Giter VIP home page Giter VIP logo

obpo-plugin's Introduction

Obfuscated Binary Pseudocode Optimizer

中文说明

obpo is a pseudo-code optimizer based on hex-rays microcode, uses techniques such as dataflow-tracking, program-slicing, concolic-execution to rebuild the flatterned control flow.

obpo 是一个基于 hex-rays microcode 的伪代码优化器,使用数据流跟踪,程序切片,混合执行等技术来重建被平坦化的控制流。

obpo-plugin

The obpo core is closed source, but provided obpo-plugin is FREE & OPEN SOURCE. obpo-plugin is a cloud plugin, the binary code of the target function will be sent to the obpo-server for processing, and the response result will be applied to the decompilation process. These all uploaded data and processes can be seen in the obpo-plugin's code.

obpo 核心代码不是开源的,但提供免费且开源的 obpo-plugin. obpo-plugin 是一个云插件,目标函数的二进制代码会被发送到 obpo-server 进行处理, 并将结果应用到反编译过程中。这些上传的数据和流程都可以在 obpo-plugin 的代码中看到。

声明:obpo 到目前为止没有过任何直接或间接的付费服务或捐赠渠道,服务器资源均由作者自费承担,服务如果出现宕机可以发起 issue,我会抽空维护。 (翻译:爱用不用别来阴阳怪气,你行你开源)

obpo-server

About how to process uploaded data, I published the source code for obpo-server. This is a simple backend server written in golang, used to receive request and input to ida and uses obpo-core to deobfuscation, finally returning data to obpo-plugin client.

关于如何处理上传的数据,我上传了 obpo-server 的源代码。这是一个用 golang 写的简易后端服务器, 用来接收请求后输入到 ida 并调用 obpo core 来反混淆,最后返回数据给 obpo-plugin 客户端。

But please remember that obpo-core is still closed source. You can't use obpo-server to run an self obpo service, but you can use it as a reference for how to use it to implement a cloud plugin for decompile optimize

但请记住 obpo-core 依然是闭源的。 你无法用 obpo-server 来运行一个自己的 obpo 服务,但你可以用来参考如何实现一个反编译优化的云插件。

NOTE

  1. Obpo can't solve all obfuscate problems, but I hope it can be a powerful option.
  2. Due to the limited server performance, the timeout is limited to 600s. Server is self-financing, please don't abuse it (e.g. multithreading, malicious attacks).

...

  1. obpo 无法解决所有混淆问题,但我希望它能成为一个有力的可选项。(翻译:懒得手工去混淆的话就试试,别指望啥都能行)
  2. 由于服务器性能有限,超时限制为600s。服务器是自费的,请勿滥用(如多线程、恶意攻击)。

Supported Version

obpo-plugin currently requires the following versions of hex-rays decompiler:

obpo-plugin 需要使用以下版本的 hex-rays 反编译器才能正常工作:

Hex-Rays Version Arch
7.7.0.220118 ARM64, X86, X86_64
7.6.0.210427 ARM, ARM64, X86, X86_64, PowerPC, PowerPC64, MIPS
7.5.0.201028 ARM, ARM64, X86, X86_64, PowerPC, PowerPC64, MIPS

Installation

Copy obpo_plugin.py and obpoplugin into ida plugins path.

obpo_plugin.pyobpoplugin 复制到 ida 插件路径中。

Usages

Obpo requires you to manually mark a dispatch block for Control Flow Flattening before automated analysis. Normally, the dispatch block looks like this:

Obpo 要求您在自动分析之前手动标记用于控制流扁平化的分发块。通常情况下,分发块看起来像这样:

Right-click on the control flow graph, click OBPO -> Mark and process function. Refresh the decompiler after processing is complete, like this:

右键单击控制流图,单击“OBPO -> Mark and process function”。之后刷新反编译器处理完成,如下:

Depending on the decompilation changes you can continue to mark dispatch blocks.

根据反编译的变化,您可以继续标记分发块。

Samples

In the samples, saved some pseudocode and compare image by automation testing.

samples 中,保存了一些通过自动化测试产生的伪代码以及比较图像。

Feedback

All sample binaries are saved in obpo-project/samples. Welcome to submit other sample.

所有示例二进制文件都保存在 obpo-project/samples 中。欢迎提交其他样本。

obpo-plugin's People

Contributors

hluwa avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

obpo-plugin's Issues

OLLVM-tll/Armariris deobfuscation sample

sample: https://github.com/OWASP/owasp-mstg/blob/master/Crackmes/Android/Level_04/r2pay-v1.0.apk

Traceback (most recent call last):
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 17, in activate
    self.f(ctx)
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 70, in mark_and_process
    process(_)
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 30, in process
    mba = generate_microcode(func, level=LEVEL)
  File "/home/edu/idapro-7.7/plugins/obpoplugin/process.py", line 21, in generate_microcode
    raise Exception("{} generate mc error:  {}".format(hex(function.start_ea) % hf.errea, hf.str))
TypeError: not all arguments converted during string formatting
Traceback (most recent call last):
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 17, in activate
    self.f(ctx)
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 70, in mark_and_process
    process(_)
  File "/home/edu/idapro-7.7/plugins/obpoplugin/popup.py", line 33, in process
    optimized = request_process(mba, mark_manager_instance().func_marked(ea))
  File "/home/edu/idapro-7.7/plugins/obpoplugin/process.py", line 170, in request_process
    response = response.json()
  File "/home/edu/.local/lib/python3.6/site-packages/requests/models.py", line 910, in json
    return complexjson.loads(self.text, **kwargs)
  File "/usr/lib/python3/dist-packages/simplejson/__init__.py", line 518, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3/dist-packages/simplejson/decoder.py", line 370, in decode
    obj, end = self.raw_decode(s)
  File "/usr/lib/python3/dist-packages/simplejson/decoder.py", line 400, in raw_decode
    return self.scan_once(s, idx=_w(s, idx).end())
simplejson.errors.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

520 Bad Gateway

The server response 502 error.

<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>openresty/1.19.9.1</center>
</body>
</html>

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.