74 -> 0x824bc
0x81d98 -> 0x82080
0x831f4 -> 0x8349c
0x82e2c -> 0x82fe4
0x83688 -> 0x831c8
0x822d4 -> 0x82e00
0x824b8 -> 0x831c8
0x83904 -> 0x82e20
0x83a14 -> 0x82860
0x83498 -> 0x8295c
0x82968 -> 0x82b2c
0x82fe0 -> 0x81d8c
0x835b8 -> 0x83790
0x83b24 -> 0x83a38
0x82968 -> 0x82bec
0x82118 -> 0x83a18
0x81f74 -> 0x8277c
0x831f4 -> 0x831f8
0x83a34 -> 0x835ac
0x835b8 -> 0x83884
0x82cfc -> 0x83a18
0x83a44 -> 0x83b28
0x831c4 -> 0x8295c
0x83dfc -> 0x831e8
0x81f74 -> 0x82338
0x835b8 -> 0x8368c
0x82778 -> 0x831e8
0x83a44 -> 0x83a48
0x83a44 -> 0x83ea8
0x81d98 -> 0x82028
0x81d98 -> 0x81ea8
0x82e2c -> 0x8309c
0x8318c -> 0x83a18
0x83c40 -> 0x83c44
0x82a14 -> 0x8295c
0x82be8 -> 0x83b08
0x83f58 -> 0x82e20
0x831f4 -> 0x833f4
0x8285c -> 0x831e8
0x83230 -> 0x831e8
0x82938 -> 0x83b08
0x83c50 -> 0x83e00
0x835b8 -> 0x83908
0x83bb0 -> 0x831e8
0x821dc -> 0x8295c
0x82b28 -> 0x81f68
0x83c50 -> 0x84058
0x83bf4 -> 0x835ac
0x835b8 -> 0x835bc
0x81f74 -> 0x822d8
0x82968 -> 0x8296c
0x83594 -> 0x83a38
0x83098 -> 0x8293c
0x82f60 -> 0x82860
0x831f4 -> 0x83234
0x82ea4 -> 0x81f68
0x831f4 -> 0x8333c
0x8378c -> 0x8295c
0x84054 -> 0x82b0c
0x834d4 -> 0x831c8
0x831e4 -> 0x82e20
0x81f74 -> 0x81f78
0x82024 -> 0x82e20
```

从第一个跳转地址开始看起，

```
0x81d88 -> 0x831e8
```

`0x831e8`对应的跳转地址是`0x831F4`

但是观察去重后的跳转表，`0x831F4`会跳到多个不同地址。这样无法找出唯一对应的地址。而这处跳转的计算和寄存器`x27`有关

![](upload/attach/202607/1008445_B9NV5K66PRUHQJ5.png)

返回`0x81d88`处观察x27

![](upload/attach/202607/1008445_8QSFJ752NS5BDT9.png)

x27是定值，最终跳转的肯定也是一个唯一固定的地址。再观察顺序跳转表

```
1 0x81d88 -> 0x831e8
2 0x831f4 -> 0x831f8
......
16 0x81d88 -> 0x831e8
17 0x831f4 -> 0x831f8
```

由此可以得到最终跳转关系为：0x81d88 -> 0x831e8 -> 0x831f8

`0x831e8`这个块只是一个分发块，没有实际作用，所以这其实是一种控制流平坦化 + 间接跳转混淆

接下来继续找类似这种结构的跳转关系

跳入分发块：

```
0x81d88 -> 0x831e8
0x83dfc -> 0x831e8
0x82778 -> 0x831e8
0x8285c -> 0x831e8
0x83230 -> 0x831e8
0x83bb0 -> 0x831e8
```

跳出分发块：

```
0x831f4 -> 0x834d8
0x831f4 -> 0x8349c
0x831f4 -> 0x831f8
0x831f4 -> 0x833f4
0x831f4 -> 0x83234
0x831f4 -> 0x8333c
```

实际执行顺序

```
0x81d88 -> 0x831e8
0x831f4 -> 0x831f8

0x83dfc -> 0x831e8
0x831f4 -> 0x8333c

0x82778 -> 0x831e8
0x831f4 -> 0x83234

0x8285c -> 0x831e8
0x831f4 -> 0x833f4

0x83230 -> 0x831e8
0x831f4 -> 0x8349c

0x83bb0 -> 0x831e8
0x831f4 -> 0x833f4
```

这样就可以得到最终的执行顺序：

```
0x81d88 -> 0x831f8
0x83dfc -> 0x8333c
0x82778 -> 0x83234
0x8285c -> 0x833f4
0x83230 -> 0x8349c
0x83bb0 -> 0x833f4
```

写一个脚本批量重复这个过程即可得到真实跳转关系

不过在这个过程中我们可以发现神奇的一点

![](upload/attach/202607/1008445_SC8ARA9GNCJQEEF.png)

最终跳转的地址就是上面赋值用来计算的地址。这样的话都不需要根据trace表来分析， 直接根据特征写脚本patch就可以了（~~谜底就在谜面上这一块~~）

搞定了这种fla + idr的A -> 分发块 -> B跳转关系，还有多目标块A -> B -> C / A -> B -> D需要修复，这种是因为条件跳转导致的

![](upload/attach/202607/1008445_NXEKUHWS8URJGM3.png)

上面的两个函数是要跳转的目标，条件是NE，但是我们很难确定哪个是满足条件后的跳转目标，这个时候可以再trace一遍。因为这个混淆中所有的条件跳转结尾都是

hook打印这个地方的值

```
0x82fd8 w8=0x7e2fa2f8 w30=0x7e2fa2f8
0x82fe0 -> 0x81d8c
```

w8和w30相同，说明不满足NE

观察顺序跳转表

```
0x82fe0 -> 0x81d8c
0x81d98 -> 0x82080
```

不满足NE条件时最终会跳到`0x82080`这个函数

可知B.NE 0x84058  B 0x82080

这样两种混淆就全部解决了。

去混淆后的部分代码如下

![](upload/attach/202607/1008445_9T4ZKS99DCP7YRH.png)

逻辑清晰，可识别出算法

## 案例2

应用为*幸咖啡，版本是网上找的一个旧版

以md5算法的外层函数为示例。

观察cfg图，可以看出明显是控制流平坦化

![](upload/attach/202607/1008445_5G7RW4CWAYJ35FS.png)

去除控制流平坦化只有三步
1.计算基本块下一跳转块的case值

2.遍历分发块找到对应地址

3.patch

先来看一下基本块和分发块的特征

**基本块**

单后继

```
MOV             W9, #0x3E04
STUR            X0, [X29,#var_20]
MOVK            W9, #0xBE87,LSL#16
```

双后继

```
MOV             W9, #0x5C511C13
CMP             X8, #0
MOV             W8, #0x1B0C631C
CSEL            W9, W8, W9, EQ
```

**分发块**

```
MOV             W9, #0x8ECCC728
CMP             W8, W9
B.EQ            loc_4411C
```

或

```
MOV             W9, #0xF8D34334
CMP             W8, W9
MOV             W9, #0xFF680FE2
B.EQ            loc_43C34
```

如果用同一种LLVM Pass来混淆函数的话，汇编层面往往指令相同。

简单观察特征之后就可以发现，这个函数基本块单后继都是`mov + stur + movk`的这种结构，多后继块都是`cesl + b`的结构（多后继的典型特征就是csel / cmov 汇编），所以根据特征不难定位后继块，可以写一个脚本提取出case值和跳转地址

```c++
#include <idc.idc>

static cmpInsn(current_addr,target_insn,target_op1,target_op2,target_op3)
{
    auto res = 1;
    if(target_insn != 0)
    {
        auto insn_name = print_insn_mnem(current_addr);
        if(insn_name != target_insn)
        {
            res = 0;
        }
    }
    if(target_op1 != 0)
    {
        auto op1 = print_operand(current_addr,0);
        if(op1 != target_op1)
        {
            res = 0;
        }
    }
    if(target_op2 != 0)
    {
        auto op2 = print_operand(current_addr,1);
        if(op2 != target_op2)
        {
            res = 0;
        }
    }
    if(target_op3 != 0)
    {
        auto op3 = print_operand(current_addr,2);
        if(op3 != target_op3)
        {
            res = 0;
        }
    }
    return res;
}

static calCaseVal(current_addr,end_addr)
{
    auto case_low = get_operand_value(current_addr,1);
    auto case_high = get_operand_value(next_head(next_head(current_addr,end_addr),end_addr),1);
    auto caseVal = (case_high << 16) | case_low;
    return caseVal;
}

static main()
{
    auto current_addr = 0x43BBC;
    auto end_addr = 0x443D4;
    auto start_addr = current_addr;
    while (current_addr != BADADDR && current_addr < end_addr)
    {
        auto current_res = cmpInsn(current_addr,"MOV","W9",0,0);
        auto next_res = cmpInsn(next_head(current_addr,end_addr),"STUR",0,0,0);
        auto last_addr = next_head(next_head(current_addr,end_addr),end_addr);
        auto last_res = cmpInsn(last_addr,"MOVK","W9",0,0);
        if(current_res && next_res && last_res)
        {
            auto caseVal = calCaseVal(current_addr,end_addr);
            auto B_addr = next_head(last_addr,end_addr);
            msg("{'basicBlockAddr' : 0x%X, 'nextCaseVal' : 0x%X},\n",B_addr,caseVal);
        }

if(cmpInsn(current_addr,"MOV","W9",0,0) && cmpInsn(next_head(current_addr,end_addr),"B",0,0,0))
        {
            msg("{'basicBlockAddr' : 0x%X, 'nextCaseVal' : 0x%X},\n",next_head(current_addr,end_addr),get_operand_value(current_addr,1));
        }

current_addr = next_head(current_addr, end_addr);
    }
}
```

输出：

```
{'basicBlockAddr' : 0x43CC4, 'nextCaseVal' : 0x452944A5},
{'basicBlockAddr' : 0x43D3C, 'nextCaseVal' : 0x35F42CE9},
{'basicBlockAddr' : 0x43D9C, 'nextCaseVal' : 0xB22FA3D0},
{'basicBlockAddr' : 0x43DFC, 'nextCaseVal' : 0x78E716D8},
{'basicBlockAddr' : 0x43E4C, 'nextCaseVal' : 0x1C536006},
{'basicBlockAddr' : 0x43E9C, 'nextCaseVal' : 0x43F23AAF},
{'basicBlockAddr' : 0x43EF8, 'nextCaseVal' : 0x22DF66B8},
{'basicBlockAddr' : 0x43F34, 'nextCaseVal' : 0x3D42BA4E},
{'basicBlockAddr' : 0x43F64, 'nextCaseVal' : 0x93A75DE8},
{'basicBlockAddr' : 0x43FAC, 'nextCaseVal' : 0xB50E4CF3},
{'basicBlockAddr' : 0x43FDC, 'nextCaseVal' : 0x1C536006},
{'basicBlockAddr' : 0x44058, 'nextCaseVal' : 0xECEBC62F},
{'basicBlockAddr' : 0x440CC, 'nextCaseVal' : 0x78E716D8},
{'basicBlockAddr' : 0x44118, 'nextCaseVal' : 0xD721AE9D},
{'basicBlockAddr' : 0x44128, 'nextCaseVal' : 0x4CF7C786},
{'basicBlockAddr' : 0x44148, 'nextCaseVal' : 0xB22FA3D0},
{'basicBlockAddr' : 0x44158, 'nextCaseVal' : 0x93A75DE8},
{'basicBlockAddr' : 0x44164, 'nextCaseVal' : 0xBBBE05E4},
{'basicBlockAddr' : 0x44174, 'nextCaseVal' : 0x43F23AAF},
{'basicBlockAddr' : 0x44180, 'nextCaseVal' : 0x8ECCC728},
{'basicBlockAddr' : 0x441DC, 'nextCaseVal' : 0x43EDB2A0},
{'basicBlockAddr' : 0x441E8, 'nextCaseVal' : 0xB62C5792},
{'basicBlockAddr' : 0x441F4, 'nextCaseVal' : 0xCA9DBB1F},
{'basicBlockAddr' : 0x44298, 'nextCaseVal' : 0x4B62C933},
{'basicBlockAddr' : 0x442BC, 'nextCaseVal' : 0xBE873E04},
{'basicBlockAddr' : 0x442D8, 'nextCaseVal' : 0x2F804C20},
{'basicBlockAddr' : 0x44334, 'nextCaseVal' : 0xEFEBCA04},
{'basicBlockAddr' : 0x44350, 'nextCaseVal' : 0x97F01E89},
```

这样就提取出了函数中所有单后继基本块跳转地址和下一个基本块的case值

稍微修改一下得到多后继的

```c++
#include <idc.idc>

static findCase(current_addr,reg,start_addr)
{
    while(current_addr != BADADDR)
    {
        auto insn = print_insn_mnem(current_addr);
        auto op = print_operand(current_addr,0);
        if(insn == "MOV" && op == reg)
        {
            auto caseVal = get_operand_value(current_addr,1);
            return caseVal;
        }
        current_addr = prev_head(current_addr,start_addr);
    }
}

static main()
{
    auto current_addr = 0x43BBC;
    auto end_addr = 0x443D4;
    auto start_addr = current_addr;
    while (current_addr != BADADDR && current_addr < end_addr)
    {
        auto current_insn = print_insn_mnem(current_addr);
        auto next_insn = print_insn_mnem(next_head(current_addr,end_addr));
        if(current_insn == "CSEL" && next_insn == "B")
        {
            auto cond = print_operand(current_addr,3);
            auto eq_reg = print_operand(current_addr,1);
            auto other_reg = print_operand(current_addr,2);
            auto eq_case = findCase(current_addr,eq_reg,start_addr);
            auto other_case = findCase(current_addr,other_reg,start_addr);
            msg("{'basicBlockAddr' : 0x%X, 'eqCaseVal' : 0x%X, 'otherCaseVal' : 0x%X, 'cond' : '%s'},\n",next_head(current_addr,end_addr),eq_case,other_case,cond);
        }

current_addr = next_head(current_addr, end_addr);
    }
}
```

输出：

```
{'basicBlockAddr' : 0x4409C, 'eqCaseVal' : 0x1B0C631C, 'otherCaseVal' : 0x5C511C13, 'cond' : 'EQ'},
{'basicBlockAddr' : 0x44384, 'eqCaseVal' : 0xEE5D4D0B, 'otherCaseVal' : 0xF8D34334, 'cond' : 'NE'},
```

分发块全部以`mov w9,imm + cmp w8,w9`这样的结构开头。不过有一种分发块需要注意

```asm
MOV             W9, #0xF8D34334
CMP             W8, W9
MOV             W9, #0xFF680FE2
B.EQ            loc_43C34
```

如果case值和这里的`0xF8D34334`相等，那么最后会跳转到`loc_43C34`，这是什么地方呢

![](upload/attach/202607/1008445_Q54T84E39GGSSM4.png)

是开始分发的地方。所以这里的逻辑其实是basicBlock -> dispatchBlock -> dispatchBlock -> basicBlock，而不是经典的basicBlock -> dispatchBlock -> basicBlock。多分发了一次。

写出idc脚本提取值

```cpp
#include <idc.idc>

static findJmp(addr,end_addr)
{
    while(addr < end_addr && addr != BADADDR)
    {
        addr = next_head(addr,end_addr);
        auto insn_name = print_insn_mnem(addr);
        if(strstr(insn_name,"B") != -1)
        {
            break;
        }
    }

return addr;
}

static main()
{
    auto current_addr = 0x43BBC;
    auto end_addr = 0x443D4;
    while (current_addr != BADADDR && current_addr < end_addr)
    {
        auto insn_name = print_insn_mnem(current_addr);
        auto op1 = print_operand(current_addr,0);
        if(insn_name == "MOV" && op1 == "W9")
        {
            auto next_addr = next_head(current_addr,end_addr);
            auto next_insn = print_insn_mnem(next_addr);
            auto next_op1 = print_operand(next_addr,0);
            auto next_op2 = print_operand(next_addr,1);
            if(next_insn == "CMP" && next_op1 == "W8" && next_op2 == "W9")
            {
                auto real_addr = next_head(next_addr,end_addr);
                auto real_insn = print_insn_mnem(real_addr);
                auto real_op1 = print_operand(real_addr,0);
                auto real_op2 = get_operand_value(real_addr,1);
                auto real_case = 0;
                if(real_insn == "MOV" && real_op1 == "W9")
                {
                    real_case = real_op2;
                }
                auto B_addr = findJmp(next_addr,end_addr);
                auto cond = print_insn_mnem(B_addr);
                auto eq_jmp = print_operand(B_addr,0);
                auto other_jmp = next_head(B_addr,end_addr);
                msg("{'addr' : 0x%X, 'caseVal' : 0x%s, 'cond' : '%s', 'eq_jmp' : %s, 'other_jmp' : 0x%X, 'real_case' : 0x%X},\n", current_addr,toupper(ltoa(get_operand_value(current_addr, 1), 16)),cond,eq_jmp,other_jmp,real_case);
            }
        }
        current_addr = next_head(current_addr, end_addr);
    }
}
```

输出：

```
{'addr' : 0x43C38, 'caseVal' : 0xF8D34333, 'cond' : 'B.LE', 'eq_jmp' : loc_43CC8, 'other_jmp' : 0x43C48, 'real_case' : 0x0},
{'addr' : 0x43C48, 'caseVal' : 0x3D42BA4D, 'cond' : 'B.GT', 'eq_jmp' : loc_43D40, 'other_jmp' : 0x43C58, 'real_case' : 0x0},
{'addr' : 0x43C58, 'caseVal' : 0x22DF66B7, 'cond' : 'B.GT', 'eq_jmp' : loc_43E50, 'other_jmp' : 0x43C68, 'real_case' : 0x0},
{'addr' : 0x43C68, 'caseVal' : 0x17F41D4, 'cond' : 'B.LE', 'eq_jmp' : loc_43FE0, 'other_jmp' : 0x43C78, 'real_case' : 0x0},
{'addr' : 0x43C78, 'caseVal' : 0x17F41D5, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43C90, 'real_case' : 0xFF680FE2},
{'addr' : 0x43C90, 'caseVal' : 0x1B0C631C, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43CA8, 'real_case' : 0x35F42CE9},
{'addr' : 0x43CA8, 'caseVal' : 0x1C536006, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43CBC, 'real_case' : 0x89},
{'addr' : 0x43CC8, 'caseVal' : 0xC105D5A4, 'cond' : 'B.LE', 'eq_jmp' : loc_43DA0, 'other_jmp' : 0x43CD8, 'real_case' : 0x0},
{'addr' : 0x43CD8, 'caseVal' : 0xECEBC62E, 'cond' : 'B.GT', 'eq_jmp' : loc_43E00, 'other_jmp' : 0x43CE8, 'real_case' : 0x0},
{'addr' : 0x43CE8, 'caseVal' : 0xCA9DBB1E, 'cond' : 'B.LE', 'eq_jmp' : loc_43F68, 'other_jmp' : 0x43CF8, 'real_case' : 0x0},
{'addr' : 0x43CF8, 'caseVal' : 0xCA9DBB1F, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43D10, 'real_case' : 0xB50E4CF3},
{'addr' : 0x43D10, 'caseVal' : 0xD721AE9D, 'cond' : 'B.EQ', 'eq_jmp' : loc_442D0, 'other_jmp' : 0x43D20, 'real_case' : 0x0},
{'addr' : 0x43D20, 'caseVal' : 0xE4648FAD, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43D34, 'real_case' : 0x89},
{'addr' : 0x43D40, 'caseVal' : 0x4CF7C785, 'cond' : 'B.GT', 'eq_jmp' : loc_43EA0, 'other_jmp' : 0x43D50, 'real_case' : 0x0},
{'addr' : 0x43D50, 'caseVal' : 0x43F23AAE, 'cond' : 'B.LE', 'eq_jmp' : loc_44020, 'other_jmp' : 0x43D60, 'real_case' : 0x0},
{'addr' : 0x43D60, 'caseVal' : 0x43F23AAF, 'cond' : 'B.EQ', 'eq_jmp' : loc_441E0, 'other_jmp' : 0x43D70, 'real_case' : 0x0},
{'addr' : 0x43D70, 'caseVal' : 0x452944A5, 'cond' : 'B.EQ', 'eq_jmp' : loc_44338, 'other_jmp' : 0x43D80, 'real_case' : 0x0},
{'addr' : 0x43D80, 'caseVal' : 0x4B62C933, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43D94, 'real_case' : 0x89},
{'addr' : 0x43DA0, 'caseVal' : 0xB22FA3CF, 'cond' : 'B.GT', 'eq_jmp' : loc_43EFC, 'other_jmp' : 0x43DB0, 'real_case' : 0x0},
{'addr' : 0x43DB0, 'caseVal' : 0x93A75DE7, 'cond' : 'B.LE', 'eq_jmp' : loc_43F38, 'other_jmp' : 0x43DC0, 'real_case' : 0x0},
{'addr' : 0x43DC0, 'caseVal' : 0x93A75DE8, 'cond' : 'B.EQ', 'eq_jmp' : loc_44178, 'other_jmp' : 0x43DD0, 'real_case' : 0x0},
{'addr' : 0x43DD0, 'caseVal' : 0x97F01E89, 'cond' : 'B.EQ', 'eq_jmp' : loc_442C0, 'other_jmp' : 0x43DE0, 'real_case' : 0x0},
{'addr' : 0x43DE0, 'caseVal' : 0x9A4F670B, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43DF4, 'real_case' : 0x89},
{'addr' : 0x43E00, 'caseVal' : 0xEFEBCA03, 'cond' : 'B.LE', 'eq_jmp' : loc_43FB0, 'other_jmp' : 0x43E10, 'real_case' : 0x0},
{'addr' : 0x43E10, 'caseVal' : 0xEFEBCA04, 'cond' : 'B.EQ', 'eq_jmp' : loc_44184, 'other_jmp' : 0x43E20, 'real_case' : 0x0},
{'addr' : 0x43E20, 'caseVal' : 0xF1508DA1, 'cond' : 'B.EQ', 'eq_jmp' : loc_442DC, 'other_jmp' : 0x43E30, 'real_case' : 0x0},
{'addr' : 0x43E30, 'caseVal' : 0xF50BDBE9, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43E44, 'real_case' : 0x89},
{'addr' : 0x43E50, 'caseVal' : 0x34D451D4, 'cond' : 'B.LE', 'eq_jmp' : loc_4405C, 'other_jmp' : 0x43E60, 'real_case' : 0x0},
{'addr' : 0x43E60, 'caseVal' : 0x34D451D5, 'cond' : 'B.EQ', 'eq_jmp' : loc_441EC, 'other_jmp' : 0x43E70, 'real_case' : 0x0},
{'addr' : 0x43E70, 'caseVal' : 0x35F42CE9, 'cond' : 'B.EQ', 'eq_jmp' : loc_44348, 'other_jmp' : 0x43E80, 'real_case' : 0x0},
{'addr' : 0x43E80, 'caseVal' : 0x3BC74C43, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43E94, 'real_case' : 0x89},
{'addr' : 0x43EA0, 'caseVal' : 0x5C511C12, 'cond' : 'B.LE', 'eq_jmp' : loc_440A0, 'other_jmp' : 0x43EB0, 'real_case' : 0x0},
{'addr' : 0x43EB0, 'caseVal' : 0x5C511C13, 'cond' : 'B.EQ', 'eq_jmp' : loc_441F8, 'other_jmp' : 0x43EC0, 'real_case' : 0x0},
{'addr' : 0x43EC0, 'caseVal' : 0x72910E37, 'cond' : 'B.EQ', 'eq_jmp' : loc_44354, 'other_jmp' : 0x43ED0, 'real_case' : 0x0},
{'addr' : 0x43ED0, 'caseVal' : 0x78E716D8, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43EE4, 'real_case' : 0x89},
{'addr' : 0x43EFC, 'caseVal' : 0xB62C5791, 'cond' : 'B.LE', 'eq_jmp' : loc_440D0, 'other_jmp' : 0x43F0C, 'real_case' : 0x0},
{'addr' : 0x43F0C, 'caseVal' : 0xBBBE05E4, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C04, 'other_jmp' : 0x43F1C, 'real_case' : 0x0},
{'addr' : 0x43F1C, 'caseVal' : 0xBE873E04, 'cond' : 'B.NE', 'eq_jmp' : loc_44388, 'other_jmp' : 0x43F2C, 'real_case' : 0x0},
{'addr' : 0x43F38, 'caseVal' : 0x8ECCC728, 'cond' : 'B.EQ', 'eq_jmp' : loc_4411C, 'other_jmp' : 0x43F48, 'real_case' : 0x0},
{'addr' : 0x43F48, 'caseVal' : 0x913BCE29, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43F5C, 'real_case' : 0x89},
{'addr' : 0x43F68, 'caseVal' : 0xC105D5A5, 'cond' : 'B.EQ', 'eq_jmp' : loc_4412C, 'other_jmp' : 0x43F78, 'real_case' : 0x0},
{'addr' : 0x43F78, 'caseVal' : 0xC3C03B1F, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43F8C, 'real_case' : 0x89},
{'addr' : 0x43FB0, 'caseVal' : 0xECEBC62F, 'cond' : 'B.EQ', 'eq_jmp' : loc_4414C, 'other_jmp' : 0x43FC0, 'real_case' : 0x0},
{'addr' : 0x43FC0, 'caseVal' : 0xEE5D4D0B, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43FD4, 'real_case' : 0x89},
{'addr' : 0x43FE0, 'caseVal' : 0xF8D34334, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x43FF8, 'real_case' : 0xFF680FE2},
{'addr' : 0x43FF8, 'caseVal' : 0xFF680FE2, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x4400C, 'real_case' : 0x89},
{'addr' : 0x44020, 'caseVal' : 0x3D42BA4E, 'cond' : 'B.EQ', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x44038, 'real_case' : 0xEFEBCA04},
{'addr' : 0x44038, 'caseVal' : 0x43EDB2A0, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x4404C, 'real_case' : 0x89},
{'addr' : 0x4405C, 'caseVal' : 0x22DF66B8, 'cond' : 'B.EQ', 'eq_jmp' : loc_4415C, 'other_jmp' : 0x4406C, 'real_case' : 0x0},
{'addr' : 0x4406C, 'caseVal' : 0x2F804C20, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x44080, 'real_case' : 0x89},
{'addr' : 0x440A0, 'caseVal' : 0x4CF7C786, 'cond' : 'B.EQ', 'eq_jmp' : loc_44168, 'other_jmp' : 0x440B0, 'real_case' : 0x0},
{'addr' : 0x440B0, 'caseVal' : 0x4E7CBDE0, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x440C4, 'real_case' : 0x89},
{'addr' : 0x440D0, 'caseVal' : 0xB22FA3D0, 'cond' : 'B.EQ', 'eq_jmp' : loc_4429C, 'other_jmp' : 0x440E0, 'real_case' : 0x0},
{'addr' : 0x440E0, 'caseVal' : 0xB50E4CF3, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x440F4, 'real_case' : 0x89},
{'addr' : 0x44388, 'caseVal' : 0xB62C5792, 'cond' : 'B.NE', 'eq_jmp' : loc_43C34, 'other_jmp' : 0x4439C, 'real_case' : 0x89},
```

现在我们有了这两张表，应该怎么使用呢，以具体的例子观察一下

```
{basicBlockAddr : 0x43CC4, nextCaseVal : 0x452944A5}
{addr : 0x43D70, caseVal : 0x452944A5, cond : B.EQ, eq_jmp : loc_44338, other_jmp : 0x43D80}
```

所以 0x43CC4 -> 0x44338

再具体的观察一下，可以发现所有的case值对应的条件都是B.EQ / B.NE，条件跳转完全是吓唬人的，没有起到实际作用。之前我文章中提到的那种魔改控制流平坦化混淆才是真的使用大于小于来分发case值。

使用python脚本批量处理这两个表

```py
basic_blocks = [
{'basicBlockAddr' : 0x43CC4, 'nextCaseVal' : 0x452944A5},
{'basicBlockAddr' : 0x43D3C, 'nextCaseVal' : 0x35F42CE9},
{'basicBlockAddr' : 0x43D9C, 'nextCaseVal' : 0xB22FA3D0},
{'basicBlockAddr' : 0x43DFC, 'nextCaseVal' : 0x78E716D8},
{'basicBlockAddr' : 0x43E4C, 'nextCaseVal' : 0x1C536006},
{'basicBlockAddr' : 0x43E9C, 'nextCaseVal' : 0x43F23AAF},
{'basicBlockAddr' : 0x43EF8, 'nextCaseVal' : 0x22DF66B8},
{'basicBlockAddr' : 0x43F34, 'nextCaseVal' : 0x3D42BA4E},
{'basicBlockAddr' : 0x43F64, 'nextCaseVal' : 0x93A75DE8},
{'basicBlockAddr' : 0x43FAC, 'nextCaseVal' : 0xB50E4CF3},
{'basicBlockAddr' : 0x43FDC, 'nextCaseVal' : 0x1C536006},
{'basicBlockAddr' : 0x44058, 'nextCaseVal' : 0xECEBC62F},
{'basicBlockAddr' : 0x440CC, 'nextCaseVal' : 0x78E716D8},
{'basicBlockAddr' : 0x44118, 'nextCaseVal' : 0xD721AE9D},
{'basicBlockAddr' : 0x44128, 'nextCaseVal' : 0x4CF7C786},
{'basicBlockAddr' : 0x44148, 'nextCaseVal' : 0xB22FA3D0},
{'basicBlockAddr' : 0x44158, 'nextCaseVal' : 0x93A75DE8},
{'basicBlockAddr' : 0x44164, 'nextCaseVal' : 0xBBBE05E4},
{'basicBlockAddr' : 0x44174, 'nextCaseVal' : 0x43F23AAF},
{'basicBlockAddr' : 0x44180, 'nextCaseVal' : 0x8ECCC728},
{'basicBlockAddr' : 0x441DC, 'nextCaseVal' : 0x43EDB2A0},
{'basicBlockAddr' : 0x441E8, 'nextCaseVal' : 0xB62C5792},
{'basicBlockAddr' : 0x441F4, 'nextCaseVal' : 0xCA9DBB1F},
{'basicBlockAddr' : 0x44298, 'nextCaseVal' : 0x4B62C933},
{'basicBlockAddr' : 0x442BC, 'nextCaseVal' : 0xBE873E04},
{'basicBlockAddr' : 0x442D8, 'nextCaseVal' : 0x2F804C20},
{'basicBlockAddr' : 0x44334, 'nextCaseVal' : 0xEFEBCA04},
{'basicBlockAddr' : 0x44350, 'nextCaseVal' : 0x97F01E89},
]

dispatch_blocks = [
{'addr' : 0x43C38, 'caseVal' : 0xF8D34333, 'cond' : 'B.LE', 'eq_jmp' : 0x43CC8, 'other_jmp' : 0x43C48, 'real_case' : 0x0},
{'addr' : 0x43C48, 'caseVal' : 0x3D42BA4D, 'cond' : 'B.GT', 'eq_jmp' : 0x43D40, 'other_jmp' : 0x43C58, 'real_case' : 0x0},
{'addr' : 0x43C58, 'caseVal' : 0x22DF66B7, 'cond' : 'B.GT', 'eq_jmp' : 0x43E50, 'other_jmp' : 0x43C68, 'real_case' : 0x0},
{'addr' : 0x43C68, 'caseVal' : 0x17F41D4, 'cond' : 'B.LE', 'eq_jmp' : 0x43FE0, 'other_jmp' : 0x43C78, 'real_case' : 0x0},
{'addr' : 0x43C78, 'caseVal' : 0x17F41D5, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43C90, 'real_case' : 0xFF680FE2},
{'addr' : 0x43C90, 'caseVal' : 0x1B0C631C, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43CA8, 'real_case' : 0x35F42CE9},
{'addr' : 0x43CA8, 'caseVal' : 0x1C536006, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43CBC, 'real_case' : 0x89},
{'addr' : 0x43CC8, 'caseVal' : 0xC105D5A4, 'cond' : 'B.LE', 'eq_jmp' : 0x43DA0, 'other_jmp' : 0x43CD8, 'real_case' : 0x0},
{'addr' : 0x43CD8, 'caseVal' : 0xECEBC62E, 'cond' : 'B.GT', 'eq_jmp' : 0x43E00, 'other_jmp' : 0x43CE8, 'real_case' : 0x0},
{'addr' : 0x43CE8, 'caseVal' : 0xCA9DBB1E, 'cond' : 'B.LE', 'eq_jmp' : 0x43F68, 'other_jmp' : 0x43CF8, 'real_case' : 0x0},
{'addr' : 0x43CF8, 'caseVal' : 0xCA9DBB1F, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43D10, 'real_case' : 0xB50E4CF3},
{'addr' : 0x43D10, 'caseVal' : 0xD721AE9D, 'cond' : 'B.EQ', 'eq_jmp' : 0x442D0, 'other_jmp' : 0x43D20, 'real_case' : 0x0},
{'addr' : 0x43D20, 'caseVal' : 0xE4648FAD, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43D34, 'real_case' : 0x89},
{'addr' : 0x43D40, 'caseVal' : 0x4CF7C785, 'cond' : 'B.GT', 'eq_jmp' : 0x43EA0, 'other_jmp' : 0x43D50, 'real_case' : 0x0},
{'addr' : 0x43D50, 'caseVal' : 0x43F23AAE, 'cond' : 'B.LE', 'eq_jmp' : 0x44020, 'other_jmp' : 0x43D60, 'real_case' : 0x0},
{'addr' : 0x43D60, 'caseVal' : 0x43F23AAF, 'cond' : 'B.EQ', 'eq_jmp' : 0x441E0, 'other_jmp' : 0x43D70, 'real_case' : 0x0},
{'addr' : 0x43D70, 'caseVal' : 0x452944A5, 'cond' : 'B.EQ', 'eq_jmp' : 0x44338, 'other_jmp' : 0x43D80, 'real_case' : 0x0},
{'addr' : 0x43D80, 'caseVal' : 0x4B62C933, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43D94, 'real_case' : 0x89},
{'addr' : 0x43DA0, 'caseVal' : 0xB22FA3CF, 'cond' : 'B.GT', 'eq_jmp' : 0x43EFC, 'other_jmp' : 0x43DB0, 'real_case' : 0x0},
{'addr' : 0x43DB0, 'caseVal' : 0x93A75DE7, 'cond' : 'B.LE', 'eq_jmp' : 0x43F38, 'other_jmp' : 0x43DC0, 'real_case' : 0x0},
{'addr' : 0x43DC0, 'caseVal' : 0x93A75DE8, 'cond' : 'B.EQ', 'eq_jmp' : 0x44178, 'other_jmp' : 0x43DD0, 'real_case' : 0x0},
{'addr' : 0x43DD0, 'caseVal' : 0x97F01E89, 'cond' : 'B.EQ', 'eq_jmp' : 0x442C0, 'other_jmp' : 0x43DE0, 'real_case' : 0x0},
{'addr' : 0x43DE0, 'caseVal' : 0x9A4F670B, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43DF4, 'real_case' : 0x89},
{'addr' : 0x43E00, 'caseVal' : 0xEFEBCA03, 'cond' : 'B.LE', 'eq_jmp' : 0x43FB0, 'other_jmp' : 0x43E10, 'real_case' : 0x0},
{'addr' : 0x43E10, 'caseVal' : 0xEFEBCA04, 'cond' : 'B.EQ', 'eq_jmp' : 0x44184, 'other_jmp' : 0x43E20, 'real_case' : 0x0},
{'addr' : 0x43E20, 'caseVal' : 0xF1508DA1, 'cond' : 'B.EQ', 'eq_jmp' : 0x442DC, 'other_jmp' : 0x43E30, 'real_case' : 0x0},
{'addr' : 0x43E30, 'caseVal' : 0xF50BDBE9, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43E44, 'real_case' : 0x89},
{'addr' : 0x43E50, 'caseVal' : 0x34D451D4, 'cond' : 'B.LE', 'eq_jmp' : 0x4405C, 'other_jmp' : 0x43E60, 'real_case' : 0x0},
{'addr' : 0x43E60, 'caseVal' : 0x34D451D5, 'cond' : 'B.EQ', 'eq_jmp' : 0x441EC, 'other_jmp' : 0x43E70, 'real_case' : 0x0},
{'addr' : 0x43E70, 'caseVal' : 0x35F42CE9, 'cond' : 'B.EQ', 'eq_jmp' : 0x44348, 'other_jmp' : 0x43E80, 'real_case' : 0x0},
{'addr' : 0x43E80, 'caseVal' : 0x3BC74C43, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43E94, 'real_case' : 0x89},
{'addr' : 0x43EA0, 'caseVal' : 0x5C511C12, 'cond' : 'B.LE', 'eq_jmp' : 0x440A0, 'other_jmp' : 0x43EB0, 'real_case' : 0x0},
{'addr' : 0x43EB0, 'caseVal' : 0x5C511C13, 'cond' : 'B.EQ', 'eq_jmp' : 0x441F8, 'other_jmp' : 0x43EC0, 'real_case' : 0x0},
{'addr' : 0x43EC0, 'caseVal' : 0x72910E37, 'cond' : 'B.EQ', 'eq_jmp' : 0x44354, 'other_jmp' : 0x43ED0, 'real_case' : 0x0},
{'addr' : 0x43ED0, 'caseVal' : 0x78E716D8, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43EE4, 'real_case' : 0x89},
{'addr' : 0x43EFC, 'caseVal' : 0xB62C5791, 'cond' : 'B.LE', 'eq_jmp' : 0x440D0, 'other_jmp' : 0x43F0C, 'real_case' : 0x0},
{'addr' : 0x43F0C, 'caseVal' : 0xBBBE05E4, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C04, 'other_jmp' : 0x43F1C, 'real_case' : 0x0},
{'addr' : 0x43F1C, 'caseVal' : 0xBE873E04, 'cond' : 'B.NE', 'eq_jmp' : 0x44388, 'other_jmp' : 0x43F2C, 'real_case' : 0x0},
{'addr' : 0x43F38, 'caseVal' : 0x8ECCC728, 'cond' : 'B.EQ', 'eq_jmp' : 0x4411C, 'other_jmp' : 0x43F48, 'real_case' : 0x0},
{'addr' : 0x43F48, 'caseVal' : 0x913BCE29, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43F5C, 'real_case' : 0x89},
{'addr' : 0x43F68, 'caseVal' : 0xC105D5A5, 'cond' : 'B.EQ', 'eq_jmp' : 0x4412C, 'other_jmp' : 0x43F78, 'real_case' : 0x0},
{'addr' : 0x43F78, 'caseVal' : 0xC3C03B1F, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43F8C, 'real_case' : 0x89},
{'addr' : 0x43FB0, 'caseVal' : 0xECEBC62F, 'cond' : 'B.EQ', 'eq_jmp' : 0x4414C, 'other_jmp' : 0x43FC0, 'real_case' : 0x0},
{'addr' : 0x43FC0, 'caseVal' : 0xEE5D4D0B, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43FD4, 'real_case' : 0x89},
{'addr' : 0x43FE0, 'caseVal' : 0xF8D34334, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x43FF8, 'real_case' : 0xFF680FE2},
{'addr' : 0x43FF8, 'caseVal' : 0xFF680FE2, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x4400C, 'real_case' : 0x89},
{'addr' : 0x44020, 'caseVal' : 0x3D42BA4E, 'cond' : 'B.EQ', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x44038, 'real_case' : 0xEFEBCA04},
{'addr' : 0x44038, 'caseVal' : 0x43EDB2A0, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x4404C, 'real_case' : 0x89},
{'addr' : 0x4405C, 'caseVal' : 0x22DF66B8, 'cond' : 'B.EQ', 'eq_jmp' : 0x4415C, 'other_jmp' : 0x4406C, 'real_case' : 0x0},
{'addr' : 0x4406C, 'caseVal' : 0x2F804C20, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x44080, 'real_case' : 0x89},
{'addr' : 0x440A0, 'caseVal' : 0x4CF7C786, 'cond' : 'B.EQ', 'eq_jmp' : 0x44168, 'other_jmp' : 0x440B0, 'real_case' : 0x0},
{'addr' : 0x440B0, 'caseVal' : 0x4E7CBDE0, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x440C4, 'real_case' : 0x89},
{'addr' : 0x440D0, 'caseVal' : 0xB22FA3D0, 'cond' : 'B.EQ', 'eq_jmp' : 0x4429C, 'other_jmp' : 0x440E0, 'real_case' : 0x0},
{'addr' : 0x440E0, 'caseVal' : 0xB50E4CF3, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x440F4, 'real_case' : 0x89},
{'addr' : 0x44388, 'caseVal' : 0xB62C5792, 'cond' : 'B.NE', 'eq_jmp' : 0x43C34, 'other_jmp' : 0x4439C, 'real_case' : 0x89},
]

for basic_block in basic_blocks:
    nextCaseVal = basic_block.get("nextCaseVal")
    for dispatch_block in dispatch_blocks:
        caseVal = dispatch_block.get("caseVal")
        if caseVal == nextCaseVal:
            cond = dispatch_block.get("cond")
            realCaseVal =dispatch_block.get("real_case")
            if realCaseVal != 0 and realCaseVal != 0x89:
                nextCaseVal = realCaseVal
                for dispatch_block in dispatch_blocks:
                    caseVal = dispatch_block.get("caseVal")
                    if caseVal == nextCaseVal:
                        cond = dispatch_block.get("cond")
                        if cond == "B.NE":
                            branch = dispatch_block.get("other_jmp")
                        if cond == "B.EQ":
                            branch = dispatch_block.get("eq_jmp")
            else:
                if cond == "B.NE":
                    branch = dispatch_block.get("other_jmp")
                if cond == "B.EQ":
                    branch = dispatch_block.get("eq_jmp")
    print(f"jmp {hex(basic_block.get("basicBlockAddr"))} -> {hex(branch)}")

```

~~我python水平一般，写的脚本比较丑陋，大家见谅(≧﹏ ≦)~~

输出跳转关系表如下

```
jmp 0x43cc4 -> 0x44338
jmp 0x43d3c -> 0x44348
jmp 0x43d9c -> 0x4429c
jmp 0x43dfc -> 0x43ee4
jmp 0x43e4c -> 0x43cbc
jmp 0x43e9c -> 0x441e0
jmp 0x43ef8 -> 0x4415c
jmp 0x43f34 -> 0x44184
jmp 0x43f64 -> 0x44178
jmp 0x43fac -> 0x440f4
jmp 0x43fdc -> 0x43cbc
jmp 0x44058 -> 0x4414c
jmp 0x440cc -> 0x43ee4
jmp 0x44118 -> 0x442d0
jmp 0x44128 -> 0x44168
jmp 0x44148 -> 0x4429c
jmp 0x44158 -> 0x44178
jmp 0x44164 -> 0x43c04
jmp 0x44174 -> 0x441e0
jmp 0x44180 -> 0x4411c
jmp 0x441dc -> 0x4404c
jmp 0x441e8 -> 0x4439c
jmp 0x441f4 -> 0x440f4
jmp 0x44298 -> 0x43d94
jmp 0x442bc -> 0x43f2c
jmp 0x442d8 -> 0x44080
jmp 0x44334 -> 0x44184
jmp 0x44350 -> 0x442c0

```

根据这张表patch代码即可。效果如下

![](upload/attach/202607/1008445_KJ9W2UR66HFK8JB.png)

恢复后的cfg图

![](upload/attach/202607/1008445_PDZF9NNZAHTXYRM.png)

这是MD5函数的外层函数，内层算法混淆和这种是一样的，这里就不再展示了

## 案例3

目标为鹅的反作弊so文件，被间接跳转和控制流平坦化保护。由于不好动态，所以我们纯静态的去除这两种混淆

**间接跳转**

先观察是如何进行间接跳转混淆的

```asm
.text:000000000021094C                 MOV             W8, #0x5A63
.text:0000000000210950                 MOV             W9, #0x9281
.text:0000000000210954                 CMP             W1, #0
.text:0000000000210958                 MOVK            W8, #0xD73F,LSL#16
.text:000000000021095C                 MOVK            W9, #0x69A0,LSL#16
.text:0000000000210960                 ADRL            X23, off_527780
.text:0000000000210968                 ADD             W10, W8, #0x11
.text:000000000021096C                 ADD             W11, W9, #0x11
.text:0000000000210970                 EOR             W8, W10, W8
.text:0000000000210974                 EOR             W10, W11, W9
.text:0000000000210978                 MOV             X25, X2
.text:000000000021097C                 CSEL            W8, W8, W10, EQ
.text:0000000000210980                 MOV             W26, W1
.text:0000000000210984                 STP             W11, W9, [X29,#var_8]
.text:0000000000210988                 LDR             X8, [X23,W8,UXTW#3]
.text:000000000021098C                 BR              X8
```

`X23`是函数表，根据计算出的偏移对其进行查找

偏移的计算公式为 (imm + num) ^ imm。除了加法外还有其他计算，sub、or等

每个函数只对函数表赋一次值，如果看到附近其它块也以`X23`为基址寻找跳转函数，大概率都是`21094C`这个函数的

![](upload/attach/202607/1008445_WY42UQC9DCBK29R.png)

计算的值不一定是常数，还有可能是通过寄存器计算。

通过观察我们可以发现，不是所有的块都对函数表进行了赋值，被间接跳转切割的块全部使用同一个寄存器作为跳转表，因此，同一个函数的块都是相连在一起的。

![](upload/attach/202607/1008445_2C4SYNMC8Q5UEQA.png)

知道此函数计算公式为(imm cal num) ^ imm之后，就可以写脚本提取数值模拟计算，找到要跳转的地址。、

因为脚本比较复杂，之后的脚本就都使用ai生成了

```py
import re

import ida_bytes
import ida_funcs
import ida_kernwin
import ida_lines
import idc

START_EA = 0x21092C
END_EA = 0x210F2C
TABLE_EA = 0x527780
PTR_SIZE = 8
TABLE_COUNT = 0x100
ADD_COMMENTS = True

MASK32 = 0xFFFFFFFF
MAX_BACKTRACK = 0x400
STOP_MNEMS = {"br", "blr", "ret"}

def _msg(s):
    try:
        ida_kernwin.msg(s + "\n")
    except Exception:
        print(s)

def mnem(ea):
    return (idc.print_insn_mnem(ea) or "").lower()

def op_text(ea, n):
    text = idc.print_operand(ea, n) or ""
    return ida_lines.tag_remove(text).strip()

def norm_reg(reg):
    reg = (reg or "").strip().lower()
    reg = reg.replace(",", "")
    if reg.startswith("x") and reg[1:].isdigit():
        return "w" + reg[1:]
    if reg == "xzr":
        return "wzr"
    return reg

def reg64(reg):
    reg = norm_reg(reg)
    if reg.startswith("w") and reg[1:].isdigit():
        return "x" + reg[1:]
    if reg == "wzr":
        return "xzr"
    return reg

def is_reg_operand(ea, n):
    return idc.get_operand_type(ea, n) == idc.o_reg

def imm_operand(ea, n):
    typ = idc.get_operand_type(ea, n)
    if typ in (idc.o_imm, idc.o_near, idc.o_far):
        return idc.get_operand_value(ea, n) & MASK32
    return None

def mov_shift(ea):
    # IDA may keep the LSL as part of operand 1 or only in the rendered line.
    for n in range(1, 5):
        text = op_text(ea, n)
        m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", text, re.I)
        if m:
            return int(m.group(1), 0)
    line = ida_lines.tag_remove(idc.generate_disasm_line(ea, 0) or "")
    m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", line, re.I)
    return int(m.group(1), 0) if m else 0

def prev_head(ea, start):
    p = idc.prev_head(ea, start)
    return None if p == idc.BADADDR or p < start else p

def next_head(ea, end):
    n = idc.next_head(ea, end)
    return None if n == idc.BADADDR or n >= end else n

def operand_value(ea, n, start, depth, seen):
    if is_reg_operand(ea, n):
        reg = norm_reg(op_text(ea, n))
        if reg in ("wzr", "xzr"):
            return 0
        return resolve_reg(reg, ea, start, depth + 1, seen)
    return imm_operand(ea, n)

def apply_binop(insn, a, b):
    if a is None or b is None:
        return None
    if insn == "add":
        return (a + b) & MASK32
    if insn == "sub":
        return (a - b) & MASK32
    if insn == "orr":
        return (a | b) & MASK32
    if insn == "eor":
        return (a ^ b) & MASK32
    return None

def resolve_reg(reg, before_ea, start, depth=0, seen=None):
    """Recover a 32-bit constant value for reg immediately before before_ea."""
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return 0
    if seen is None:
        seen = set()
    key = (reg, before_ea)
    if key in seen or depth > 32:
        return None
    seen.add(key)

ea = prev_head(before_ea, start)
    low_limit = max(start, before_ea - MAX_BACKTRACK)
    while ea is not None and ea >= low_limit:
        insn = mnem(ea)
        if insn in STOP_MNEMS:
            return None

dst = norm_reg(op_text(ea, 0))
        if dst == reg:
            if insn in ("mov", "movz"):
                imm = imm_operand(ea, 1)
                if imm is not None:
                    return (imm << mov_shift(ea)) & MASK32
                if is_reg_operand(ea, 1):
                    return resolve_reg(op_text(ea, 1), ea, start, depth + 1, seen)
                return None

if insn == "movn":
                imm = imm_operand(ea, 1)
                if imm is None:
                    return None
                return (~(imm << mov_shift(ea))) & MASK32

if insn == "movk":
                imm = imm_operand(ea, 1)
                if imm is None:
                    return None
                old = resolve_reg(reg, ea, start, depth + 1, seen)
                if old is None:
                    old = 0
                shift = mov_shift(ea)
                mask = (0xFFFF << shift) & MASK32
                return ((old & ~mask) | ((imm & 0xFFFF) << shift)) & MASK32

if insn in ("add", "sub", "orr", "eor"):
                a = operand_value(ea, 1, start, depth, seen)
                b = operand_value(ea, 2, start, depth, seen)
                return apply_binop(insn, a, b)

return None

ea = prev_head(ea, start)
    return None

def csel_operands(ea):
    dst = norm_reg(op_text(ea, 0))
    src_true = norm_reg(op_text(ea, 1))
    src_false = norm_reg(op_text(ea, 2))
    cond = op_text(ea, 3).lower()
    if not cond:
        line = idc.generate_disasm_line(ea, 0) or ""
        parts = [p.strip().lower() for p in line.split(",")]
        cond = parts[-1] if len(parts) >= 4 else "?"
    return dst, src_true, src_false, cond

def operand_mentions_reg(text, reg):
    regs = set(re.findall(r"\b[wx](?:\d+|zr)\b", text.lower()))
    wanted = {norm_reg(reg), reg64(reg)}
    return bool(regs & wanted)

def find_table_load_and_br(csel_ea, end, index_reg):
    ea = next_head(csel_ea, end)
    load_ea = None
    branch_reg = None

while ea is not None:
        insn = mnem(ea)

if insn == "ldr" and operand_mentions_reg(op_text(ea, 1), index_reg):
            load_ea = ea
            branch_reg = reg64(op_text(ea, 0))

if insn == "br":
            br_reg = reg64(op_text(ea, 0))
            if branch_reg and br_reg == branch_reg:
                return load_ea, ea, branch_reg
            return None, ea, None

if insn in ("b", "ret", "blr"):
            return None, ea, None

ea = next_head(ea, end)

return None, None, None

def read_table_target(index):
    if index is None:
        return None
    if index < 0 or index >= TABLE_COUNT:
        return None
    ea = TABLE_EA + (index & MASK32) * PTR_SIZE
    if PTR_SIZE == 8:
        return ida_bytes.get_qword(ea)
    return ida_bytes.get_dword(ea)

def value_from_regs(ea, n, regs):
    if is_reg_operand(ea, n):
        item = regs.get(norm_reg(op_text(ea, n)))
        return item[0] if is_const_item(item) else None
    return imm_operand(ea, n)

def is_const_item(item):
    return isinstance(item, tuple) and len(item) == 3 and isinstance(item[0], int)

def const_item(value, assigned=False, calculated=False):
    if value is None:
        return None
    return (value & MASK32, assigned, calculated)

def item_value(item):
    return item[0] if is_const_item(item) else None

def item_has_assignment_and_calc(item):
    return is_const_item(item) and item[1] and item[2]

def csel_source_item(regs, reg):
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return const_item(0)
    return regs.get(reg)

def item_is_wzr_const(item):
    return is_const_item(item) and item[0] == 0 and not item[1] and not item[2]

def csel_pair_ready(item_true, item_false):
    true_ready = item_has_assignment_and_calc(item_true)
    false_ready = item_has_assignment_and_calc(item_false)
    true_zero = item_is_wzr_const(item_true)
    false_zero = item_is_wzr_const(item_false)
    return (true_ready and (false_ready or false_zero)) or (false_ready and (true_ready or true_zero))

def merge_calc_item(value, *items):
    assigned = any(is_const_item(item) and item[1] for item in items)
    return const_item(value, assigned=assigned, calculated=True)

def set_reg_value(regs, reg, value):
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return
    if value is None:
        regs.pop(reg, None)
    else:
        regs[reg] = value

def table_choice_from_mem(ea, regs):
    mem = op_text(ea, 1)
    for reg, value in regs.items():
        if isinstance(value, tuple) and value[0] == "choice" and operand_mentions_reg(mem, reg):
            return value
    return None

def add_note(ea, text):
    if not ADD_COMMENTS:
        return
    old = idc.get_cmt(ea, 0) or ""
    if text in old:
        return
    new = (old + "\n" + text).strip() if old else text
    idc.set_cmt(ea, new, 0)

def analyze_range(start=START_EA, end=END_EA):
    regs = {}
    pending_loads = {}
    rows = []
    ea = start

while ea is not None and ea < end:
        insn = mnem(ea)
        dst = norm_reg(op_text(ea, 0))

if insn in ("mov", "movz"):
            imm = imm_operand(ea, 1)
            if imm is not None:
                set_reg_value(regs, dst, const_item(imm << mov_shift(ea), assigned=True))
            elif is_reg_operand(ea, 1):
                src_item = regs.get(norm_reg(op_text(ea, 1)))
                set_reg_value(regs, dst, src_item if is_const_item(src_item) else None)
            else:
                set_reg_value(regs, dst, None)

elif insn == "movn":
            imm = imm_operand(ea, 1)
            set_reg_value(regs, dst, None if imm is None else const_item(~(imm << mov_shift(ea)), assigned=True))

elif insn == "movk":
            imm = imm_operand(ea, 1)
            old_item = regs.get(dst)
            old = item_value(old_item)
            if old is None:
                old = 0
            if imm is None:
                set_reg_value(regs, dst, None)
            else:
                shift = mov_shift(ea)
                mask = (0xFFFF << shift) & MASK32
                set_reg_value(
                    regs,
                    dst,
                    const_item(((old & ~mask) | ((imm & 0xFFFF) << shift)) & MASK32, assigned=True),
                )

elif insn in ("add", "sub", "orr", "eor"):
            item_a = regs.get(norm_reg(op_text(ea, 1))) if is_reg_operand(ea, 1) else const_item(imm_operand(ea, 1))
            item_b = regs.get(norm_reg(op_text(ea, 2))) if is_reg_operand(ea, 2) else const_item(imm_operand(ea, 2))
            value = apply_binop(insn, item_value(item_a), item_value(item_b))
            set_reg_value(regs, dst, None if value is None else merge_calc_item(value, item_a, item_b))

elif insn == "csel":
            _, src_true, src_false, cond = csel_operands(ea)
            item_true = csel_source_item(regs, src_true)
            item_false = csel_source_item(regs, src_false)
            if csel_pair_ready(item_true, item_false):
                set_reg_value(regs, dst, ("choice", cond, item_value(item_true), item_value(item_false), ea))
            else:
                set_reg_value(regs, dst, None)

elif insn == "ldr":
            choice = table_choice_from_mem(ea, regs)
            if choice is not None:
                _, cond, idx_true, idx_false, csel_ea = choice
                target_true = read_table_target(idx_true)
                target_false = read_table_target(idx_false)
                pending_loads[reg64(dst)] = (csel_ea, cond, idx_true, idx_false, target_true, target_false, ea)
                set_reg_value(regs, dst, None)
            else:
                set_reg_value(regs, dst, None)

elif insn == "br":
            br_reg = reg64(op_text(ea, 0))
            pending = pending_loads.pop(br_reg, None)
            if pending is not None:
                csel_ea, cond, idx_true, idx_false, target_true, target_false, load_ea = pending
                ok = target_true is not None and target_false is not None
                rows.append((csel_ea, cond, idx_true, idx_false, target_true, target_false, load_ea, ea, ok))
                if ok:
                    note = "case: if %s -> 0x%X; else -> 0x%X" % (cond, target_true, target_false)
                    add_note(csel_ea, note)
                    add_note(ea, "table br from CSEL 0x%X: %s" % (csel_ea, note))
            pending_loads.clear()
            regs.clear()

elif insn in ("bl", "blr"):
            # AArch64 calls may clobber caller-saved registers. Keep x19-x28 constants.
            for i in range(19):
                regs.pop("w%d" % i, None)

ea = next_head(ea, end)

return rows

def print_rows(rows):
    for row in rows:
        csel_ea, cond, idx_t, idx_f, tgt_t, tgt_f, ldr_ea, br_ea, ok = row
        if not ok:
            continue
        _msg(
            "0x%X %s 0x%X, B 0x%X"
            % (
                br_ea,
                cond.upper(),
                tgt_t,
                tgt_f,
            )
        )

def main():
    func = ida_funcs.get_func(START_EA)
    if func:
        _msg("function: %s 0x%X-0x%X" % (idc.get_func_name(func.start_ea), START_EA, END_EA))
    _msg("table: 0x%X, ptr_size=%d" % (TABLE_EA, PTR_SIZE))
    rows = analyze_range(START_EA, END_EA)
    print_rows(rows)
    _msg("resolved %d/%d CSEL table branches" % (sum(1 for r in rows if r[-1]), len(rows)))

if __name__ == "__main__":
    main()

```

输出

```
0x21098C EQ 0x210EF8, B 0x210990
0x2109D8 EQ 0x2109DC, B 0x210D08
0x210A28 GT 0x210A2C, B 0x210D48
0x210AD8 EQ 0x210B2C, B 0x210ADC
0x210B64 EQ 0x210B70, B 0x210B68
0x210BD0 HI 0x210F04, B 0x210D84
0x210C14 CC 0x210C18, B 0x210C3C
0x210D44 GT 0x210A2C, B 0x210D48
0x210D80 HI 0x210F04, B 0x210D84
0x210E0C EQ 0x210EE4, B 0x210E10
0x210EA8 EQ 0x210B70, B 0x210B68
```

输出的块只是一部分，还有一些没有打印出来，比如sub_210E10函数

![](upload/attach/202607/1008445_97S8SH85HUZ3SED.png)

这个函数没有任何赋值常数的操作，证明赋值这个行为是在上个块进行的，看看它的上个块是什么

```
0x210E0C EQ 0x2137D4, B 0x210E10
```

是`0x210E0C`所在块

![](upload/attach/202607/1008445_TMFX2YTN3B97ZT5.png)

确实对W20、W21进行了赋值。

所以，我们可以遍历表中第一列，第一列的块一定是其它块的前驱块。从前驱块开始，找后继块的赋值并计算跳转值

```python
import re

import ida_bytes
import ida_kernwin
import ida_lines
import idc

START_EA = 0x21092C
END_EA = 0x210F2C
TABLE_EA = 0x527780
PTR_SIZE = 8
TABLE_COUNT = 0x100
MAX_BLOCK_BYTES = 0x300

SEED_EDGES = [
    (0x21098C, "EQ", 0x210EF8, 0x210990),
    (0x2109D8, "EQ", 0x2109DC, 0x210D08),
    (0x210A28, "GT", 0x210A2C, 0x210D48),
    (0x210AD8, "EQ", 0x210B2C, 0x210ADC),
    (0x210B64, "EQ", 0x210B70, 0x210B68),
    (0x210BD0, "HI", 0x210F04, 0x210D84),
    (0x210C14, "CC", 0x210C18, 0x210C3C),
    (0x210D44, "GT", 0x210A2C, 0x210D48),
    (0x210D80, "HI", 0x210F04, 0x210D84),
    (0x210E0C, "EQ", 0x210EE4, 0x210E10),
    (0x210EA8, "EQ", 0x210B70, 0x210B68),
]

MASK32 = 0xFFFFFFFF

def out(s):
    try:
        ida_kernwin.msg(s + "\n")
    except Exception:
        print(s)

def mnem(ea):
    return (idc.print_insn_mnem(ea) or "").lower()

def op(ea, n):
    return ida_lines.tag_remove(idc.print_operand(ea, n) or "").strip()

def norm_reg(reg):
    reg = (reg or "").strip().lower().replace(",", "")
    if reg.startswith("x") and reg[1:].isdigit():
        return "w" + reg[1:]
    if reg == "xzr":
        return "wzr"
    return reg

def reg64(reg):
    reg = norm_reg(reg)
    if reg.startswith("w") and reg[1:].isdigit():
        return "x" + reg[1:]
    if reg == "wzr":
        return "xzr"
    return reg

def is_reg(ea, n):
    return idc.get_operand_type(ea, n) == idc.o_reg

def imm(ea, n):
    if idc.get_operand_type(ea, n) in (idc.o_imm, idc.o_near, idc.o_far):
        return idc.get_operand_value(ea, n) & MASK32
    return None

def mov_shift(ea):
    for n in range(1, 5):
        text = op(ea, n)
        m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", text, re.I)
        if m:
            return int(m.group(1), 0)
    line = ida_lines.tag_remove(idc.generate_disasm_line(ea, 0) or "")
    m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", line, re.I)
    return int(m.group(1), 0) if m else 0

def next_ea(ea, end):
    n = idc.next_head(ea, end)
    return None if n == idc.BADADDR or n >= end else n

def calc(insn, a, b):
    if a is None or b is None:
        return None
    if insn == "add":
        return (a + b) & MASK32
    if insn == "sub":
        return (a - b) & MASK32
    if insn == "orr":
        return (a | b) & MASK32
    if insn == "eor":
        return (a ^ b) & MASK32
    return None

def item(value, assigned=False, calculated=False):
    if value is None:
        return None
    return (value & MASK32, assigned, calculated)

def item_ok(v):
    return isinstance(v, tuple) and len(v) == 3 and isinstance(v[0], int)

def item_value(v):
    return v[0] if item_ok(v) else None

def item_ready(v):
    return item_ok(v) and v[1] and v[2]

def set_reg(regs, reg, value):
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return
    if value is None:
        regs.pop(reg, None)
    else:
        regs[reg] = value

def mentions_reg(text, reg):
    regs = set(re.findall(r"\b[wx](?:\d+|zr)\b", text.lower()))
    return bool(regs & {norm_reg(reg), reg64(reg)})

def read_target(index):
    if index is None or index < 0 or index >= TABLE_COUNT:
        return None
    ea = TABLE_EA + index * PTR_SIZE
    return ida_bytes.get_qword(ea) if PTR_SIZE == 8 else ida_bytes.get_dword(ea)

def csel_info(ea):
    dst = norm_reg(op(ea, 0))
    src_t = norm_reg(op(ea, 1))
    src_f = norm_reg(op(ea, 2))
    cond = op(ea, 3).upper()
    if not cond:
        line = ida_lines.tag_remove(idc.generate_disasm_line(ea, 0) or "")
        parts = [p.strip().upper() for p in line.split(",")]
        cond = parts[-1] if len(parts) >= 4 else "?"
    return dst, src_t, src_f, cond

def call_clobber(regs):
    for i in range(19):
        regs.pop("w%d" % i, None)

def copy_regs(regs):
    return dict(regs or {})

def known_block_starts():
    starts = {START_EA}
    for _, _, true_target, false_target in SEED_EDGES:
        if START_EA <= true_target < END_EA:
            starts.add(true_target)
        if START_EA <= false_target < END_EA:
            starts.add(false_target)
    ea = START_EA
    while ea is not None and ea < END_EA:
        if mnem(ea) == "br":
            n = next_ea(ea, END_EA)
            if n is not None:
                starts.add(n)
        ea = next_ea(ea, END_EA)
    return sorted(starts)

def block_start_for_br(br_ea, starts):
    prev = None
    for start in starts:
        if start <= br_ea:
            prev = start
        else:
            break
    return prev

def analyze_block(block_start, initial_regs=None):
    """Analyze one candidate block entry until the first BR/direct terminal."""
    regs = copy_regs(initial_regs)
    pending = {}
    ea = block_start
    end = min(END_EA, block_start + MAX_BLOCK_BYTES)

while ea is not None and START_EA <= ea < end:
        insn = mnem(ea)
        dst = norm_reg(op(ea, 0))

if insn in ("mov", "movz"):
            v = imm(ea, 1)
            if v is not None:
                set_reg(regs, dst, item(v << mov_shift(ea), assigned=True))
            elif is_reg(ea, 1):
                src = regs.get(norm_reg(op(ea, 1)))
                set_reg(regs, dst, src if item_ok(src) else None)
            else:
                set_reg(regs, dst, None)

elif insn == "movn":
            v = imm(ea, 1)
            set_reg(regs, dst, None if v is None else item(~(v << mov_shift(ea)), assigned=True))

elif insn == "movk":
            v = imm(ea, 1)
            old = item_value(regs.get(dst))
            if old is None:
                old = 0
            if v is None:
                set_reg(regs, dst, None)
            else:
                shift = mov_shift(ea)
                mask = (0xFFFF << shift) & MASK32
                set_reg(regs, dst, item((old & ~mask) | ((v & 0xFFFF) << shift), assigned=True))

elif insn in ("add", "sub", "orr", "eor"):
            a_item = regs.get(norm_reg(op(ea, 1))) if is_reg(ea, 1) else item(imm(ea, 1))
            b_item = regs.get(norm_reg(op(ea, 2))) if is_reg(ea, 2) else item(imm(ea, 2))
            value = calc(insn, item_value(a_item), item_value(b_item))
            assigned = (item_ok(a_item) and a_item[1]) or (item_ok(b_item) and b_item[1])
            set_reg(regs, dst, None if value is None else item(value, assigned=assigned, calculated=True))

elif insn == "csel":
            dst, src_t, src_f, cond = csel_info(ea)
            t_item = regs.get(src_t)
            f_item = regs.get(src_f)
            if item_ready(t_item) and item_ready(f_item):
                set_reg(regs, dst, ("choice", cond, item_value(t_item), item_value(f_item), ea))
            else:
                set_reg(regs, dst, None)

elif insn == "ldr":
            mem = op(ea, 1)
            choice = None
            for reg, value in regs.items():
                if isinstance(value, tuple) and value and value[0] == "choice" and mentions_reg(mem, reg):
                    choice = value
                    break
            if choice is not None:
                _, cond, idx_t, idx_f, csel_ea = choice
                pending[reg64(dst)] = (cond, read_target(idx_t), read_target(idx_f), csel_ea, ea)
            set_reg(regs, dst, None)

elif insn == "br":
            regs_at_br = copy_regs(regs)
            data = pending.get(reg64(op(ea, 0)))
            if data is None:
                return {"row": None, "regs": regs_at_br, "br": ea}
            cond, target_t, target_f, csel_ea, ldr_ea = data
            if target_t is None or target_f is None:
                return {"row": None, "regs": regs_at_br, "br": ea}
            row = (ea, cond, target_t, target_f, block_start, csel_ea, ldr_ea)
            return {"row": row, "regs": regs_at_br, "br": ea}

elif insn == "b":
            return {"row": None, "regs": copy_regs(regs), "br": None}

elif insn in ("bl", "blr"):
            call_clobber(regs)

elif insn == "ret":
            return {"row": None, "regs": copy_regs(regs), "br": None}

ea = next_ea(ea, end)

return {"row": None, "regs": copy_regs(regs), "br": None}

def main():
    starts = known_block_starts()
    queue = []
    seed_by_br = {}
    for br_ea, cond, true_target, false_target in SEED_EDGES:
        block_start = block_start_for_br(br_ea, starts)
        if block_start is None:
            continue
        seed_by_br[br_ea] = (cond, true_target, false_target)
        queue.append((block_start, None, br_ea))

seen_jobs = set()
    seen_brs = {br for br, _, _, _ in SEED_EDGES}
    recovered = []

while queue:
        start, initial_regs, expected_br = queue.pop(0)
        if not (START_EA <= start < END_EA):
            continue

# The same block may need to be revisited with a different predecessor state.
        state_key = tuple(sorted((k, v) for k, v in (initial_regs or {}).items() if item_ok(v)))
        job_key = (start, expected_br, state_key)
        if job_key in seen_jobs:
            continue
        seen_jobs.add(job_key)

result = analyze_block(start, initial_regs)
        if result is None:
            continue
        row = result["row"]
        regs_at_br = result["regs"]
        actual_br = result["br"]

if expected_br is not None and actual_br != expected_br:
            continue

if row is None and expected_br in seed_by_br:
            cond, target_t, target_f = seed_by_br[expected_br]
            queue.append((target_t, regs_at_br, None))
            queue.append((target_f, regs_at_br, None))
            continue

if row is None:
            continue

br_ea, cond, target_t, target_f, block_start, csel_ea, ldr_ea = row
        if br_ea not in seen_brs:
            recovered.append(row)
            seen_brs.add(br_ea)
        queue.append((target_t, regs_at_br, None))
        queue.append((target_f, regs_at_br, None))

for br_ea, cond, target_t, target_f, block_start, csel_ea, ldr_ea in recovered:
        out("0x%X %s 0x%X, B 0x%X" % (br_ea, cond, target_t, target_f))

out("recovered %d new table branches" % len(recovered))

if __name__ == "__main__":
    main()
```

输出：

```
0x210B00 EQ 0x210BD4, B 0x210B04
0x210E34 EQ 0x210EAC, B 0x210E38
0x210B28 EQ 0x210B2C, B 0x210ADC
0x210E68 EQ 0x210EE4, B 0x210E10
0x210C60 EQ 0x210CB4, B 0x210C64
0x210CD8 EQ 0x210E6C, B 0x210CDC
0x210C88 EQ 0x210BD4, B 0x210C8C
0x210D04 EQ 0x210BD4, B 0x210CB4
0x210CB0 EQ 0x210CB4, B 0x210C64
```

这样剩下的跳转关系也齐了。

patch完效果如下

![](upload/attach/202607/1008445_RC4F6Y8TBX5TEGN.png)

其他间接跳转也可以使用脚本，改一下开头的起始地址，结束地址，表地址即可，也可以写脚本自动提取。

![](upload/attach/202607/1008445_XSM4MS8BKV87S2V.png)

这是随便找了另一个间接跳转函数去除的效果，中间出现的一些值是间接跳转的遗留产物，不影响正常逻辑

![](upload/attach/202607/1008445_VFWVWZ2RWCBGJKR.png)

觉得影响也可以patch掉

**控制流平坦化**

以`xxx_sdk_encryptpacket`函数为例

![](upload/attach/202607/1008445_2RBAESHUTSJFR2Z.png)

观察cfg图，这四块明显是控制流平坦化中的分发块

最上面的控制流平坦化结构如下

![](upload/attach/202607/1008445_CTKYBMG5YQFUKTT.png)

用来比较的是w21和其他寄存器，但是这些寄存器在入口块就已经赋值过了，所以这块分发块是有固定的执行顺序的

```
0x1B9C84 -> 0x1B9C9C
0x1B9CA0 -> 0x1B9CCC,
0x1B9CD0 -> 0x1B9CD4,
0x1B9CD8 -> 0x1B9EE4,
```

这个地方的跳转关系可以轻松得到。

剩下三块分发块都是下面这个结构

![](upload/attach/202607/1008445_RMZ96NNCCQPN8BF.png)

以w8寄存器作为对比寄存器，基本块跳转地址为`loc_1B9F9C`

![](upload/attach/202607/1008445_PK5R7MP66FY342R.png)

这个地方将保存的case值赋给w8，再跳转到分发块进行分发。

之前说到fla去除有三步：获取基本块case值、遍历分发块的case值得到跳转地址、patch

现在已知分发块结构为cmp x8, reg + B.cond，而用来比较的reg一定在之前被赋值过，那么就可以写脚本得到分发块表。

```python
import re

import ida_funcs
import idautils
import ida_lines
import idc

FUNC_EA = 0x1B9C24
MAX_BACKTRACK = 0x800
MASK32 = 0xFFFFFFFF
DEF_MNEMS = {"mov", "movz", "movn", "movk", "add", "sub", "orr", "eor", "csel"}

def msg(line):
    try:
        print(line)
    except Exception:
        pass

def clean(text):
    return ida_lines.tag_remove(text or "").strip()

def mnem(ea):
    return clean(idc.print_insn_mnem(ea)).lower()

def op(ea, n):
    return clean(idc.print_operand(ea, n))

def is_reg(ea, n):
    return idc.get_operand_type(ea, n) == idc.o_reg

def imm(ea, n):
    if idc.get_operand_type(ea, n) in (idc.o_imm, idc.o_near, idc.o_far):
        return idc.get_operand_value(ea, n) & MASK32
    return None

def mov_shift(ea):
    for n in range(1, 5):
        text = op(ea, n)
        m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", text, re.I)
        if m:
            return int(m.group(1), 0)
    line = clean(idc.generate_disasm_line(ea, 0))
    m = re.search(r"lsl\s*#?\s*(0x[0-9a-f]+|\d+)", line, re.I)
    return int(m.group(1), 0) if m else 0

def prev_head(ea, start):
    p = idc.prev_head(ea, start)
    return None if p == idc.BADADDR or p < start else p

def next_head(ea, end):
    n = idc.next_head(ea, end)
    return None if n == idc.BADADDR or n >= end else n

def is_cond_branch(ea):
    name = mnem(ea)
    return name.startswith("b.") and name not in ("b.al", "b.nv")

def branch_cond(ea):
    name = mnem(ea)
    return name[2:].upper() if name.startswith("b.") else name.upper()

def branch_target_text(ea):
    text = op(ea, 0)
    value = idc.get_operand_value(ea, 0)
    if value != idc.BADADDR:
        return "0x%X" % value
    return text

def apply_binop(name, a, b):
    if a is None or b is None:
        return None
    if name == "add":
        return (a + b) & MASK32
    if name == "sub":
        return (a - b) & MASK32
    if name == "orr":
        return (a | b) & MASK32
    if name == "eor":
        return (a ^ b) & MASK32
    return None

def operand_value(ea, n, func_start, depth, seen):
    if is_reg(ea, n):
        reg = norm_reg(op(ea, n))
        if reg in ("wzr", "xzr"):
            return 0
        return resolve_reg_value(reg, ea, func_start, depth + 1, seen)
    return imm(ea, n)

def resolve_reg_value(reg, before_ea, func_start, depth=0, seen=None):
    """Resolve constant value of reg immediately before before_ea."""
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return 0
    if seen is None:
        seen = set()
    key = (reg, before_ea)
    if key in seen or depth > 48:
        return None
    seen.add(key)

low = max(func_start, before_ea - MAX_BACKTRACK)
    ea = prev_head(before_ea, func_start)
    while ea is not None and ea >= low:
        name = mnem(ea)
        dst = norm_reg(op(ea, 0))

if dst == reg and name in DEF_MNEMS:
            if name in ("mov", "movz"):
                value = imm(ea, 1)
                if value is not None:
                    return (value << mov_shift(ea)) & MASK32
                if is_reg(ea, 1):
                    return resolve_reg_value(op(ea, 1), ea, func_start, depth + 1, seen)
                return None

if name == "movn":
                value = imm(ea, 1)
                if value is None:
                    return None
                return (~(value << mov_shift(ea))) & MASK32

if name == "movk":
                value = imm(ea, 1)
                if value is None:
                    return None
                old = resolve_reg_value(reg, ea, func_start, depth + 1, seen)
                if old is None:
                    old = 0
                shift = mov_shift(ea)
                mask = (0xFFFF << shift) & MASK32
                return ((old & ~mask) | ((value & 0xFFFF) << shift)) & MASK32

if name in ("add", "sub", "orr", "eor"):
                a = operand_value(ea, 1, func_start, depth, seen)
                b = operand_value(ea, 2, func_start, depth, seen)
                return apply_binop(name, a, b)

return None

ea = prev_head(ea, func_start)

return None

def get_cmp_case_value(cmp_ea, func_start):
    if mnem(cmp_ea) != "cmp":
        return None
    if norm_reg(op(cmp_ea, 0)) != "w8":
        return None
    if not is_reg(cmp_ea, 1):
        return None
    return resolve_reg_value(norm_reg(op(cmp_ea, 1)), cmp_ea, func_start)

def find_flag_source_cmp_for_leaf(leaf_branch_ea, func_start):
    for xref in idautils.XrefsTo(leaf_branch_ea):
        pred = xref.frm
        if not is_cond_branch(pred):
            continue
        cmp_ea = prev_head(pred, func_start)
        if cmp_ea is None:
            continue
        if get_cmp_case_value(cmp_ea, func_start) is not None:
            return cmp_ea
    return None

def find_cases(func_ea=FUNC_EA):
    func = ida_funcs.get_func(func_ea)
    if not func:
        raise RuntimeError("function not found at 0x%X" % func_ea)

rows = []
    seen_addrs = set()
    ea = func.start_ea
    while ea is not None and ea < func.end_ea:
        if mnem(ea) == "cmp":
            br_ea = next_head(ea, func.end_ea)
            if br_ea is None or not is_cond_branch(br_ea):
                ea = next_head(ea, func.end_ea)
                continue

case_val = get_cmp_case_value(ea, func.start_ea)
            if case_val is None:
                ea = next_head(ea, func.end_ea)
                continue

other_jmp = next_head(br_ea, func.end_ea)
            if other_jmp is None:
                ea = next_head(ea, func.end_ea)
                continue

if ea not in seen_addrs:
                rows.append((ea, case_val, branch_cond(br_ea), branch_target_text(br_ea), other_jmp))
                seen_addrs.add(ea)
            ea = next_head(ea, func.end_ea)
            continue

if not is_cond_branch(ea):
            ea = next_head(ea, func.end_ea)
            continue

prev = prev_head(ea, func.start_ea)
        if prev is not None and mnem(prev) == "cmp":
            ea = next_head(ea, func.end_ea)
            continue

cmp_ea = find_flag_source_cmp_for_leaf(ea, func.start_ea)
        if cmp_ea is None:
            ea = next_head(ea, func.end_ea)
            continue
        case_val = get_cmp_case_value(cmp_ea, func.start_ea)
        other_jmp = next_head(ea, func.end_ea)
        if case_val is not None and other_jmp is not None and ea not in seen_addrs:
            rows.append((ea, case_val, branch_cond(ea), branch_target_text(ea), other_jmp))
            seen_addrs.add(ea)

ea = next_head(ea, func.end_ea)

return rows

def main():
    for addr, case_val, cond, eq_jmp, other_jmp in find_cases(FUNC_EA):
        msg(
            "{'addr' : 0x%X, 'caseVal' : 0x%X, 'cond' : '%s', 'eq_jmp' : %s, 'other_jmp' : 0x%X},"
            % (addr, case_val, cond, eq_jmp, other_jmp)
        )

if __name__ == "__main__":
    main()

```

输出

```
{'addr' : 0x1B9CE0, 'caseVal' : 0x1674F175, 'cond' : 'GE', 'eq_jmp' : 0x1B9CFC, 'other_jmp' : 0x1B9CE8},
{'addr' : 0x1B9CE8, 'caseVal' : 0xF740EF3C, 'cond' : 'GE', 'eq_jmp' : 0x1B9D18, 'other_jmp' : 0x1B9CF0},
{'addr' : 0x1B9CF0, 'caseVal' : 0x8CF6E865, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9CF8},
{'addr' : 0x1B9CFC, 'caseVal' : 0x4C0FA2CE, 'cond' : 'GE', 'eq_jmp' : 0x1B9D2C, 'other_jmp' : 0x1B9D04},
{'addr' : 0x1B9D04, 'caseVal' : 0x3C777BC5, 'cond' : 'GE', 'eq_jmp' : 0x1B9D40, 'other_jmp' : 0x1B9D0C},
{'addr' : 0x1B9D0C, 'caseVal' : 0x1674F175, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D14},
{'addr' : 0x1B9D18, 'caseVal' : 0x1042B5BC, 'cond' : 'GE', 'eq_jmp' : 0x1B9D48, 'other_jmp' : 0x1B9D20},
{'addr' : 0x1B9D20, 'caseVal' : 0xF740EF3C, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D28},
{'addr' : 0x1B9D2C, 'caseVal' : 0x6C23C62F, 'cond' : 'GE', 'eq_jmp' : 0x1B9D50, 'other_jmp' : 0x1B9D34},
{'addr' : 0x1B9D34, 'caseVal' : 0x4C0FA2CE, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D3C},
{'addr' : 0x1B9D40, 'caseVal' : 0x3C777BC5, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D44},
{'addr' : 0x1B9D48, 'caseVal' : 0x1042B5BC, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D4C},
{'addr' : 0x1B9D50, 'caseVal' : 0x6C23C62F, 'cond' : 'NE', 'eq_jmp' : 0x1B9CE0, 'other_jmp' : 0x1B9D54},
{'addr' : 0x1B9DA4, 'caseVal' : 0xF740EF3C, 'cond' : 'GE', 'eq_jmp' : 0x1B9F1C, 'other_jmp' : 0x1B9DAC},
{'addr' : 0x1B9DAC, 'caseVal' : 0x8CF6E865, 'cond' : 'EQ', 'eq_jmp' : 0x1B9D80, 'other_jmp' : 0x1B9DB4},
{'addr' : 0x1B9DB8, 'caseVal' : 0x4C0FA2CE, 'cond' : 'GE', 'eq_jmp' : 0x1B9E80, 'other_jmp' : 0x1B9DC0},
{'addr' : 0x1B9DC0, 'caseVal' : 0x3C777BC5, 'cond' : 'GE', 'eq_jmp' : 0x1B9E40, 'other_jmp' : 0x1B9DC8},
{'addr' : 0x1B9DC8, 'caseVal' : 0x1674F175, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9DD0},
{'addr' : 0x1B9E40, 'caseVal' : 0x3C777BC5, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9E44},
{'addr' : 0x1B9E80, 'caseVal' : 0x6C23C62F, 'cond' : 'LT', 'eq_jmp' : 0x1B9EDC, 'other_jmp' : 0x1B9E88},
{'addr' : 0x1B9E88, 'caseVal' : 0x6C23C62F, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9E8C},
{'addr' : 0x1B9EDC, 'caseVal' : 0x4C0FA2CE, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9EE4},
{'addr' : 0x1B9F14, 'caseVal' : 0xF740EF3C, 'cond' : 'LT', 'eq_jmp' : 0x1B9F94, 'other_jmp' : 0x1B9F1C},
{'addr' : 0x1B9F1C, 'caseVal' : 0x1042B5BC, 'cond' : 'GE', 'eq_jmp' : 0x1B9F70, 'other_jmp' : 0x1B9F24},
{'addr' : 0x1B9F24, 'caseVal' : 0xF740EF3C, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9F2C},
{'addr' : 0x1B9F70, 'caseVal' : 0x1042B5BC, 'cond' : 'NE', 'eq_jmp' : 0x1B9F9C, 'other_jmp' : 0x1B9F74},
{'addr' : 0x1B9F94, 'caseVal' : 0x8CF6E865, 'cond' : 'EQ', 'eq_jmp' : 0x1B9D58, 'other_jmp' : 0x1B9F9C},
```

再看基本块

![](upload/attach/202607/1008445_G3KJYWUHFDCTD8U.png)

基本块尾部将case值赋值到内存中，然后跳转到分发块进行分发。case值则是通过mov + movk赋值的

```python
import re

import ida_funcs
import ida_gdl
import ida_lines
import idc

FUNC_EA = 0x1B9C24
MASK32 = 0xFFFFFFFF
MAX_BACKTRACK = 0x120
DEF_MNEMS = {"mov", "movz", "movn", "movk", "add", "sub", "orr", "eor", "csel"}

def out(line):
    print(line)

def clean(text):
    return ida_lines.tag_remove(text or "").strip()

def mnem(ea):
    return clean(idc.print_insn_mnem(ea)).lower()

def op(ea, n):
    return clean(idc.print_operand(ea, n))

def is_reg(ea, n):
    return idc.get_operand_type(ea, n) == idc.o_reg

def imm(ea, n):
    if idc.get_operand_type(ea, n) in (idc.o_imm, idc.o_near, idc.o_far):
        return idc.get_operand_value(ea, n) & MASK32
    return None

def prev_head(ea, start):
    p = idc.prev_head(ea, start)
    return None if p == idc.BADADDR or p < start else p

def next_head(ea, end):
    n = idc.next_head(ea, end)
    return None if n == idc.BADADDR or n >= end else n

def operand_value(ea, n, low, depth, seen):
    if is_reg(ea, n):
        reg = norm_reg(op(ea, n))
        if reg in ("wzr", "xzr"):
            return 0
        return resolve_reg_value(reg, ea, low, depth + 1, seen)
    return imm(ea, n)

def resolve_reg_value(reg, before_ea, low, depth=0, seen=None):
    reg = norm_reg(reg)
    if reg in ("wzr", "xzr"):
        return 0
    if seen is None:
        seen = set()
    key = (reg, before_ea)
    if key in seen or depth > 48:
        return None
    seen.add(key)

ea = prev_head(before_ea, low)
    while ea is not None and ea >= low:
        name = mnem(ea)
        dst = norm_reg(op(ea, 0))
        if dst != reg or name not in DEF_MNEMS:
            ea = prev_head(ea, low)
            continue

if name in ("mov", "movz"):
            value = imm(ea, 1)
            if value is not None:
                return (value << mov_shift(ea)) & MASK32
            if is_reg(ea, 1):
                return resolve_reg_value(op(ea, 1), ea, low, depth + 1, seen)
            return None

if name == "movn":
            value = imm(ea, 1)
            return None if value is None else (~(value << mov_shift(ea))) & MASK32

if name == "movk":
            value = imm(ea, 1)
            if value is None:
                return None
            old = resolve_reg_value(reg, ea, low, depth + 1, seen)
            if old is None:
                old = 0
            shift = mov_shift(ea)
            mask = (0xFFFF << shift) & MASK32
            return ((old & ~mask) | ((value & 0xFFFF) << shift)) & MASK32

if name in ("add", "sub", "orr", "eor"):
            a = operand_value(ea, 1, low, depth, seen)
            b = operand_value(ea, 2, low, depth, seen)
            return apply_binop(name, a, b)

if name == "csel":
            # The caller handles W8=CSEL specially so it can emit both successors.
            return None

return None

def find_last_def(reg, before_ea, low):
    reg = norm_reg(reg)
    ea = prev_head(before_ea, low)
    while ea is not None and ea >= low:
        if mnem(ea) in DEF_MNEMS and norm_reg(op(ea, 0)) == reg:
            return ea
        ea = prev_head(ea, low)
    return None

def is_next_case_store(ea):
    if mnem(ea) != "stur":
        return False
    if norm_reg(op(ea, 0)) != "w8":
        return False
    mem = op(ea, 1).replace(" ", "").lower()
    return "x29" in mem and ("var_1c" in mem or "#-0x1c" in mem or "#-28" in mem)

def find_block_for_ea(func, ea):
    for block in ida_gdl.FlowChart(func):
        if block.start_ea <= ea < block.end_ea:
            return block
    return None

def is_terminal(ea):
    name = mnem(ea)
    return name == "ret" or name == "br" or name == "b" or name.startswith("b.")

def linear_block_start(func, ea):
    cur = ea
    prev = prev_head(cur, func.start_ea)
    while prev is not None and prev >= func.start_ea:
        if is_terminal(prev):
            return cur
        cur = prev
        prev = prev_head(cur, func.start_ea)
    return func.start_ea

def find_block_jump_after_store(func, store_ea):
    ea = next_head(store_ea, func.end_ea)
    while ea is not None and ea < func.end_ea:
        if is_terminal(ea):
            return ea
        ea = next_head(ea, func.end_ea)
    return None

def analyze_store(func, store_ea):
    block = find_block_for_ea(func, store_ea)
    if block is None:
        return None

block_start = linear_block_start(func, store_ea)
    jump_ea = find_block_jump_after_store(func, store_ea)
    if jump_ea is None:
        return None
    search_low = max(func.start_ea, store_ea - MAX_BACKTRACK)
    def_ea = find_last_def("w8", store_ea, search_low)
    if def_ea is None:
        return None

if mnem(def_ea) == "csel":
        src_eq = norm_reg(op(def_ea, 1))
        src_other = norm_reg(op(def_ea, 2))
        cond = op(def_ea, 3).upper()
        eq_val = resolve_reg_value(src_eq, def_ea, search_low)
        other_val = resolve_reg_value(src_other, def_ea, search_low)
        if eq_val is None or other_val is None:
            return None
        return (
            "{'basicBlockAddr' : 0x%X, 'eqCaseVal' : 0x%X, 'otherCaseVal' : 0x%X, 'cond' : '%s'},"
            % (jump_ea, eq_val, other_val, cond)
        )

value = resolve_reg_value("w8", store_ea, search_low)
    if value is None:
        return None
    return "{'basicBlockAddr' : 0x%X, 'nextCaseVal' : 0x%X}," % (jump_ea, value)

def main():
    func = ida_funcs.get_func(FUNC_EA)
    if func is None:
        raise RuntimeError("function not found at 0x%X" % FUNC_EA)

ea = func.start_ea
    while ea is not None and ea < func.end_ea:
        if is_next_case_store(ea):
            line = analyze_store(func, ea)
            if line:
                out(line)
        ea = next_head(ea, func.end_ea)

if __name__ == "__main__":
    main()
```

输出g

```
{'basicBlockAddr' : 0x1B9DA0, 'eqCaseVal' : 0xF740EF3C, 'otherCaseVal' : 0x6C23C62F, 'cond' : 'EQ'},
{'basicBlockAddr' : 0x1B9E38, 'nextCaseVal' : 0x1042B5BC},
{'basicBlockAddr' : 0x1B9E78, 'nextCaseVal' : 0x1042B5BC},
{'basicBlockAddr' : 0x1B9ED4, 'eqCaseVal' : 0xF740EF3C, 'otherCaseVal' : 0x3C777BC5, 'cond' : 'EQ'},
{'basicBlockAddr' : 0x1B9F10, 'nextCaseVal' : 0x8CF6E865},
{'basicBlockAddr' : 0x1B9F68, 'eqCaseVal' : 0x1042B5BC, 'otherCaseVal' : 0x1674F175, 'cond' : 'EQ'},
```

有两个表之后，就可以依据跳转关系用python处理得到跳转关系

```
0x1B9C84 -> 0x1B9C9C
0x1B9CA0 -> 0x1B9CCC,
0x1B9CD0 -> 0x1B9CD4,
0x1B9CD8 -> 0x1B9EE4,

0x1B9DA0 EQ 0x1B9D28, B 0x1B9D54,
0x1B9E38 -> 0x1B9D4C,
0x1B9E78 -> 0x1B9D4C,
0x1B9ED4 EQ 0x1B9D28, B 0x1B9D44,
0x1B9F10 -> 0x1B9CF8,
0x1B9F68 EQ 0x1B9D4C, B 0x1B9D14,
```

patch后效果如下

![](upload/attach/202607/1008445_EJAQEN387PEHVD5.png)

一些垃圾值依旧是控制流平坦化赋值遗留下的产物，觉得不干净也可以将赋值case指令都nop掉。

其他fla也与此类似，按照步骤进行处理即可

## 小结

混淆重要的不是如何去除，而是理解混淆的原理。了解原理之后自然就有方法去除了。

作为一个安卓蒟蒻，如果文章中有任何错误，欢迎各位大佬指正(≧﹏ ≦)，也欢迎各位大神和我交流不同的看法orz

回复或点赞可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

最后于 2026-7-17 17:34 被mb_wckjnnha编辑，原因：

#混淆加固 #脱壳反混淆

最新回复 (48) 1 2 ▶
xingbing 雪币： 158 活跃值： (5706) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 1381 粉丝 2 关注私信	xingbing 2 楼学习 2026-7-17 15:42 0
PangBai 雪币： 187 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 32 粉丝 1 关注私信	PangBai 3 楼学习 2026-7-17 17:32 0
mb_ldbucrik 雪币： 6 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 693 粉丝 7 关注私信	mb_ldbucrik 4 楼感谢分享 2026-7-17 20:52 0
x1a0f3n9 雪币： 48 活跃值： (1690) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 60 粉丝 90 关注私信	x1a0f3n9 5 楼谢谢 2026-7-18 00:15 0
TheLuckyOne 雪币： 250 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 19 粉丝 0 关注私信	TheLuckyOne 6 楼学习 2026-7-18 01:35 0
wx_Huber Barrientos 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 211 粉丝 1 关注私信	wx_Huber Barrientos 7 楼 666 2026-7-18 03:42 0
Thehepta 雪币： 3596 活跃值： (7395) 能力值： ( LV11，RANK：185 ) 在线值：发帖 23 回帖 235 粉丝 282 关注私信	Thehepta 3 8 楼 6 2026-7-18 11:50 0
mb_qimctavn 雪币： 5244 活跃值： (6655) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 390 粉丝 1 关注私信	mb_qimctavn 9 楼 6 2026-7-18 12:32 0
CJ_353959 雪币： 0 活跃值： (280) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 5 粉丝 0 关注私信	CJ_353959 10 楼 666 2026-7-18 15:39 0
学计算机睡觉雪币： 779 活跃值： (1237) 能力值： ( LV3，RANK：30 ) 在线值：发帖 3 回帖 94 粉丝 4 关注私信	学计算机睡觉 11 楼 666 2026-7-18 17:29 0
iBa0 雪币： 1560 活跃值： (5848) 能力值： ( LV4，RANK：40 ) 在线值：发帖 6 回帖 483 粉丝 37 关注私信	iBa0 12 楼 1 2026-7-18 22:12 0
B.M.K 雪币： 234 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 98 粉丝 0 关注私信	B.M.K 13 楼 1 2026-7-18 22:16 0
wx_插曲雪币： 411 活跃值： (881) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 317 粉丝 24 关注私信	wx_插曲 14 楼 1 2026-7-19 16:20 0
Gryffindoss 雪币： 635 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 125 粉丝 0 关注私信	Gryffindoss 15 楼 213123123 2026-7-19 18:40 0
FMNS 雪币： 9 活跃值： (1986) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 119 粉丝 1 关注私信	FMNS 16 楼感谢分享 2026-7-19 19:37 0
Imxz 雪币： 112 活跃值： (9435) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 754 粉丝 9 关注私信	Imxz 17 楼 tql 2026-7-20 09:15 0
hanjiefang 雪币： 219 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 120 粉丝 0 关注私信	hanjiefang 18 楼 666 2026-7-20 13:39 0
guijingwen 雪币： 7338 活跃值： (7535) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 306 粉丝 0 关注私信	guijingwen 19 楼 66 2026-7-20 13:50 0
mb_nwtotthp 雪币： 8 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	mb_nwtotthp 20 楼感谢分享 2026-7-20 18:22 0
kingking888 雪币： 3168 活跃值： (6234) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 292 粉丝 6 关注私信	kingking888 21 楼 666 2026-7-21 00:22 0
Zepp7289 雪币： 200 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 138 粉丝 0 关注私信	Zepp7289 22 楼 tql 2026-7-21 15:57 0
mb_cbgtaveo 雪币： 292 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 253 粉丝 0 关注私信	mb_cbgtaveo 23 楼 666666666666 2026-7-21 16:10 0
BitWarden 雪币： 2473 活跃值： (1910) 能力值： ( LV8，RANK：120 ) 在线值：发帖 10 回帖 53 粉丝 70 关注私信	BitWarden 2 24 楼学习中 2026-7-22 11:20 0
悠久之翼灬雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 9 粉丝 0 关注私信	悠久之翼灬 25 楼 66 2026-7-23 16:14 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复