I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function.

The problem is that this custom function takes a long time to resolve and the code is only ever memory resident, either passed directly to execute or directly as arguments to other functions.

I was wondering whether it would be possible to programmatically replace all instances of strings containing encoded data with what all the functions actually resolve to.

I can't post any actual code from the script, but the obfuscated code and strings are all in the form of:

xor_deob_hex(decode_to_hex(decode("mixed_up_hex_literal", some_int_literal)), 
    decode_to_hex(decode("other_mixed_up_hex_literal, other_int_literal)

What I want is to remember the above string/code, evaluate the string/code, and replace all instances of the string/code with it's results within the original script. This way I can read the original code and determine the program's function.

Update: At this point I've moved on using API monitor because this particular process injects code into another process, but some pointers on code evaluation to replacement would still be useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.