search

cq674350529 / deflat

use angr to deobfuscation
555 stars 109 forks source link

Will it support arm64? #6

Closed LittleLydia closed 4 years ago

LittleLydia commented 4 years ago

It seems that one angr dependency cle doesn't support mach-o backend very well. What would be the possible ways to solve it?

cq674350529 commented 4 years ago

Do you have some binaries for testing purpose? Both raw binary and flatted binary with symbols compiled would be better.

If not, I can only have a try with aarch64 in Linux env.

LittleLydia commented 4 years ago

Thanks for the reply. I can provide some flattened arm64 binary with its raw binary later.

LittleLydia commented 4 years ago

testsformacho.zip

Here it is!

cq674350529 commented 4 years ago

Thanks! I'll have a try.

cq674350529 commented 4 years ago

@LittleLydia Currently, the aarch64 is supported via https://github.com/cq674350529/deflat/pull/7.

By the way, I didn't come accross any issues related to cle at the moment. In addition, another issue was fixed when more than one function call exist in the same block.

You can have a try. If any issues, feedback is welcomed.

Thanks!

LittleLydia commented 4 years ago

Cle does not support loading two and more binaries at the same time. So if a macho depends on many libraries, it will fail. Have emailed you a practical example and the log file. You can take a look.

cq674350529 commented 4 years ago

I tried the binary you provided with the latest angr, and I didn't came across the issue you mentioned.

However, angr seems to output wrong blocks of the target function. In addition, the flatted structure of the target function is different from those in demo binary. It'll take some time to debug it, since the binary is soooooooo big.

By the way, are you sure the target function is flatted?

Thanks!

cq674350529 commented 4 years ago

@LittleLydia Oops, it's hard for me to debug this binary currently. Since it's soooooooooo big, it will consume all my computer resources(CPU, memory) every time I run it with angr. Also, the IDA is also sloooooooooow to respond.