Mark Lim peta909

IDAPython CTREE

Important links

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

IDA Microcode notes

References

Ilfak's presentation at Recon 2018
Microcode in pictures
Hex-Rays Microcode API vs. Obfuscating Compiler
Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

Counting number of times strings match in YARA with awk...

wxs@wxs-mbp yara % cat rules/test.yara
rule a { strings: $a = "FreeBSD" nocase  $b = "usage: " condition: any of them }
wxs@wxs-mbp yara % ./yara -s rules/test.yara /bin/ls
a /bin/ls
0xb8e1:$a: FreeBSD
0xb9a1:$a: FreeBSD
0xb9f1:$a: FreeBSD

	#include "stdafx.h"
	#include <iostream>

	LPVOID lpJmpRealloc = nullptr;
	DWORD Backup_Eax, Handle, Address_1, New, Old, *DwSizee;

	const DWORD_PTR __declspec(naked) GetGateAddress()
	{
	__asm
	{

	#include <Windows.h>

	#include <iostream>
	#include "ntdll_undoc.h"

	PPEB get_default_peb()
	{
	#if defined(_WIN64)
	return (PPEB)__readgsqword(0x60);
	#else

	; x96 shellcode (x32+x64) by [email protected]
	; yasm -f bin -o x96shell_msgbox x96shell_msgbox.asm
	section .text
	bits 32
	_main:
	call entry
	entry:
	mov ax, cs
	sub ax, 0x23
	jz retTo32b

	#########################################
	# Created by @kuroi_dotsh - KuroiSH #
	# Website: https://dengisan.nl/ #
	# E-mail: [email protected] #
	#########################################

	;
	; The executable is stored in the final section, so that it does not need
	; relocations (as we can simply load it over our own headers and pad with
	; virtualsize to keep our module running).