search

shamrockhoax / mazedecoder

28 stars 7 forks source link

How did the API used in the query script find the problem #1

Open VirMinions opened 3 years ago

VirMinions commented 3 years ago

Hello! After reading the script you wrote, I was greatly impressed, but also full of curiosity. Therefore, many APIs appeared in the script, which would never appear in my usual IDA Python script. I tried to read the documents and materials. Although IDA's official website included relevant documents, it did not explain the parameters. I wonder if you can give me some advice so that I can have a reasonable direction and resources to write scripts in the future.

shamrockhoax commented 3 years ago

Hello! After reading the script you wrote, I was greatly impressed, but also full of curiosity. Therefore, many APIs appeared in the script, which would never appear in my usual IDA Python script. I tried to read the documents and materials. Although IDA's official website included relevant documents, it did not explain the parameters. I wonder if you can give me some advice so that I can have a reasonable direction and resources to write scripts in the future.

Most of what I did started by looking at the IDA Python source directly. It can be located in IDAs installation directory. The code can be a bit annoying to comb through, but it is well documented. You can also find a lot of info in the Hex-rays SDK (https://hex-rays.com/products/ida/support/sdkdoc/group___v_t__.html). I also did a fair amount of googling and ended looking up how other people leveraged the IDAPython API.

VirMinions commented 3 years ago

Please tell me a question, after looking at your source code, I found that what it does is to remove all the code that is not parsed, obturate the code, and then analyze and rebuild a lot of functions.But there's still the problem of flattening, right?Is there a good solution if it still exists?

shamrockhoax commented 3 years ago

Yeah, the decoder isn't complete and functions well enough for reversing the binary. I didn't know that there was CFG flattening being applied. I plan on having another solution that would identify and remove CFG flattening, if it exists in maze. However, i haven't had time to work on it in a while. Rolf Rolles did a post on CFG Unflattening here: https://hex-rays.com/blog/hex-rays-microcode-api-vs-obfuscating-compiler/