I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect jump (jmp rbp) jumps to invalid memory and I don't understand why. Can anyone shed some light on the issue. Since rbp is calculated in the block below, i didn't include any other parts of the binary.

The address that it jumps to is 0x000000014CC3A390; but my base is at 0x140000000 and my driver's size is 0xB64000 bytes. Other addresses are in the 0x140xxxxxx range but this one seems so weird and I don't know why.

Other notes:

0x1409F4F92 + 0xc242cdf = 0x14CC37C71

seg007:00000001409F4F84 loc_1409F4F84:                          ; CODE XREF: seg007:00000001406E3AE2↑j
seg007:00000001409F4F84                 mov     rcx, 4B1Fh
seg007:00000001409F4F8B                 lea     rax, cs:14CC37C71h
seg007:00000001409F4F92                 mov     rsi, rax
seg007:00000001409F4F95                 mov     rbp, rsi
seg007:00000001409F4F98                 mov     rbx, rsi
seg007:00000001409F4F9B                 mov     rdx, rax
seg007:00000001409F4F9E                 shl     rbp, 1
seg007:00000001409F4FA1                 xor     rbx, rcx
seg007:00000001409F4FA4                 and     rbx, rsi
seg007:00000001409F4FA7                 and     rdx, rcx
seg007:00000001409F4FAA                 sub     rbp, rsi
seg007:00000001409F4FAD                 xor     rdx, rax
seg007:00000001409F4FB0                 sub     r9, 4
seg007:00000001409F4FB4                 xor     rbx, rbp
seg007:00000001409F4FB7                 mov     rsi, rbx
seg007:00000001409F4FBA                 movsxd  rbx, dword ptr [rsp]
seg007:00000001409F4FBE                 add     rsi, rcx
seg007:00000001409F4FC1                 add     rdx, rsi
seg007:00000001409F4FC4                 mov     rax, rdx
seg007:00000001409F4FC7                 mov     rcx, rsp
seg007:00000001409F4FCA                 mov     rbp, rax
seg007:00000001409F4FCD                 add     rbp, rbx ; last operation that matters
seg007:00000001409F4FD0                 mov     rbx, rsp
seg007:00000001409F4FD3                 sar     rbx, 3Fh
seg007:00000001409F4FD7                 shr     rbx, cl
seg007:00000001409F4FDA                 mov     rdx, rsp
seg007:00000001409F4FDD                 xor     ecx, ecx
seg007:00000001409F4FDF                 cmp     rsp, 40h ; '@'
seg007:00000001409F4FE3                 cmovnb  rbx, rcx
seg007:00000001409F4FE7                 mov     rdi, rdx
seg007:00000001409F4FEA                 mov     rax, 4
seg007:00000001409F4FF1                 mov     rcx, rax
seg007:00000001409F4FF4                 shl     rdi, cl
seg007:00000001409F4FF7                 xor     ecx, ecx
seg007:00000001409F4FF9                 mov     rsi, rdx
seg007:00000001409F4FFC                 cmp     rax, 40h ; '@'
seg007:00000001409F5000                 cmovnb  rdi, rcx
seg007:00000001409F5004                 mov     rcx, rax
seg007:00000001409F5007                 shl     rsi, cl
seg007:00000001409F500A                 xor     ecx, ecx
seg007:00000001409F500C                 sub     rdi, rdx
seg007:00000001409F500F                 cmp     rax, 40h ; '@'
seg007:00000001409F5013                 cmovnb  rsi, rcx
seg007:00000001409F5017                 xor     rsi, rax
seg007:00000001409F501A                 sub     rsi, rdi
seg007:00000001409F501D                 mov     rdx, rsi
seg007:00000001409F5020                 sub     rdx, rbx
seg007:00000001409F5023                 mov     rsp, rdx
seg007:00000001409F5026                 jmp     rbp


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.