denuvo-ref/r2con2021_deobfuscation
1
0
Fork 0
mirror of https://github.com/mrphrazer/r2con2021_deobfuscation synced 2026-08-17 18:26:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
r2con2021_deobfuscation/tracer
History
Exact
Fare9 0537d14aa2 Added vm tracer
2021-10-11 00:40:57 +02:00
..
example1.jpg Added vm tracer 2021-10-11 00:40:57 +02:00
example2.jpg Added vm tracer 2021-10-11 00:40:57 +02:00
output.txt Added vm tracer 2021-10-11 00:40:57 +02:00
README.md Added vm tracer 2021-10-11 00:40:57 +02:00
vm_disassembler_tracer.py Added vm tracer 2021-10-11 00:40:57 +02:00

README.md

vm_disassembler_tracer.py

This script takes the values obtained from miasm while applying symbolic execution, to follow the control flow of the program and generating a VM Stack and local variables used during the execution of the binary.

This will be helpful to follow the execution of the obfuscated function, as the obfuscation works with a virtual stack, and virtual variables, we cannot easily watch this on a debugger, this tracer allows you to follow the execution watching after each instruction the result on stack and in variables.

  • Example 1:

Example1

  • Example 2:

Example2

Execution output

You can see one of the outputs using as input parameter the value 5, in the file output.txt.