I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function.
The problem is that this custom function takes a long time to resolve and the code is only ever memory resident, either passed directly to execute or directly as arguments to other functions.
I was wondering whether it would be possible to programmatically replace all instances of strings containing encoded data with what all the functions actually resolve to.
I can't post any actual code from the script, but the obfuscated code and strings are all in the form of:
xor_deob_hex(decode_to_hex(decode("mixed_up_hex_literal", some_int_literal)), decode_to_hex(decode("other_mixed_up_hex_literal, other_int_literal)
What I want is to remember the above string/code, evaluate the string/code, and replace all instances of the string/code with it's results within the original script. This way I can read the original code and determine the program's function.
Update: At this point I've moved on using API monitor because this particular process injects code into another process, but some pointers on code evaluation to replacement would still be useful.