Guidelines for dealing with obfuscated code

Question

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has anti-debugging features and as far as I can understand it modifies its code during the the tls callbacks (at least thats what IDA indicated when stepping through the tls callbacks, there are 3 of them). I suspect the tls callbacks check for debuggers and also it unpacks the executable.

I would like to ask a couple of questions in connection with this.

• How would you go about reversing a code that is heavly obfuscated? (Lots of jumps and opaque predicates.) Maybe after the tls callbacks finish the code is unpacked and some of the obfuscation is removed?

• I have added breakpoints to the main debug checking functions from ntdll.dll and kernel32.dll to see if they call any, I saw they had multiple calls to ntqueryprocessinformation, I suspect they are querying their own process?

• Also, if i want to read the memory of the application during runtime, I will need to find a way to bypass their anti debug features, meaning I have to figure out what they are doing with the tls callbacks and also from the entry point of the PE?

I am looking for any general or specific guidelines you guys can throw me, in order to defeat their obfuscation.

Thank you

Answer 1

You can press Ctrl+E to select the TLS entry point. see here: https://hex-rays.com/blog/tls-callbacks/

Answer 2

There are multiple ways an application could use to detect the debugger presence using NtQueryInformationProcess() since it retrieves information from a process for example most common use:

ProcessDebugPort, which receives a DWORD value equal to 0xFFFFFFFF (decimal -1) if the process is being debugged.

 lea eax, [dwReturned]
 push eax ; ReturnLength
 push 4   ; ProcessInformationLength
 lea ecx, [dwProcessDebugPort]
 push ecx ; ProcessInformation
 push 7   ; ProcessInformationClass
 push -1  ; ProcessHandle
 call NtQueryInformationProcess
 inc dword ptr [dwProcessDebugPort]
 jz being_debugged  
being_debugged:
 push -1
 call ExitProces

A simple solution is to set a breakpoint where NtQueryInformationProcess() returns and when the breakpoint is hit patch with DWORD value 0.

For Obfuscation, there is no direct path to deal with it but I usually try to classify and read the ASM code carefully to identify any known obfuscation techniques first such as:

• Logic Flow Obfuscation

              xor eax,eax     << zero eax
              test eax,eax    << Check if eax ZERO 
              JE _eaxWasZero
  

• NOP Obfuscation

               push eax
               add eax,ecx
               sub eax,ebx
               push ebx
               sub ebx, EDX
               xor ebx, edi
               pop ebx
               pop eax
  

• Anti-Disassembler Code Obfuscation which is used to confuse the disassembler by adding junk bytes and fake function return address

• Trampolines (code jumps to different locations)

• Instruction Permutations (make simple instructions complex)

and then simplify it in order to identify the logic or any anti debugging trick.