Produce a string for an operand type

-------------------------------------------------------------------------- compare operands but ignore the sizes

For microinstructions with two or more operands (in l and r), check to see if one of them is numeric and the other one isn't. If this is the case, ret

The obfuscation techniques upon conditional operations have "&1" miscellaneously present or not present within them. Writing pattern-matching rules fo

Produce a brief representation of a microinstruction, including the types of its operands.

Produce a string describing the microcode maturity level.

The obfuscator implements boolean inversion via "x ^ 1". Hex-Rays, or one of our other deobfuscation rules, could also convert these to m_lnot instruc

For microinstructions with two or more operands (in l and r), check to see if one of them is a mop_d (result of another microinstruction), where the p

Put an mop_t into an mlist_t. The op must be either a register or a stack variable.

Append a goto onto a non-empty block, which is assumed not to already have a goto at the end of it.

For a block that ends in a conditional jump, extract the integer block numbers for the "taken" and "not taken" cases.

Insert a micro-operand into one of the two sets above. Remove duplicates -- meaning, if the operand we're trying to insert is already in the set, remo

Plan to replace an edge from src->oldDest to src->newDest

Apply the planned changes to the graph

This function checks whether two conditional terms are logically opposite. For example, "eax <s 1" and "eax >=s 1" would be considered logically oppos

Either change the destination of an existing goto, or add a new goto onto the end of the block to the destination. Also, plan to modify the graph stru

For a block with a single successor, change its target from some old block to a new block. This is only on the graph level, not in terms of gotos.

Compute dominator information for the function.

Delete all instructions on a block, and remove its outgoing edges. Blocks will be deleted if we have removed edges in the graph such that the block is

Convenience function to look up a block number by its key. This way, we can write the iterator-end check once, so clients don't have to do it.

This function finds a numeric definition by searching in the forward direction.

This function is just a thin wrapper around FindForwardNumericDef, which also inserts the mov into the "chain" argument.

This function has way too many arguments. Basically, it's a wrapper around my_find_def_backwards from above. It is extended in the following ways: If

Find all calls to __alloca_probe, extract the parameters, and update the stack pointer differentials.

This function computes all of the preliminary information needed for unflattening.

This function finds the "first" block immediately before the control flow flattening dispatcher begins. The logic is simple; start at the beginning of

This function just inspects the instruction and calls the pattern-replacement functions above to perform deobfuscation.

The goto-to-goto elimination and unflattening phases remove edges in the control flow graph represented in the mbl_array_t *. As a result, certain blo

This function eliminates transfers to blocks with a single goto on them. Either if a given block has a goto at the end of it, where the destination is

This method determines whether a given function is likely obfuscated. It does this by ensuring that: 1) Some minimum number of comparisons are made ag

Top-level functionality to simplify an XOR microinstruction. Insert the instruction, then see if any simplifications could be performed. If so, remove

For a block with two predecessors, figure out if one of them ends in a jcc instruction. Return pointers to the block that ends in a jcc and the one th

Reverse engineered from hexrays.dll (though it's obvious). Basically: does this block end in a call instruction?

Ilfak sent me this function in response to a similar support request. It walks backwards through a block, instruction-by-instruction, looking at what

This is a nearly identical version of the function above, except it works in the forward direction rather than backwards.

Plan to add an edge from src->dest

Were any cancellations performed?

This function attempts to locate the numeric assignment to a given variable "what" starting from the end of the block "mb". It follows definitions bac

Compare two sets of mop_t * (number values) element-by-element. There should be one value in the larger set that's not in the smaller set. Find and re

Find the block that dominates iDispPred, and which is one of the targets of the control flow flattening switch.

This function is used for unflattening constructs that have two successors, such as if statements. Given a block that assigns to the assignment variab

Wrapper to insert constant and non-constant terms

Compare two sets of mop_t * element-by-element. Return true if they match.

Erase the now-superfluous chain of instructions that were used to copy a numeric value into the assignment variable.

Plan to remove an edge from src->dest

This is the top-level un-flattening function for an entire graph. Hex-Rays calls this function since we register our CFUnflattener class as a block op

Callback function. Do pattern-deobfuscation.

--------------------------------------------------------------------------

Matches patterns of the form: (a^b^c^d) & (a^b^c^d^e) => (a^b^c^d) & ~e, where e is numeric The terms don't necessarily have to be in the same order;

Replaces terms of the form ~(~x | n), where n is a number, with x & ~n.

One of the obfuscation patterns involves a subtraction by 1. In the assembly code, this is implemented by something like: add eax, 2 add eax, ecx ; o

Replaces conditionals of the form !(!c1 || !c2) with (c1 && c2).

This function simplifies microinstruction patterns that look like either: (x & 1) | (y & 1) ==> (x | y) & 1 or: (x & 1) ^ (y & 1) ==> (x ^ y) & 1

This function performs the following pattern-substitution: (x * (x-1)) & 1 ==> 0

Replace patterns of the form (x&c)|(~x&d) (when c and d are numbers such that c == ~d) with x^d.

This pattern replaces microcode of the form (x|!x), where x is a conditional, and !x is its syntactically-negated version, with 1.

This function looks tries to replace patterns of the form either: (x&y)|(x^y) ==> x|y or: (x&y)|(y^x) ==> x|y

Remove XOR chains with common terms. E.g. x^5^y^6^5^x ==> y^6. This uses the XorSimplifier class from PatternDeobfuscateUtil.

--------------------------------------------------------------------------

--------------------------------------------------------------------------