反混淆

ollvm 安装#

参考：wiki, issue#186

git clone -b llvm-4.0 https://github.com/obfuscator-llvm/obfuscator.git
mkdir ollvm-build && cd $_
cmake -DCMAKE_BUILD_TYPE=Release -DLLVM_INCLUDE_TESTS=OFF ../obfuscator/
make -j8

编译之前打修复的 patch：issue#178 ，放入 1.patch，然后 git apply 1.patch

 

三板斧#

keystone、capstone、unicorn

 

工具#

https://gitlab.com/eshard/d810

https://github.com/cq674350529/deflat

https://github.com/SnowGirls/deflat

https://github.com/mFallW1nd/deflat

https://oacia.dev/ollvm-study/