llvm-deobfuscator icon indicating copy to clipboard operation
llvm-deobfuscator copied to clipboard

Modify deobfuscated IL in place

Open toshipiazza opened this issue 4 years ago • 1 comments

Blocking on https://github.com/Vector35/binaryninja-api/issues/1606

Right now, we undo control flow flattening by patching the binary and saving it to disk. Now that binja has a decompiler, it's worth updating the IL instead, keeping everything platform-independent.

Since we're completely reconstructing the function, I see two solutions here:

  1. incrementally update control flow, re-placing phi nodes as we go (or)
  2. completely re-build the IL for the function w/ correct control flow fixups

But it all depends on how the feature works in binja when it's ready

toshipiazza avatar May 04 '20 19:05 toshipiazza

This also makes it easier to deobfuscate OLLVM's opaque predicates, which we currently don't bother doing.

toshipiazza avatar May 04 '20 19:05 toshipiazza