-
-
[分享]某团间接跳转混淆还原
-
发表于: 2023-3-27 16:35
-
前阵子分析某团，so层有比较重的混淆，除了一些简单的可整体nop的花指令以外，还有大量的间接跳转混淆（原理参考f53K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6S2L8h3W2E0L8#2)9J5c8X3N6G2M7X3!0F1i4@1g2r3i4@1u0o6i4K6R3&6i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1#2i4K6R3^5i4K6W2m8i4@1f1#2i4@1p5#2i4@1u0p5i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1&6i4K6V1^5i4@1t1#2i4@1f1#2i4@1q4p5i4K6V1H3i4@1f1#2i4K6W2o6i4@1p5^5i4@1f1&6i4@1u0q4i4K6V1&6i4@1f1#2i4K6V1K6i4@1p5#2i4@1f1&6i4K6R3J5i4@1p5K6i4@1f1#2i4@1q4p5i4@1p5$3i4@1f1@1i4@1u0m8i4K6R3$3i4@1f1#2i4K6R3%4i4@1p5H3i4@1f1$3i4K6S2n7i4K6W2n7i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1@1i4@1t1^5i4K6R3&6i4@1f1@1i4@1t1^5i4K6S2n7i4@1f1@1i4@1u0m8i4K6V1@1i4@1f1&6i4K6V1&6i4@1p5@1i4@1f1@1i4@1u0m8i4K6S2o6i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1#2i4@1t1H3i4@1t1I4i4@1f1$3i4K6S2m8i4K6S2m8i4@1f1&6i4K6V1%4i4@1t1@1i4@1f1$3i4K6S2q4i4@1p5#2i4@1f1^5i4@1t1%4i4@1t1K6i4@1f1^5i4@1u0p5i4@1q4o6i4@1f1#2i4@1p5@1i4K6R3@1i4@1f1%4i4K6V1H3i4K6R3$3i4@1f1#2i4@1t1&6i4@1t1J5i4@1f1#2i4K6R3%4i4K6R3H3i4@1f1@1i4@1u0m8i4K6R3$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1^5i4@1u0r3i4K6V1&6i4@1f1&6i4K6R3%4i4K6S2o6i4@1f1#2i4K6R3I4i4K6W2m8i4@1f1@1i4@1t1^5i4@1q4m8i4@1f1^5i4K6R3@1i4K6W2m8i4@1f1$3i4K6W2o6i4@1q4o6i4@1f1#2i4K6R3^5i4K6R3$3i4@1f1@1i4@1u0m8i4@1q4n7i4@1g2r3i4@1u0o6i4K6W2m8
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 | import keystoneimport ida_bytesimport ida_idaimport ida_segmentimport ida_uaimport idaapiimport idautilsimport idc# 初始化汇编器的架构和模式ks = keystone.Ks(keystone.KS_ARCH_ARM64, keystone.KS_MODE_LITTLE_ENDIAN)def getAddrRange(): start = ida_ida.inf_get_min_ea() size = ida_ida.inf_get_max_ea() - start # 将地址范围限定于text节 for seg in idautils.Segments(): seg = idaapi.getseg(seg) segName = ida_segment.get_segm_name(seg) if segName == ".text": start = seg.start_ea size = seg.size() return start, sizedef binSearch(start, end, pattern): matches = [] addr = start if end == 0: end = idc.BADADDR if end != idc.BADADDR: end = end + 1 while True: addr = ida_bytes.bin_search(addr, end, bytes.fromhex(pattern), None, idaapi.BIN_SEARCH_FORWARD, idaapi.BIN_SEARCH_NOCASE) if addr == idc.BADADDR: break else: matches.append(addr) addr = addr + 1 return matchesdef generate(code, addr): encoding, _ = ks.asm(code, addr) return encoding# 不一定全，可以碰到再处理full_nop_list = [ "FF0301D1E0FB00A90100009480000010FE0300AAFF030191C0035FD6E0FB7CA9", "FFC300D1E07B01A90100009480000010FE0300AAFFC30091C0035FD6E07B7EA9", "FF4301D1E07B02A90100009480000010FE0300AAFF430191C0035FD6E07B7DA9", "FF4301D1E0FB00A90100009480000010FE0300AAFF430191C0035FD6E0FB7BA9", "FF4301D1E0FB01A90100009480000010FE0300AAFF430191C0035FD6E0FB7CA9", "E0FB3EA90100009460000010FE0300AAC0035FD6E0FB7EA9", "E07B3EA90100009460000010FE0300AAC0035FD6E07B7EA9", "E07B3FA90100009460000010FE0300AAC0035FD6E07B7FA9"]for i in range(len(full_nop_list)): matches = binSearch(0, 0, full_nop_list[i]) for matche in matches: print("flower" + str(i) + ":", hex(matche)) nopCode = generate("nop", 0) ida_bytes.patch_bytes(matche, bytes(nopCode) * int(len(full_nop_list[i]) / 8))# 获取代码段的起始地址和长度start, size = getAddrRange()insn = ida_ua.insn_t()indirect_jump_addr = []for i in range(0, size, 4): addr = start + i # decode_insn 返回长度，ARM64即4，无法解析则返回0 if idaapi.decode_insn(insn, addr): mnemonic = insn.get_canon_mnem() if mnemonic == "BL" and insn.Op1.addr == 0x14DFC: indirect_jump_addr.append(addr) # print(hex(addr))for i in range(0, size, 4): addr = start + i # decode_insn 返回长度，ARM64即4，无法解析则返回0 if idaapi.decode_insn(insn, addr): mnemonic = insn.get_canon_mnem() local_addr = insn.Op1.addr if mnemonic == "B" and local_addr in indirect_jump_addr: firstinsn = ida_ua.insn_t() idaapi.decode_insn(firstinsn, addr - 4) if firstinsn.get_canon_mnem() == 'MOV': value = firstinsn.Op2.value elif firstinsn.get_canon_mnem() == 'LDR': value = ida_bytes.get_dword(firstinsn.Op2.addr) else: print("需要额外处理") offset_addr = local_addr + 4 + 4 * value target_addr = local_addr + 4 + ida_bytes.get_dword(offset_addr) print("flower_indirect local_addr",hex(addr),"target_addr",hex(target_addr)) code = f"B {hex(target_addr)}" bCode = generate(code, addr) ida_bytes.patch_bytes(addr, bytes(bCode)) |
最后放一下龙哥星球的邀请链接~IDA脚本反混淆系列文章真心赞！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
