llvm deobfuscator fail

Question

llvm deobfuscator fail

ZakiG opened this issue 6 years ago · comments

As you can see, there is a problem when we remove the confusion. How can we solve it
Errors is as follows:

Call target 0x0 does not appear to be code in instruction at 0x4005ce Function at 0x4005e0 is too large, skipping analysis Analysis update took 0.050 seconds Error fetching version list: Update authentication failed Analysis update took 0.000 seconds Exception in thread Thread-2: Traceback (most recent call last): File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner self.run() File "/home/XXXXX/binaryninja/plugins/../python/binaryninja/plugin.py", line 420, in run self.task.run() File "/home/XXXXX/.binaryninja/plugins/llvm-deobfuscator-e7ec09ea4ae0d52ee9a4d28ff9f391c7efea2a57/__init__.py", line 16, in run self.func(bv, self.addr) File "/home/XXXXX/.binaryninja/plugins/llvm-deobfuscator-e7ec09ea4ae0d52ee9a4d28ff9f391c7efea2a57/deflatten.py", line 295, in deflatten_cfg state_var = func.get_low_level_il_at(addr).medium_level_il.dest AttributeError: 'NoneType' object has no attribute 'medium_level_il'

Thanks

Kareem ElFaramawi · Answer 1 · Wed Nov 28 2018 03:35:36 GMT+0800 (China Standard Time)

@ZakiG could you provide the binary you're having this issue with?

ZakiG · Answer 2 · Wed Nov 28 2018 09:42:09 GMT+0800 (China Standard Time)

Of course, this is the binary Kareem El-Faramawi <notifications@github.com> 于2018年11月28日周三上午3:35写道：

…

@ZakiG <https://github.com/ZakiG> could you provide the binary you're having this issue with? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AQky0K57zIqkSiQGyoKBVW15pqK-C6RLks5uzZQLgaJpZM4YxbWB> .

Kareem ElFaramawi · Answer 3 · Wed Nov 28 2018 10:22:23 GMT+0800 (China Standard Time)

Email attachments don't work with github, can you upload it somewhere and post a link?

ZakiG · Answer 4 · Wed Nov 28 2018 19:04:28 GMT+0800 (China Standard Time)

OK, you can get binary from here: https://transfer.sh/1OOtg/Interpreter Kareem El-Faramawi <notifications@github.com> 于2018年11月28日周三上午10:22写道：

…

Email attachments don't work with github, can you upload it somewhere and post a link? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AQky0N3TFjPXYtmk9wgBCK_D4x0Xt4ioks5uzfNggaJpZM4YxbWB> .

ZakiG · Answer 5 · Thu Nov 29 2018 15:31:15 GMT+0800 (China Standard Time)

Emmm, how can I solve this problem finally ,thanks~ Kareem El-Faramawi <notifications@github.com> 于2018年11月29日周四上午4:02写道：

…

Closed #1 <#1> via 88dcec9 <88dcec9> . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AQky0KmOnDErFdnckFkqcNJnKC4gOvp9ks5uzuvjgaJpZM4YxbWB> .

Kareem ElFaramawi · Answer 6 · Thu Nov 29 2018 15:35:18 GMT+0800 (China Standard Time)

You should be able to just update the plugin and it'll be fixed, commit 88dcec9 fixes the issue. The problem was that binja wasn't fully analyzing the function, and this forces it to complete analysis.