| 0x4010c0 handletest_x86.exe|push ebp|ebp=0x19ff74|esp=0x19ff2c | |
| 0x4010c1 handletest_x86.exe|mov ebp, esp|esp=0x19ff28 | |
| 0x4010c3 handletest_x86.exe|push 0x41e9bc|esp=0x19ff28 | |
| 0x4010c8 handletest_x86.exe|call 0x401080|esp=0x19ff24|eip=0x4010c8 | |
| 0x401080 handletest_x86.exe|push ebp|ebp=0x19ff28|esp=0x19ff20 | |
| 0x401081 handletest_x86.exe|mov ebp, esp|esp=0x19ff1c | |
| 0x401083 handletest_x86.exe|sub esp, 8|esp=0x19ff1c | |
| 0x401086 handletest_x86.exe|lea eax, [ebp + 0xc]|ebp=0x19ff1c | |
| 0x401089 handletest_x86.exe|mov dword ptr [ebp - 4], eax|ebp=0x19ff1c|eax=0x19ff28 | |
| 0x40108c handletest_x86.exe|mov ecx, dword ptr [ebp - 4]|ebp=0x19ff1c |
| # (C) Rolf Rolles, Mobius Strip Reverse Engineering, 9/21/2021. | |
| import idaapi | |
| from functools import reduce | |
| stl_map_keyvalue_fmt = ("struct {2}_{3}_keyvalue_t" | |
| "{{" | |
| "{0} key;" | |
| "{1} value;" | |
| "}};") |
| __int64 __fastcall DispatchDeviceControl(PDEVICE_OBJECT DeviceObject, IRP *arg_irp) | |
| { | |
| __int64 idx; // rdi | |
| _IO_STACK_LOCATION *CurrentStackLocation; // rbx | |
| ULONG_PTR len; // rdi | |
| ULONG InputBufferLength; // esi | |
| unsigned __int64 OutputBufferLength; // r12 | |
| int v8; // esi | |
| void *SystemBuffer; // r15 | |
| char v10; // al |
| import struct | |
| def extract_stage3(stage3_buffer): | |
| # struct stage3_header | |
| # { | |
| # uint32_t magic; | |
| # uint16_t block_count; | |
| # uint16_t header_size; | |
| # uint32_t entry_offset; |
| import idautils | |
| import idaapi | |
| import ida_bytes | |
| import ida_search | |
| import ida_segment | |
| import ida_nalt | |
| def find_function(pattern): | |
| text = ida_segment.get_segm_by_name('.text') | |
| return ida_search.find_binary(text.start_ea, text.end_ea, pattern, 16, ida_search.SEARCH_DOWN) |
| int __stdcall sub_10001100(_DWORD *a1, unsigned int a2, unsigned int a3) | |
| { | |
| _DWORD *v3; // edi | |
| unsigned int v4; // ebx | |
| unsigned int v5; // esi | |
| int v6; // edx | |
| unsigned int v7; // eax | |
| int v8; // ecx | |
| unsigned int v9; // edx | |
| unsigned __int16 *v10; // edx |
| #pragma once | |
| #include <stdint.h> | |
| #include "win_helper.h" | |
| namespace poc_kit | |
| { | |
| namespace pattern | |
| { |
| import time | |
| from typing import List | |
| import pefile | |
| from capstone import * | |
| from capstone.x86 import * | |
| import re | |
| import struct | |
| # SAMPLE_PATH = 'bin/enc_string_test.bin32' | |
| SAMPLE_PATH = 'bin/2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9.bin32' |
This Python script is designed to handle JMP deobfuscation.
It will sqash unneeded unconditional jmps and create new blocks, relocates blocks of code, adjusts relative addresses, and aligns blocks with padding.
Inspired by http://hooked-on-mnemonics.blogspot.com/2012/10/simple-deobfuscation-of-code.html