Unidbg Trace 反 OLLVM 控制流平坦化（fla）

Unidbg Trace 反 OLLVM 控制流平坦化

最新推荐文章于 2025-03-31 12:15:32 发布

原创

最新推荐文章于 2025-03-31 12:15:32 发布 · 710 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#android #算法 #逆向 #网络安全 #汇编 #OLLVM

版权归作者所有，如有转发，请注明文章出处：https://cyrus-studio.github.io/blog/

目标 so 分析

目标方法反汇编视图如下

word/media/image1.png

F5 反汇编代码如下，很明显通过 fla 隐藏了真实的执行流

__int64 __usercall dynamicBase64Encode@<X0>(const unsigned __int8 *a1@<X0>, unsigned __int64 a2@<X1>, __int64 a3@<X8>)
{
  int v3; // w8
  int v4; // w8
  unsigned __int8 *v5; // x0
  int v6; // w8
  unsigned __int8 *v7; // x0
  __int64 result; // x0
  int i; // [xsp+20h] [xbp-60h]
  unsigned __int64 v11; // [xsp+30h] [xbp-50h]
  int v12; // [xsp+3Ch] [xbp-44h]
  int v13; // [xsp+40h] [xbp-40h]
  char v16[24]; // [xsp+60h] [xbp-20h] BYREF
  __int64 v17; // [xsp+78h] [xbp-8h]

  v17 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  generateDynamicBase64Alphabet(a2);
  sub_29574(a3);
  v13 = 0;
  v12 = -6;
  v11 = 0LL;
  do
  {
    if ( v11 >= a2 )
      v3 = 491;
    else
      v3 = 26962;
    for ( i = v3; ; i = 24464 )
    {
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( 1 )
                {
                  while ( i == 491 )
                  {
                    if ( v12 <= -6 )
                      v6 = 4827;
                    else
                      v6 = 2995;
                    i = v6;
                  }
                  if ( i != 2995 )
                    break;
                  v7 = (unsigned __int8 *)sub_2E280(v16, (v13 << 8 >> (v12 + 8)) & 0x3F);
                  std::string::push_back(a3, *v7);
                  i = 4827;
                }
                if ( i != 4827 )
                  break;
                i = 32391;
              }
              if ( i != 5705 )
                break;
              v5 = (unsigned __int8 *)sub_2E280(v16, (v13 >> v12) & 0x3F);
              std::string::push_back(a3, *v5);
              v12 -= 6;
              i = 24464;
            }
            if ( i != 9961 )
              break;
            ++v11;
            i = 29358;
          }
          if ( i != 16827 )
            break;
          i = 9961;
        }
        if ( i != 24464 )
          break;
        if ( v12 < 0 )
          v4 = 16827;
        else
          v4 = 5705;
        i = v4;
      }
      if ( i != 26962 )
        break;
      v13 = a1[v11] | (v13 << 8);
      v12 += 8;
    }
  }

最低0.47元/天解锁文章