Open Semnodime opened 1 year ago
It's likely due to repeatedly replacing nested proxy function calls in example A, resulting in larger and larger code each time. Whereas in example B Pe
isn't detected as a proxy function, due to now having statements other than just a simple return, so this issue doesn't occur.
For something like example A the best option is to disable the proxy function removal setting.
I wanted to help out and started digging into the cause of #36. Although I was unable to locate the core issue ( I believe the deobfuscation would actually finish, although allowing a deobfuscation parameter to limit the time spent on reversing any particular function would be nice), I stumbled upon something:
Deobfuscating example A leads to vastly different results in comparison to deobfuscating example B
This feels somewhat ackward and I wonder whether there's a bug or how this happens.
@ben-sb It'd be nice if you could throw in a guess
Example A
Example B
Note: Differs only in this part, where the return statement with the comma expression in
Pe
is refactored into two statements: