Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using IDAPython to Make Your Life Easier: Part 1

Summary: A Unit 42 malware reverse engineer describes using IDAPython to automate defeating string obfuscation in a malicious sample, where a single-byte XOR decryption function was called 116 times with data passed via the ESI register. The script uses IDA API calls including XrefsTo(), GetOperandValue(), and MakeComm() to locate the references, extract and decrypt the raw binary strings byte-by-byte until a null terminator, and annotate the disassembly with comments, ultimately decrypting 161 instances of encrypted strings.

Key Takeaway: The sample's decryption was trivial - the first byte served as a single-byte XOR key for the rest, turning E4 91 96 88 89 8B 8A CA 80 88 88 into 'urlmon.dll' - yet it was called 116 times, and analysts without scripting would face decrypting each instance by hand.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related