0

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having identified the junk code from the actual code, is how can I remove the junk opcodes entirely and shorten the disassembly to the direct operation that it is employing? I have found no delete/remove bytes in the SDK, and short of a processor module, I am not sure if IDA has this capability, which would be a shame if it didn't.

  • from:
add     ecx, 4  
mov     edi, 32F88Eh    ; junk  
and     edi, 34h        ; junk  
add     edi, 0aB0b2cE6h ; junk  
mov     ebx, 98761234h  ; junk  
mov     [ebp+edi+47652784], ecx; [ebp+0xa0]

The manipulations to edi are junk in the sense their value is actually static once you apply constant folding to it

  • to:
add ecx, 4  
mov [ebp+0xa0], ecx
1

You can't just remove bytes since that would shift the following opcodes and invalidate all relative jumps/calls. The usual approach in such cases is patching the junk instructions with NOPs (0x90 for x86/x64). You can write a smalls script to do it (e.g. using patch_byte).

  • Thanks for response, which in a way, answers my question. I have been doing it exactly the way you mentioned, but was hoping that if patched correctly, and re-analyzed, the disassembly could be reconstructed accordingly. – Plug Loafsley Nov 11 at 19:22
0

Answering my own question as an additional one to Igor's.

Using nops excessively is perhaps fine for a single routine, or certain instances (at least for me), but the solution I prefer in this case is just cleaning up the code manually outside of IDA, and then adding a separate segment for it into the idb. That way I don't have to modify the obfuscated code at all, and can have both (clean/dirty) versions, with the clean one becoming the target for further analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.