Binary Ninja の Python API を使ってバイナリ解析と操作を自動化する

def main():

    # Load current view
    bv = current_view

    # Get functions
    for func in bv.functions:
        if func.name == "main":
            main_func_startaddr = func.start
        print(f"FUNC_NAME: {func.name},\t OFFSET: {hex(func.start)}")


    # Get disassemble code
    func_addr = 0x43e0
    instruction = bv.get_disassembly(func_addr)
    print(f"ADDRESS: {hex(func_addr)},\t CODE: {instruction}")


    # Get disassemble function code(until return)
    start_addr = main_func_startaddr
    end_addr = start_addr + 0x4000
    current_addr = start_addr
    instruction = ""

    while (current_addr < end_addr) and (instruction != "retn"):
        instruction = bv.get_disassembly(current_addr)
        instruction_length = bv.get_instruction_length(current_addr)
        current_addr += bv.get_instruction_length(current_addr)
        if instruction_length > 0:
            print(f"0x{current_addr:x}: {instruction}")   
        else:
            break


    # Convert to NOP

    ## Stat undo actions
    undo_actions_state = bv.begin_undo_actions()

    target_address = 0x43e0
    if bv.convert_to_nop(target_address):
        print(f"Converted 0x{target_address:x} to NOP.")
    else:
        print(f"Failed converted 0x{target_address:x} to NOP.")

    ## Commit actions
    bv.commit_undo_actions(undo_actions_state)


    # Save file
    bv.file.save()


    return

if __name__ == "__main__":
    import os
    import sys
    sys.stdout = open(f"{os.path.dirname(os.path.realpath(__file__))}/stdout.log", "w")
    main()
    sys.stdout = sys.__stdout__

# Load current view
bv = current_view

# Get functions
for func in bv.functions:
    if func.name == "main":
        main_func_startaddr = func.start
    print(f"FUNC_NAME: {func.name},\t OFFSET: {hex(func.start)}")

# Get disassemble code
func_addr = 0x43e0
instruction = bv.get_disassembly(func_addr)
print(f"ADDRESS: {hex(func_addr)},\t CODE: {instruction}")

# Get disassemble function code(until return)
start_addr = main_func_startaddr
end_addr = start_addr + 0x4000
current_addr = start_addr
instruction = ""

while (current_addr < end_addr) and (instruction != "retn"):
    instruction = bv.get_disassembly(current_addr)
    instruction_length = bv.get_instruction_length(current_addr)
    current_addr += bv.get_instruction_length(current_addr)
    if instruction_length > 0:
        print(f"0x{current_addr:x}: {instruction}")   
    else:
        break

# Convert to NOP

## Stat undo actions
undo_actions_state = bv.begin_undo_actions()

target_address = 0x43e0
if bv.convert_to_nop(target_address):
    print(f"Converted 0x{target_address:x} to NOP.")
else:
    print(f"Failed converted 0x{target_address:x} to NOP.")

## Commit actions
bv.commit_undo_actions(undo_actions_state)

# Save file
bv.file.save()

# 特定の実行アドレスのバイナリを XOR したバイナリに置き換える
data = bv.read(target_addr, size)
bv.write(
    target_addr,
    (int.from_bytes(data, byteorder="little") ^ key_value).to_bytes(size, byteorder="little")
)

# Load current view
bv = current_view

call_addrs = [0x43e0]
deobfuscated_addrs = []
pushfq_flag = False
current_call_addr = 0
previous_call_addr = 0


def deobfuscate(current_call_addr):
    global bv
    global call_addrs
    global pushfq_flag
    global deobfuscated_addrs
    hex_pattern = r"0x[0-9a-fA-F]+"
    word_pattern = r".word|byte"

    undo_actions_state = bv.begin_undo_actions()

    # Get disassemble function code(until return)
    start_addr = current_call_addr
    end_addr = start_addr + 0x4000
    current_addr = start_addr
    instruction = ""

    while (current_addr < end_addr):
        instruction = bv.get_disassembly(current_addr)
        instruction_length = bv.get_instruction_length(current_addr)

        if ("xor" in instruction) and (pushfq_flag == True):
            # "xor     dword [rel 0x43ec], 0xaeee8e1"
            hex_numbers = re.findall(hex_pattern, instruction)
            word_type = re.findall(word_pattern, instruction)[0].replace(" ", "")
            target_addr = int(hex_numbers[0], 16)
            key_value = int(hex_numbers[1], 16)

            if target_addr > current_addr:     
                size = 0
                if word_type == "byte":
                    size = 1
                elif word_type == "word":
                    size = 2
                elif word_type == "dword":
                    size = 4      
                elif word_type == "qword":
                    size = 8
                
                bv.convert_to_nop(current_addr)
                data = bv.read(target_addr, size)
                bv.write(
                    target_addr,
                    (int.from_bytes(data, byteorder="little") ^ key_value).to_bytes(size, byteorder="little")
                )

            else:
                bv.convert_to_nop(current_addr)

            
        elif "pushfq" in instruction:
            bv.convert_to_nop(current_addr)
            pushfq_flag = True

        elif "popfq" in instruction:
            bv.convert_to_nop(current_addr)
            pushfq_flag = False

        elif "retn" in instruction:
            bv.commit_undo_actions(undo_actions_state)
            break
        
        else:
            if pushfq_flag:
                bv.convert_to_nop(current_addr)
            else:
                if "call" in instruction:
                    call_addr = int(re.findall(hex_pattern, instruction)[0], 16)
                    if call_addr >= 0x1260:
                        call_addrs.append(call_addr)
        
        bv.commit_undo_actions(undo_actions_state)
        current_addr += bv.get_instruction_length(current_addr)
    
    return


def main():
    global bv
    global call_addrs
    global deobfuscated_addrs

    while len(call_addrs) > 0:
        current_call_addr = call_addrs.pop()
        if current_call_addr not in deobfuscated_addrs:
            deobfuscate(current_call_addr)
            deobfuscated_addrs.append(current_call_addr)

    current_func = bv.get_function_at(current_call_addr)
    current_func.reanalyze()
    bv.update_analysis_and_wait()

    return


if __name__ == "__main__":
    import os
    import sys
    sys.stdout = open(f"{os.path.dirname(os.path.realpath(__file__))}/stdout.log", "w")
    main()
    sys.stdout = sys.__stdout__

current_func = bv.get_function_at(current_call_addr)
current_func.reanalyze()
bv.update_analysis_and_wait()