1

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to decrypt all the strings by using IDAPython. I just have no idea where to start.

2
  • Out of curiosity, how did you decide it is obfuscated with OLLVM? Found something.
    – Biswapriyo
    Apr 5, 2019 at 14:15
  • The .datadiv_decode.... functions are a telling sign of OLLVM. Apr 5, 2019 at 16:42

1 Answer 1

4

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.