When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to decrypt all the strings by using IDAPython. I just have no idea where to start.

  • Out of curiosity, how did you decide it is obfuscated with OLLVM? Found something.
    – Biswapriyo
    Apr 5 '19 at 14:15
  • The .datadiv_decode.... functions are a telling sign of OLLVM. Apr 5 '19 at 16:42

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.