Comments (6)
忘了。好像是有兼容性问题?
from arkari.
大佬,goron中有IPObfuscationContext.cpp,但是你移植过来的就删掉了,这个具体是干什么的,请大佬解答解答
IPObfuscationContext 主要是用来生成 MySecret 的信息的,具体可以参考原版 Control Flow Flattening 和 IndirectCall 这两个 Pass 中的代码,这个移植作者采用的方案是直接不使用生成的 SecretArg,而是使用 0 代替;而在原版中的逻辑是只有当 SecretArg 生成失败了才会使用 0 代替,因此这样直接导致了 goron 特色消失
from arkari.
大佬,goron中有IPObfuscationContext.cpp,但是你移植过来的就删掉了,这个具体是干什么的,请大佬解答解答
IPObfuscationContext 主要是用来生成 MySecret 的信息的,具体可以参考原版 Control Flow Flattening 和 IndirectCall 这两个 Pass 中的代码,这个移植作者采用的方案是直接不使用生成的 SecretArg,而是使用 0 代替;而在原版中的逻辑是只有当 SecretArg 生成失败了才会使用 0 代替,因此这样直接导致了 goron 特色消失
MySecret具体是什么东西呢?如果使用了MySecret,goron会有什么不同
from arkari.
举个栗子,下面代码取自 goron IndirectCall
const IPObfuscationContext::IPOInfo *SecretInfo = nullptr;
if (IPO) {
SecretInfo = IPO->getIPOInfo(&Fn);
}
Value *MySecret;
if (SecretInfo) {
MySecret = SecretInfo->SecretLI;
} else {
MySecret = ConstantInt::get(Type::getInt32Ty(Ctx), 0, true);
}
Constant *X;
if (SecretInfo) {
X = ConstantExpr::getSub(SecretInfo->SecretCI, EncKey);
} else {
X = ConstantExpr::getSub(Zero, EncKey);
}
Value *Secret = IRB.CreateSub(X, MySecret);
Value *DestAddr = IRB.CreateGEP(EncDestAddr, Secret);
Value *FnPtr = IRB.CreateBitCast(DestAddr, FTy->getPointerTo());
以上就是原版的 goron 逻辑,追踪到 IPObfuscationContext 中可以看到下面的代码
// Load Secret Token from the secret argument
IntegerType *I32Ty = Type::getInt32Ty(NF->getContext());
IRBuilder<> IRB(&NF->getEntryBlock().front());
Value *Ptr = IRB.CreateBitCast(NF->arg_begin(), I32Ty->getPointerTo());
LoadInst *MySecret = IRB.CreateLoad(Ptr);
你可以把 MySecret 当成一个密钥;至于有什么不同,当然是增加攻击者攻击的难度,下面引用 @61bcdefg 大佬的一句话解释:
会给被混淆的函数加个参数,当作解密的key
这个版本中直接丢掉了 IPObfuscationContext,四舍五入就是 key = 0
from arkari.
举个栗子,下面代码取自 goron IndirectCall
const IPObfuscationContext::IPOInfo *SecretInfo = nullptr; if (IPO) { SecretInfo = IPO->getIPOInfo(&Fn); } Value *MySecret; if (SecretInfo) { MySecret = SecretInfo->SecretLI; } else { MySecret = ConstantInt::get(Type::getInt32Ty(Ctx), 0, true); } Constant *X; if (SecretInfo) { X = ConstantExpr::getSub(SecretInfo->SecretCI, EncKey); } else { X = ConstantExpr::getSub(Zero, EncKey); } Value *Secret = IRB.CreateSub(X, MySecret); Value *DestAddr = IRB.CreateGEP(EncDestAddr, Secret); Value *FnPtr = IRB.CreateBitCast(DestAddr, FTy->getPointerTo());
以上就是原版的 goron 逻辑,追踪到 IPObfuscationContext 中可以看到下面的代码
// Load Secret Token from the secret argument IntegerType *I32Ty = Type::getInt32Ty(NF->getContext()); IRBuilder<> IRB(&NF->getEntryBlock().front()); Value *Ptr = IRB.CreateBitCast(NF->arg_begin(), I32Ty->getPointerTo()); LoadInst *MySecret = IRB.CreateLoad(Ptr);
你可以把 MySecret 当成一个密钥;至于有什么不同,当然是增加攻击者攻击的难度,下面引用 @61bcdefg 大佬的一句话解释:
会给被混淆的函数加个参数,当作解密的key
这个版本中直接丢掉了 IPObfuscationContext,四舍五入就是 key = 0
原来如此,大佬能否将IPObfuscationContext也适配进llvm17呢
from arkari.
举个栗子,下面代码取自 goron IndirectCall
const IPObfuscationContext::IPOInfo *SecretInfo = nullptr; if (IPO) { SecretInfo = IPO->getIPOInfo(&Fn); } Value *MySecret; if (SecretInfo) { MySecret = SecretInfo->SecretLI; } else { MySecret = ConstantInt::get(Type::getInt32Ty(Ctx), 0, true); } Constant *X; if (SecretInfo) { X = ConstantExpr::getSub(SecretInfo->SecretCI, EncKey); } else { X = ConstantExpr::getSub(Zero, EncKey); } Value *Secret = IRB.CreateSub(X, MySecret); Value *DestAddr = IRB.CreateGEP(EncDestAddr, Secret); Value *FnPtr = IRB.CreateBitCast(DestAddr, FTy->getPointerTo());
以上就是原版的 goron 逻辑,追踪到 IPObfuscationContext 中可以看到下面的代码
// Load Secret Token from the secret argument IntegerType *I32Ty = Type::getInt32Ty(NF->getContext()); IRBuilder<> IRB(&NF->getEntryBlock().front()); Value *Ptr = IRB.CreateBitCast(NF->arg_begin(), I32Ty->getPointerTo()); LoadInst *MySecret = IRB.CreateLoad(Ptr);
你可以把 MySecret 当成一个密钥;至于有什么不同,当然是增加攻击者攻击的难度,下面引用 @61bcdefg 大佬的一句话解释:
会给被混淆的函数加个参数,当作解密的key
这个版本中直接丢掉了 IPObfuscationContext,四舍五入就是 key = 0
原来如此,大佬能否将IPObfuscationContext也适配进llvm17呢
可以询问项目的原作者或者自己移植,我暂时对这个不感兴趣 & 没有时间
from arkari.
Related Issues (9)
- 大佬,感谢你的更新,请问能否整合进ndk? HOT 4
- Assertion failed: Ty && "Invalid GetElementPtrInst indices for type!" HOT 1
- How often does the version change HOT 2
- llvm17更新啥了呀? HOT 6
- Visual Studio 2022c++命令行参数如何配置? HOT 15
- IndirectCall and IndirectGlobalVariable is not compatible with LTO HOT 1
- vs2010运行llvm100 添加命令出错 HOT 1
- 这个支持单独函数混淆吗 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from arkari.