cq674350529 / deflat

use angr to deobfuscation

Hi there 👋

About Me

• IoT and protocol security researcher
• Medium | Blog | Twitter

Presentation

• BHEU2023: Breaking Theoretical Limits: The Gap Between Virtual NICs and Physical Network Cards  (cooperated)
• BHEU2022: LCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again  (video)
  • (website) LCDPwn
• POC2022: MikroTik RouterOS Security: The Forgotten IPC Message  (video)
• HITB2021AMS: A Journey into Synology NAS  (video)
• POC2019: Bug Hunting in Synology NAS

deflat's Issues

AttributeError: 'NoneType' object has no attribute 'transition_graph'

安装一致版本的angr之后，py3.6.0，grapy.py已复制到相同目录下，运行deflat.py时报错：
Traceback (most recent call last):
File "deflat.py", line 96, in
supergraph = am_graph.to_supergraph(target_function.transition_graph)
AttributeError: 'NoneType' object has no attribute 'transition_graph'

KeyError: 'bw'

First of all thank you very much for this tool.
Some errors occurred during my use.

`KeyError:'bw',`

I used arm files, error stackclll: ins_b_jmp_hex_arm(), called:
line(243), patch_value = ins_b_jmp_hex_arm(instr.address, children[0], bx_cond)

bx_cond = 'b' + instr.mnemonic[len('mov'):]
Then I added a new print below: print('[x] b: {:#x}'.format(instr.address))
Then, the assembly corresponding to the address is:
MOVW R2, #0xBA7B,
How to deal with this?

patch 错误 patch error

在 util.py 中 ins_b_jmp_hex_arm64 函数中 In the ins-b_jmp_hex_arm64 function in utilit.py

此语句错误 This statement is incorrect

patch_ins_hex = struct.pack('<I', ((0x14000000 | 0x03ffffff) - (cur_addr - target_addr) // 4))

应为 Should be

patch_ins_hex = struct.pack('<I', ((0x14000000 | 0x03ffffff) - (cur_addr - target_addr - 4) // 4))

TypeError: __new__() got an unexpected keyword argument 'serialized_options'

ubuntu ver18，py3.6，angr8，运行deflat.py和bogus.py时报错
TypeError: new() got an unexpected keyword argument 'serialized_options'

local variable 'retn_node' referenced before assignment

I got these error when ruuning with deflat.py:"local variable 'retn_node' referenced before assignment".
I check the script and find out when the function has no "return code"( no matching condition for if supergraph.out_degree(node) == 0 and len(node.out_branches) == 0), the function cannot work.

not able to get function in new version of angr.

I'm currently using angr version 9.2.106 in my environment. I'm encountering an issue where the target_function is returning None when excuting the following code:

target_function = cfg.functions.get(start)

I found that this issue can be resolved by replacing the above code with:

target_function = cfg.kb.functions.get_by_addr(project.loader.main_object.mapped_base + start)

This Script support arm64 ios dylib binary??

This Script support arm64 ios dylib binary??

ios dylib binary load failed...

raise CLECompatibilityError("Unable to find a loader backend for %s. Perhaps try the 'blob' loader?" % spec)

Will it support arm64?

It seems that one angr dependency cle doesn't support mach-o backend very well. What would be the possible ways to solve it?

不支持arm吗

运行脚本出错

Traceback (most recent call last):
File ".\debogus.py", line 114, in
main()
File ".\debogus.py", line 35, in main
supergraph = am_graph.to_supergraph(target_function.transition_graph)
AttributeError: 'NoneType' object has no attribute 'transition_graph'