llvm-deobfuscator
llvm-deobfuscator copied to clipboard
Modify deobfuscated IL in place
Blocking on https://github.com/Vector35/binaryninja-api/issues/1606
Right now, we undo control flow flattening by patching the binary and saving it to disk. Now that binja has a decompiler, it's worth updating the IL instead, keeping everything platform-independent.
Since we're completely reconstructing the function, I see two solutions here:
- incrementally update control flow, re-placing phi nodes as we go (or)
- completely re-build the IL for the function w/ correct control flow fixups
But it all depends on how the feature works in binja when it's ready
This also makes it easier to deobfuscate OLLVM's opaque predicates, which we currently don't bother doing.