CleanTricks to deal with dirty tricks - binary ninja deobfuscation plugin

There are many many obfuscation techniques to make binary code analysis laborious. Here I am showing some common ones, how to write a binary ninja plugin to deal with them and leave a template to add more. Find it here: https://github.com/janbbeck/CleanTricks

Overlapping code

Traditionally, a very effective way to obfuscate code is overlapping code. This is not a new technique, but traditional disassemblers have struggled with this. Lets look at an example in ghidra.

The XOR will always set the zero flag, and thereby trigger the JZ jump. Next, see how the JZ instructions jumps to 0x4011be+2. This is in the middle of the MOV R11, 0x5ebcbff49c3ff49 instruction! We can un-/re-define this code and see what the overlapping instructions are:

Interesting. So it is clear that the affected bytes represent two different instruction sequences, depending on where the program counter is. Neither ghidra, nor IDA pro nor any other disassembler I am aware of can gracefully deal with this - except for binary ninja. Lets look at that code section in binary ninja:

Both code variations are recognized and represented in the disassembly. Of course, while the code here uses r11, the technique will use with any register. The overlapping code is hidden in the literal value, 0x5ebcbff49c3ff49. It simply increases r11, then decreases it again, then jumps to the address right behind the JZ check. I have come across a binary that uses this same trick on different registers thousands of times. So I made a binary ninja plugin that deals with this in an automated way and can be easily adjusted/augmented to deal with other obfuscations as I come across them. The basic structure of the plugin consists of two parts. First, a registration for the plugin menu, second a function to be called when the menu is selected. I started with a clean template, and left it in the plugin, to be able to easily and quickly add a new deobfuscation. The template - it only iterates over all the instructions in the program - looks like this:

from binaryninja import *

from operator import itemgetter

import time

def clean_tricks_template(bv):

         # empty template to play with

         start = time.time()

         # sort instructions by address. BN does not provide this in order. Also, there are duplicates...

         instructionList = sorted(bv.instructions, key=itemgetter(1)) 

         # or instructionList = bv.instructions   , because sometimes listing by block is more useful

         last_instruction = None    # keep track of the instructions before the one under current consideration

         last_instruction2 = None   # keep track of the instructions before the one under current consideration

         for instruction in instructionList:

            last_instruction2 = last_instruction    # keep track of the instructions before the one under current consideration

            last_instruction = instruction          # keep track of the instructions before the one under current consideration

         end = time.time()

         binaryninja.log_info(repr(end-start))

PluginCommand.register("Clean Tricks\\0 - Empty template", "Empty template to experiment with", clean_tricks_template)

The PluginCommand.register creates the menu entry and the function clean_tricks_template gets called when the menu entry is selected.

To deal with the overlapping code above, we only need to NOP out the relevant bytes.

Note how the inc/dec instruction is really the immediate value placed into r11 with the mov instruction. If we NOP those out, the program already becomes simpler:

Next, we recognize that the execution proceeds from 0x4011cb to 0x4011c0, then does nothing but to go to a jump instruction to 0x4011cd:

Both code paths do the same thing, so we might as well NOP out je 0x4011c0.

Then the original mov instruction is completely pointless and can be NOP'd.

A very clever obfuscator might be able to identify an XOR instruction to construct this obfuscation around it, but more often, it is pointless as well. In that case, the code can NOP it as well, and the resulting deobfuscated section simplifies to the following:

And this is the code that goes through all of the program and cleans up all these obfuscations:

Useless computation and fake branch.

Another obfuscation technique is to perform some calculations that will never be used other than to decide a branch instruction that always goes in one direction. Consider this:

r11 is pushed on the stack, then zeroed with an xor, then the je will always succeed, because the xor will set the zero flag. Then r11 is restored from the stack. This sequence of instructions can safely be NOPd, except for the je, which needs a jmp:

And here is what this looks like after deobfuscation:

Useless computation and fake branch 2.

This is another xor based jump obfuscation. However, in this case there is no 'preamble'

This is the Clean Trick for that case:

If both 'useless computation and fake branch' techniques are used, the first one should be cleaned up first. Otherwise the push and pop instructions will remain as a remnant and the second Clean Trick will find no targets.

jmp into an inc/dec pair

In this case there is an inc/dec instruction pair doing nothing. It's overlapping with a preceding jmp instruction:

All 3 instructions have to be NOPd together:

plain inc/dec pair

In this case there simply is an inc/dec instruction pair doing nothing.

And this is the Clean Trick:

Split jmp

Another technique is to combine je/jne instructions to the same target address, either with or without a preceding computation.

And this is the Clean Trick:

Many more.

This is just a small sample of techniques used to obfuscate code and make static analysis more difficult. I'll add more to CleanTricks over time, and it's easy to add more yourself. If you come across an interesting obfuscation and write a Clean Trick for it, please put in a pull request.

https://github.com/janbbeck/CleanTricks

References:

• The IDA Pro Book, 2nd Edition: The Unofficial Guide to the World's Most Popular Disassembler
• https://github.com/janbbeck/CleanTricks