6

This doc may be interesting for you: https://github.com/CAS-Atlantic/AArch64-Encoding


3

Eureka! HERE IS THIS TABLE P.S. It's really hard to google it (keywords I used - "b arm64 opcode"), so I decided to post it as answer. Hope it'll be helpful for others.


2

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


2

The canonical source is the ARM Architecture Reference Manual. If you prefer machine readable format, the XML files are available too.


1

Not Sure i selected uxtw in this post Right Clicked and Search Google For UXTW the First Hit is Arm Documentation SUB Wd|WSP, Wn|WSP, Wm{, extend {#amount}} ; 32-bit general registers SUB Xd|SP, Xn|SP, Rm{, extend {#amount}} ; 64-bit general registers extend Is the extension to be applied to the second source operand: 32-bit general ...


1

To add on too Yennefer's wonderful and respectable answer: Going through the memory segments can definitely help, a lot of times obfuscators will tamper with those. Giving a possible clue as to what the obfuscator is. Also look at the imported functions, how do those look? Some obfuscators mess around with the IAT, and some of the functions inside of the ...


1

Usually, I try to detect which obfuscator has been used. Knowing your enemy is the first step towards the victory. If you can detect the obfuscator, you may be lucky and find the corresponding "deobfuscator". You won't have the original source, but you'll significantly decrease the entropy and the noise. A good starting point is to look at how the strings ...


1

You were almost there. But they have to point to exactly the same address so this "cmp" instruction that comes after it will succeed This statement is incorrect. Not addresses are being compared, but the data at each. The code, starting from .text:00C21094 compares 13 subsequent bytes at byte_C23018 with their counterparts at loc_C23024. So, to get the ...


1

You can extract some file from .exe using pyi-archive_viewer, modify them and put back. But be attention, all files in .exe are compressed using DEFLATE (zlib.compress() - you can watch this in source code of PyInstaller). So, when putting back you need compress file to the exact size, that was when you extracted it.


Only top voted, non community-wiki answers of a minimum length are eligible