1

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to decrypt all the strings by using IDAPython. I just have no idea where to start.

Improve this question
2
  • Out of curiosity, how did you decide it is obfuscated with OLLVM? Found something.
    – Biswapriyo
    Apr 5, 2019 at 14:15
  • The .datadiv_decode.... functions are a telling sign of OLLVM.
    – Charlie Niekirk
    Apr 5, 2019 at 16:42

1 Answer 1

Reset to default
4

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.