这种混淆是什么工具做出来的


#1
BYTE byte_103F95958;
unsigned char dword_103F95959[] =
{
    0x00,
    0x04,
    0,
    0,
    0,
    0,
    3,
    0,
    0,
    0,
    0,
    0,
    0,
    0,
    0xD,
    1,
    0,
    0,
    0,
    0xAF,
    9,
    0,
    0,
    0,
    0x72 ,
    0xAE,
...
};
__int64 sub_101F123456(int a1)
{
    char *v1; // x9
    char *v2; // x10
    int v3; // w13
    int v4; // t1
    int v5; // w13
    char *v6; // x13
    signed int v7; // w13
    int v8; // t1
    int v10; // [xsp+Ch] [xbp-134h]
    char v11; // [xsp+10h] [xbp-130h]
    char v12[32]; // [xsp+110h] [xbp-30h]
    
    v10 = a1;
    v1 = &byte_103F95958;
    v2 = &v11;
    do
    {
        while ( 1 )
        {
            while ( 1 )
            {
                while ( 1 )
                {
                    v7 = (unsigned __int8)*v1;
                    if ( v7 <= 130 )
                        break;
                    if ( v7 <= 174 )
                    {
                        if ( v7 == 131 )
                        {
                            *(_QWORD *)&v12[*(signed int *)(v1 + 1)] = *(_QWORD *)v2;
                            *(_DWORD *)&v12[*(signed int *)(v1 + 9)] = *(_DWORD *)(v1 + 5);
                            *(_QWORD *)v2 = *(_QWORD *)&v12[*(signed int *)(v1 + 13)];
                            v2 += 8;
                            *(_QWORD *)v2 = *(_QWORD *)(v1 + 17);
                            v1 += 25;
                        }
                        else if ( v7 == 174 )
                        {
                            v2 += 8;
                            if ( !*(_DWORD *)(v1 + 1) )
                                *(_QWORD *)v2 = (_QWORD)&v10;
                        LABEL_14:
                            v1 += 5;
                        }
                    }
                    else
                    {
                        switch ( v7 )
                        {
                            case 175:
                                v3 = *(_DWORD *)v2;
                                v4 = *((_DWORD *)v2 - 2);
                                v2 -= 8;
                                v5 = v4 + v3;
                                *(_DWORD *)v2 = v5;
                                *(_DWORD *)&v12[*(signed int *)(v1 + 1)] = v5;
                                *(_DWORD *)&v12[*(signed int *)(v1 + 13)] = *(_DWORD *)(v1 + 5) & *(_DWORD *)&v12[*(signed int *)(v1 + 9)];
                                v6 = &v12[*(signed int *)(v1 + 17)];
                                goto LABEL_12;
                            case 200:
                                *(_DWORD *)&v12[*(signed int *)(v1 + 5)] = **(_DWORD **)v2 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
                                *(_DWORD *)v2 = *(_DWORD *)&v12[*(signed int *)(v1 + 9)] >> *(_DWORD *)(v1 + 13);
                                v1 += 17;
                                break;
                            case 213:
                                v8 = *(_DWORD *)v2;
                                v2 -= 8;
                                *(_DWORD *)&v12[*(signed int *)(v1 + 5)] = v8 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
                                v1 += 9;
                                break;
                        }
                    }
                }
                if ( v7 > 42 )
                    break;
                if ( v7 == 25 )
                {
                    v1 += *(signed int *)(v1 + 1) + 1;
                }
                else if ( v7 == 34 )
                {
                    *((_DWORD *)v2 - 2) = *(unsigned __int8 *)(*((_QWORD *)v2 - 1) + *(_QWORD *)v2 * *(signed int *)(v1 + 1));
                    *(_DWORD *)v2 = *(_DWORD *)&v12[*(signed int *)(v1 + 9)] << *(_DWORD *)(v1 + 5);
                    v1 += 13;
                }
            }
            if ( v7 != 43 )
                break;
            *(_DWORD *)&v12[*(signed int *)(v1 + 5)] = *(_DWORD *)v2 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
            *(_QWORD *)v2 = *(_QWORD *)&v12[*(signed int *)(v1 + 9)];
            v2 += 8;
            v6 = *(char **)(v1 + 13);
        LABEL_12:
            *(_QWORD *)v2 = (_QWORD)v6;
            v1 += 21;
        }
        if ( v7 == 48 )
        {
            *((_DWORD *)v2 + 2) = *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
            v2 += 8;
            goto LABEL_14;
        }
    }
    while ( v7 != 46 );
    return *(unsigned int *)v2;
}

使用了一个静态数组来控制程序执行路径,我看了下,ollvm并没有这么做。
还有char v12[32]; 这个函数内的数组也是混淆器生成的。他每个混淆过的函数都有这么一个数组,我都没搞清楚这个是起到了什么作用。只是bcf模式生成的无用代码吗?


#2

看起来是魔改版的fla,虽然魔改幅度很小,基本跟原版没啥区别


#3

你看控制流图可能会清晰一点
我的博客有简单介绍这几个混淆的特征,你可以看一下


#4

是啥混淆? 我怎啥都看不见?


#5

我还原了他的编辑历史,现在有了


#7

张总 这种有快捷的方法还原么 (除了一步步跟出来)。。。。。。。。。。。


#8

#9

这不是抖音吗? 还特地把地址改了, 化成灰我也认得


#10

哥,你能小声点吗


#11

没事,现在QQ群里1452个人其中包括两个抖音开发者都知道你在搞抖音了