PerimeterX/restringer

Dynamically reconstruct control flow

Closed this issue · 0 comments

I wanted to create a discussion for this but I can't seem to open a discussion, so feel free to convert this to a discussion.

I am running into an RE challenge and wondered whether it would be possible to create a module for this lib to tackle this.

The code I am trying to RE, uses a lot of small if statements to obfuscate the control flow. It uses a large array with numbers as a sequence of when to execute which if blocks.

Currently, I have been reverse engineering this by manually stepping through it in a debugger and keeping track of the logic, which works, but gets very tedious for bigger operations. So I was wondering if it would be possible to dynamically analyze the control flow and simplify it.

Simplified example:

// encoded variable content
var data = "484e4f4a403f52...";

// i is the array with > 1000 numbers containing the operating sequence
var i = [];

// Provision i

for (var x = [];;) {
  try {
    // r increases by an arbitrary amount each iteration
    // v dictates which block will be executed next
    var v = i[r++];
    if (v < 33) {
      if (v < 14) {
        // ...
      } else if (v < 22) {
        if (v < 19) {
          if (v < 17) {
          // ...
          } else if (17 === v) {
          // ...
          } else {
          // ...
          }
        } else if (v < 20) {
          // ...
        } else if (20 === v) {
          // ...
        } else {
          // ...
        }
      } else if (v < 25) {
        // ...
      }
    }
  }
  catch (e) {
    // ...
  }
}

Each block here performs a small and simple task, and currently, my RE process entails keeping track of what data is modified in which way. Which as you can imagine gets very labor-intensive for a large sequence of operations.

I was thinking it could perhaps theoretically be possible to simplify the control flow by executing the code and dynamically keeping track of what happens, and then reconstructing that logic.

I understand it's not a simple thing, but I am no expert on the topic so I am curious to hear others' perspectives on this.

So.. Any ideas on if it's possible to create a module for this, or other tips to RE code like this?

I've tried to keep the details here brief for clarity, but I can further elaborate on specific aspects if needed