-
Notifications
You must be signed in to change notification settings - Fork 256
Open
Labels
Effort: TrivialIssues require < 1 day of workIssues require < 1 day of workIL OptimizationIssue involving optimization of representation (not correctness)Issue involving optimization of representation (not correctness)Impact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround
Description
I have a binary that obfuscates a regular if-else statement to a switch-case with two cases. It would be good if we can automatically concert such a case to an if-else branch, thus defeating the obfuscation, with minimal user-interaction:
Here is what it now looks like in HLIL:
We can see it is checking if the start of the buffer is 0x5a4d, a typical check for PE file.
Repro steps:
- Download the binary from https://malshare.com/sample.php?action=detail&hash=0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7 and open it
- Go to function 0x434a60
- Set the type of the data variable at
0x44284c
toconst int32_t
- Set the type of the data variable at
0x442844
toconst int32_t[2]
- View the function code in HLIL
I came across this while looking at #5629.
P.S. some other switch-case conversion related issues: #4670, #1723
Metadata
Metadata
Assignees
Labels
Effort: TrivialIssues require < 1 day of workIssues require < 1 day of workIL OptimizationIssue involving optimization of representation (not correctness)Issue involving optimization of representation (not correctness)Impact: LowIssue is a papercut or has a good, supported workaroundIssue is a papercut or has a good, supported workaround