When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to decrypt all the strings by using IDAPython. I just have no idea where to start.
1 Answer
You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.
answered Apr 6, 2019 at 5:57
.datadiv_decode....functions are a telling sign of OLLVM.