\n\nThis page has been machine-translated from the original page.
\n
This time, I used a SECCON 2022 challenge called Devil Hunter as a theme to summarize ClamAV signature notation and analysis methods.
\nReference: SECCON2022onlineCTF/reversing/devilhunter at main · SECCON/SECCON2022online_CTF
\nReference: Summary of building ClamAV from source and setting up OnAccessScan
\n\n\n\nClam Devil; Asari no Akuma
\n
The challenge provides flag.cbc and check.sh as the problem binaries.
Looking at check.sh, you can see that the text detected when scanning with clamscan and flag.cbc, as shown below, becomes the Flag.
#!/bin/sh\nif [ -z "$1" ]\nthen\n echo "[+] ${0} <flag.txt>"\n exit 1\nelse\n clamscan --bytecode-unsigned=yes --quiet -dflag.cbc "$1"\n if [ $? -eq 1 ]\n then\n echo "Correct!"\n else\n echo "Wrong..."\n fi\nfiflag.cbc contained the following text.
ClamBCafhaio`lfcf|aa```c``a```|ah`cnbac`cecnb`c``beaacp`clamcoincidencejb:4096\nSeccon.Reversing.{FLAG};Engine:56-255,Target:0;0;0:534543434f4e7b\nTeddaaahdabahdacahdadahdaeahdafahdagahebdeebaddbdbahebndebceaacb`bbadb`baacb`bb`bb`bdaib`bdbfaah\nEaeacabbae|aebgefafdf``adbbe|aecgefefkf``aebae|amcgefdgfgifbgegcgnfafmfef``\nG`ad`@`bdeBceBefBcfBcfBofBnfBnbBbeBefBfgBefBbgBcgBifBnfBgfBnbBfdBldBadBgd@`bad@Aa`bad@Aa`\nA`b`bLabaa`b`b`Faeac\nBaa``b`abTaa`aaab\nBb`baaabbaeAc`BeadTbaab\nBTcab`b@dE\nA`aaLbhfb`dab`dab`daahabndabad`bndabad`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`aa`b`d`b`b`aa`ah`aa`aa`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`b`b`b`d`b`d`b`b`b`b`bad`b`b`bad`b`d`aa`b`b`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`d`b`d`aa`Fbcgah\nBbadaedbbodad@dbadagdbbodaf@db`bahabbadAgd@db`d`bb@habTbaab\nBaaaiiab`dbbaBdbhb`d`bbbbaabTaaaiabac\nBb`dajbbabajb`dakh`ajB`bhb`dalj`akB`bhb`bamn`albadandbbodad@dbadaocbbadanamb`bb`aabbabaoAadaabaanab`bb`aAadb`dbbaa`ajAahb`d`bb@h`Taabaaagaa\nBb`bbcaabbabacAadaabdakab`bbca@dahbeabbacbeaaabfaeaahbeaBmgaaabgak`bdabfab`d`bb@h`Taabgaadag\nBb`bbhaabbabacAadaabiakab`bbha@db`d`bb@haab`d`bb@h`Taabiaagae\nBb`dbjabbaabjab`dbkah`bjaB`bhb`dblaj`bkaB`bhb`bbman`blabadbnadbbodad@dbadboacbbadbnabmab`bb`bgbboab`bbab`baacb`bb`dbbbh`bjaBnahb`dbcbj`bbbB`bhb`bbdbn`bcbb`bbebc`Add@dbadbfbcbbadagbebb`bbgbc`Addbdbbadbhbcbbadbfbbgbb`b`fbbabbhbb`dbiba`bjaAdhaabjbiab`dbibBdbhb`d`bbbibaaTaabjbaeaf\nBb`bbkbgbagaablbeab`bbkbHbj`hnicgdb`bbmbc`Add@dbadbnbcbbadagbmbb`bbobc`AddAadbadb`ccbbadbnbbobb`bbacgbb`caabbceab`bbacHcj`hnjjcdaabcck`blbbbcb`bbdcc`Add@dbadbeccbbadagbdcb`bbfcc`AddAbdbadbgccbbadbecbfcb`bbhcgbbgcaabiceab`bbhcHoigndjkcdaabjck`bccbicb`bbkcc`Add@dbadblccbbadagbkcb`bbmcc`AddAcdbadbnccbbadblcbmcb`bbocgbbncaab`deab`bbocHcoaljkhgdaabadk`bjcb`db`bbbdc`Add@dbadbcdcbbadagbbdb`bbddc`AddAddbadbedcbbadbcdbddb`bbfdgbbedaabgdeab`bbfdHcoalionedaabhdk`badbgdb`bbidc`Add@dbadbjdcbbadagbidb`bbkdc`AddAedbadbldcbbadbjdbkdb`bbmdgbbldaabndeab`bbmdHoilnikkcdaabodk`bhdbndb`bb`ec`Add@dbadbaecbbadagb`eb`bbbec`AddAfdbadbcecbbadbaebbeb`bbdegbbceaabeeeab`bbdeHdochfheedaabfek`bodbeeb`bbgec`Add@dbadbhecbbadagbgeb`bbiec`AddAgdbadbjecbbadbhebieb`bbkegbbjeaableeab`bbkeHdiemjoeedaabmek`bfebleb`bbnec`Add@dbadboecbbadagbneb`bb`fc`AddAhdbadbafcbbadboeb`fb`bbbfgbbafaabcfeab`bbbfHoimmoklfdaabdfk`bmebcfb`dbefo`bdfb`d`bbbef`Tbaag\nBb`dbffbb`bffaabgfn`bffTcaaabgfE\nAab`bLbaab`b`b`dab`dab`d`b`d`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`aa`b`d`b`d`Fbfaac\nBb`d`bb@habb`d`bbG`lckjljhaaTbaaa\nBb`dacbbaaacb`dadbbabadb`baen`acb`bafn`adb`bagh`afAcdb`bahi``agb`baik`ahBoodb`bajm`aiaeb`bakh`ajAhdb`bali`aeBhadb`baml`akalb`bana`afAadaaaoeab`banAddb`db`ao`anb`dbaao`amb`d`bbb`aabb`d`bbbaaaaTaaaoabaa\nBTcab`bamE\nSnfofdg`bcgof`befafcgig`bjc`ej`Since this CBC file is a ClamAV bytecode signature, the way to obtain the Flag seems to be to identify the text that matches this signature.
\nReference: Bytecode Signatures - ClamAV Documentation
\nBefore solving the challenge, I decided to first read through the documentation on ClamAV signatures.
\nReference: Signatures - ClamAV Documentation
\nClamAV signatures appear to fall broadly into the following categories.
\nFrom here on, I will organize the documentation for each type of ClamAV signature.
\nIn ClamAV, signatures are distributed as archive files in database formats called CDV and CLD.
\nCLD files are created when updates are applied through a differential update mechanism called CDIFF.
\nReference: Terminology - ClamAV Documentation
\nReference: ClamAV® blog: ClamAV, CVDs, CDIFFs and the magic behind the curtain
\nA CVD is a compressed signature database archive that is digitally signed and distributed by Cisco-Talos.
\nOn machines that use ClamAV, CVD files are normally downloaded by the freshclam module.
The extension for a CVD is .cvd, but when a CVD or CLD database is updated with a CDIFF patch file, the extension becomes .cld.
In addition to the CDV databases distributed by Cisco-Talos, ClamAV can also perform scans using custom database files.
\nIn ClamAV, you can use Body-based signatures in addition to database-format signatures.
\nA Body-based signature is a signature that defines detection conditions based on specific byte sequences in the scan target, rather than hashes.
\nThe main types of Body-based signatures available in ClamAV are as follows.
\nNote: Signatures whose extension ends with u are loaded only when PUA signatures are enabled.
*.ndb / *.ndu: Extended signatures*.ldb / *.ldu / *.idb: Logical Signatures*.cdb: Container Metadata Signatures*.cbc: Bytecode Signatures*.pdb / *.gdb / *.wdb: Phishing URL SignaturesThe bytecode signature (.cbc) used in this challenge is also one type of Body-based signature.
*.ndb / *.ndu refers to extended signatures.
Extended signatures can be written in the following format, defining items such as TargetType, Virus offset, and FLEVEL in addition to the hex signature.
\nMalwareName:TargetType:Offset:HexSignature[:min_flevel:[max_flevel]]Reference: Extended Signatures - ClamAV Documentation
\nMalwareName can be any value, but official signatures are usually defined according to the following naming convention.
{platform}.{category}.{name}-{signature id}-{revision}Reference: Signatures - ClamAV Documentation
\nTargetType specifies the type of file to scan.
If you want the signature to target arbitrary files, specify 0.
Reference: ClamAV File Types and Target Types - ClamAV Documentation
\nFor example, you can define an extended signature that detects files under the detection name TEST_EXTENDED_SIG as follows.
TEST_EXTENDED_SIG:0:*:48656c6c6f2c20436c616d4156With this signature, you can detect the string Hello, ClamAV, represented as a hex dump with sigtool --hex-dump, in files of any type.
When I actually scanned with the command clamscan --database=TEST_EXTENDED_SIG.ndb test1.txt, I was able to detect files containing the text Hello, ClamAV under the detection name TEST_EXTENDED_SIG.
Signatures with the extensions *.ldb / *.ldu / *.idb are logical signatures.
Logical signatures can combine multiple signatures using logical operators.
\nThe format of a logical signature is as follows.
\nSignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0;Subsig1;Subsig2;...In TargetDescriptionBlock, information about the engine and target files is written as comma-separated pairs.
Although TargetDescriptionBlock can include items other than Engine, it is recommended to place the Engine specification first for compatibility reasons.
The Engine field is written in a format such as Engine:81-255.
This Engine setting is especially important for signatures that use features added in specific versions.
Incidentally, this field is expressed as a range of FLEVEL values. An FLEVEL value of 81 corresponds to version 0.99.
\nReference: ClamAV Versions and Functionality Levels - ClamAV Documentation
\nOther values that can be specified in TargetDescriptionBlock include Target, FileSize, and EntryPoint offsets, among others.
Target lets you specify the file to be scanned. As with extended signatures, 0 means an arbitrary file.
Reference: ClamAV File Types and Target Types - ClamAV Documentation
\nIn the following LogicalExpression section, you write the logical expression that defines the relationships among the sub-signatures that follow.
You can define up to 64 sub-signatures, and they are referenced in order as 0, 1, 2, and so on.
The implementation is a little hard to grasp, but these sub-signatures can contain expressions and values.
\nFor example, in the following signature, which is the same as the sample in the documentation, the logical expression 0&1 defines a signature that detects the target file only when both Subsig0 (41414141::i) and Subsig1 (424242424242::i) match.
TEST_LOGICAL_SIG;Engine:81-255,Target:0;0&1;41414141::i;424242424242::i::i is an option that instructs ClamAV to ignore case.
In other words, the above signature detects a file when both AAAA (or aaaa) and BBBBBB (or bbbbbb) are present in the file.
If you actually test this signature against the text files from test1 to test4, you can confirm that detection occurs only when both AAAA (or aaaa) and BBBBBB (or bbbbbb) are present in the file.
Since test3 and test4 contain only one of AAAA or BBBBBB, they are not detected by this signature.
In addition, the ContainerSize option lets you specify the size of the container file itself, such as a ZIP, in bytes.
If you change the value of ContainerSize to 80000000-90000000, testzip.zip is no longer detected, but bigsizezip.zip, whose file size is 88843043, is detected.
TEST_CONTAINER_METADATA_SIG:CL_TYPE_ZIP:80000000-90000000:*:*:*:*:*:*:*Note that the file hash signatures generated by sigtool include the target file’s size in the FileSize field.
However, if the file size is unknown and only the hash is known, you can also detect it by replacing FileSize with a wildcard as shown below.
bf47ba8d5e3af20bd79fa2c9ed028c5a9501a00f:*:test1.txt:73When using this notation, you need to append a value at the end to specify a minimum engine level of 73 or higher.
\nClamAV can use not only file hashes but also hash signatures for specific sections within PE files for detection.
\nPE section hash signatures can also be created with sigtool.
sigtool --mdb /path/to/32bit/PE/fileHowever, as of the time of writing this article (August 2024), even the latest version of ClamAV does not appear to support creating section hash signatures for 64-bit PE binaries.
\nNote: PE import table hash signatures are likewise supported only for 32-bit files.
\nBecause ClamAV can process YARA rules, you can define signatures with the .yar / .yara extensions that contain YARA rules.
However, ClamAV has some limitations on the YARA rules it can handle, so caution is required.
\nI will omit the detailed limitations and usage in this article.
\nReference: YARA Rules - ClamAV Documentation
\nClamAV lets you configure several allow rules to suppress false positives.
\nAllow rules can be configured either per file hash or per signature.
\nCreating an allow rule that suppresses detection for a specific file is simple: just add a line output by sigtool, much like a file hash signature.
When adding a SHA1 or SHA256 hash as an allow rule, use .sfp as the extension for the allow list.
sigtool --sha256 ~/Downloads/eicar.com >> /var/lib/clamav/false-positives.sfp# Check the hex string to use for signatures\necho -n \"test\" | sigtool --hex-dump\n\n# Create file hash signatures\nsigtool --md5 test1.txt > test.hdb\nsigtool --sha1 test1.txt > test.hdb\nsigtool --sha256 test1.txt > test.hdb\n\n# Create allowlist rules\nsigtool --sha256 ~/Downloads/eicar.com >> /var/lib/clamav/false-positives.sfpReference: Signatures - ClamAV Documentation
\nTo solve Devil Hunter, the challenge covered in this post, I dug deeper into the documentation on bytecode signatures.
\nReference: clamav-bytecode-compiler/docs/user/clambc-user.pdf at main · Cisco-Talos/clamav-bytecode-compiler
\nFirst, prepare the bytecode compiler.
\nInstall clang and LLVM, which are required to build the bytecode compiler.
\nclang and LLVM need to use matching versions, and version 8 appears to be the recommended one.
\nI tried using the latest version 18 available through apt, but the build failed, so I decided to use Docker to prepare an environment with clang/LLVM version 8.
\nReference: clamav-docker/clamav-bytecode-compiler/README.md at main · Cisco-Talos/clamav-docker
\nWith any directory set as the current directory, run the following command:
\ndocker run -v `pwd`:/src -it clamav/clambc-compiler:stable /bin/bashThis makes it possible to run clambc-compiler.
Logical signature bytecodes (also known as Algorithmic detection bytecodes) are bytecode signatures triggered by signatures equivalent to Logical signatures (.ldb).
The CDV/CLV signatures officially distributed by ClamAV also fall into the category of bytecode signatures.
\nBy default, however, ClamAV treats any bytecode signature other than those officially distributed by Cisco as an “untrusted” signature.
\nBecause of this, when scanning with a custom bytecode signature you created yourself, be aware that you must explicitly enable the option in clamscan or clamd that allows the use of untrusted bytecode signatures.
Reference: ClamAV® blog: Brief Re-introduction to ClamAV Bytecode Signatures
\nUsing Logical signature bytecodes lets you define more complex detection logic that can run faster than using Logical signatures directly.
\nAlgorithmic detection bytecodes are broadly made up of the following elements:
\nbool logical_trigger(void))int entrypoint(void)In a bytecode signature, you define the required VIRUSNAME_PREFIX and the optional VIRUSNAMES as the malware names used for detection.
The name specified in VIRUSNAME_PREFIX is always used when a detection occurs.
The optional values defined in VIRUSNAMES, separated by commas, are appended after VIRUSNAME_PREFIX.
// TESTMALWARE.001.A\n// TESTMALWARE.001.B\nVIRUSNAME_PREFIX(\"TESTMALWARE.001\")\nVIRUSNAMES(\"A\",\"B\")This optional part is determined by passing a value like foundVirus(\"A\"); as the argument to the foundVirus function inside the bytecode signature.
You also need to specify an integer in TARGET that indicates the type the bytecode signature will scan.
As with the other signatures used so far, this integer should use one of the values listed in the following documentation.
\nReference: ClamAV File Types and Target Types - ClamAV Documentation
\nFor example, the following specifies HTML(normalized) as the target.
// HTML(normalized)\n// HTML - Whitespace transformed to spaces, tags/tag attributes normalized, all lowercase.\nTARGET(3)When HTML(normalized) is specified as the target, note that whitespace and tags are transformed and all text is interpreted as lowercase. (Signatures that target uppercase text will no longer work as intended.)
Bytecode signatures can also specify the minimum required FLEVEL.
\nWhen you define it inside a bytecode signature, you do not use the integer FLEVEL value directly. Instead, you specify a value such as FUNC_LEVEL_098_5.
// FUNC_LEVEL_098_5 = 78\nFUNCTIONALITY_LEVEL_MIN(FUNC_LEVEL_098_5)For the possible values, use the entries in the FunctionalityLevel (bytecode enum) column in the documentation below.
Reference: ClamAV Versions and Functionality Levels - ClamAV Documentation
\nInside a bytecode signature, you can define Declarations and Definitions.
\nDeclarations are used like variable declarations, while Definitions are used like variable definitions.
\nBecause of that, Declarations must always come before Definitions.
\nIn the following example, two Declarations are defined: magic and trojan.
// Declarations\nSIGNATURES_DECL_BEGIN\nDECLARE_SIGNATURE(magic)\nDECLARE_SIGNATURE(trojan)\nSIGNATURES_DECL_ENDThe Definitions corresponding to these Declarations can be written as follows.
\n// Definitions \nSIGNATURES_DEF_BEGIN\nDEFINE_SIGNATURE(magic,\"61616161\")\nDEFINE_SIGNATURE(trojan,\"74726f6a616e\")\nSIGNATURES_ENDThis registers two global variables, magic and trojan, so you can use these values inside the bytecode signature logic.
Also, if you want a signature to detect a specific string, you need to specify the hex-dumped string just as you would with Logical signatures.
\nIn the example above, because the target string is aaaa, the definition uses DEFINE_SIGNATURE(magic,\"61616161\") instead of DEFINE_SIGNATURE(magic,\"aaaa\").
In a bytecode signature, the actual signature (int entrypoint(void)) is triggered when the pattern in the Logical signature written as a simple C function (bool logical_trigger(void)) matches.
So first, define the logical_trigger function as follows.
// All bytecode triggered by logical signatures must have this function\nbool logical_trigger(void)\n{\n return count_match(Signatures.magic) > 1;\n}The count_match function counts how many times a specific pattern matched and returns that count.
In the example above, it returns the number of matches for the pattern defined by magic.
// This is the bytecode function that is actually executed when the logical signature matched\nint entrypoint(void)\n{\n if (matches(Signatures.deadbeef)) { foundVirus (\"A\") ; }\n else { foundVirus(\"B\"); }\n\n // success, return 0\n return 0;\n}Define the actual bytecode signature body (int entrypoint(void)), which is called when the Logical signature matches.
If the entrypoint processing succeeds, it is recommended that this function always return 0.
Also, use the foundVirus function when a malware condition matches.
// This is the bytecode function that is actually executed when the logical signature matched\nint entrypoint(void)\n{\n if (matches(Signatures.trojan)) { foundVirus(\"A\"); }\n else { foundVirus(\"B\"); }\n\n // success, return 0\n return 0;\n}In the example above, if the pattern matches(Signatures.deadbeef) matches, it uses A, the optional VIRUSNAMES value, and if it does not match, it uses B for detection.
The full signature created this time is shown below.
\n// TESTMALWARE.001.A\n// TESTMALWARE.001.B\nVIRUSNAME_PREFIX(\"TESTMALWARE.001\")\nVIRUSNAMES(\"A\",\"B\")\nTARGET(0)\n\n// FUNC_LEVEL_098_5 = 78\nFUNCTIONALITY_LEVEL_MIN(FUNC_LEVEL_098_5)\n\n// Declarations\nSIGNATURES_DECL_BEGIN\nDECLARE_SIGNATURE(magic)\nDECLARE_SIGNATURE(trojan)\nSIGNATURES_DECL_END\n\n// Definitions \nSIGNATURES_DEF_BEGIN\nDEFINE_SIGNATURE(magic,\"61616161\")\nDEFINE_SIGNATURE(trojan,\"74726f6a616e\")\nSIGNATURES_END\n\n// All bytecode triggered by logical signatures must have this function\nbool logical_trigger(void)\n{\n return count_match(Signatures.magic) > 1;\n}\n\n// This is the bytecode function that is actually executed when the logical signature matched\nint entrypoint(void)\n{\n if (matches(Signatures.trojan)) { foundVirus(\"A\"); }\n else { foundVirus(\"B\"); }\n\n // success, return 0\n return 0;\n}Now compile the bytecode signature created so far and scan with it.
\nThe directory structure is as follows.
\n$ tree\n.\n├── bytecodes\n│ └── TESTCODE001.c\n├── samplefiles\n│ ├── TEST001.html\n│ └── TEST001.txt\n└── up_bytecodes.shFirst, pull and start the clambc-compiler container image.
At this point, the volume directory is set to the bytecodes directory that contains the C file.
# Pull and start the clambc-compiler Docker container\ndocker run -v ./bytecodes:/src -it clamav/clambc-compiler:stable /bin/bash\n\n# Compile TESTCODE001.c to TESTCODE001.cbc\ncd /src\nclambc-compiler /src/TESTCODE001.c -o TESTCODE001.cbc -O2In the example above, -O2 is specified as the optimization option.
You can use any optimization option from -O0 to -O3, but it seems to be recommended to use at least -O1 or higher.
Once this is done, you can scan using the compiled CBC file.
\nWhen using a bytecode signature not distributed by Cisco, you must use the --bytecode-unsigned=yes option.
Also, if detection does not work as intended, you can investigate with the --debug option.
clamscan --bytecode-unsigned=yes --disable-cache -d ./bytecodes/TESTCODE001.cbc ./samplefiles/TEST001.txtThis time, because the target file type is specified as HTML(normalized), a txt file is not detected even if it contains strings such as aaaa.
In the signature above, If JSON is being generated, you can detect the target file type by comparing the string value of the You can scan with the CBC file compiled from this signature using the following command. When using When you scan the sample Word file with this signature, the file is detected as Also, if you use the In this case, the following JSON was dumped. You can use POSIX regular expressions inside bytecode signatures. Here, it looks like you can also use features such as specifying scan positions with For details, please refer to the official documentation. Using the Below is an example of dumping information from TESTCODE001.cbc. From the dump result above, you can understand information such as the Logical signature details and the number of functions inside the bytecode signature. Using the As you can see from the clambc code, this source code is embedded in encoded form in lines beginning with This code extracts the source using Reference: clamav/clambc/bcrun.c at main · Cisco-Talos/clamav Next, we create the following Python script and confirm that the source code embedded in the bytecode signature can in fact be decoded. Running the Python script above shows that, just as when using clambc, we can recover the original source code used for compilation. When bytecode signatures distributed officially or used in CTF problems are involved, it seems the source-code portion inside the bytecode signature is sometimes removed or replaced so that the source cannot be easily recovered with clambc. In fact, in the Devil Hunter challenge binary, fake data generated by the following code was embedded so that the original source could not be viewed with the clambc command. Reference: SECCON2022onlineCTF/reversing/devilhunter/builds/gen.py at main · SECCON/SECCON2022online_CTF If For example, analyzing TESTCODE001.cbc, which we have been using so far, gives the following result. The code in TESTCODE001.c was as follows. Since this bytecode signature has only a single function, the entrypoint, only From here, we will organize and interpret the disassembled code. Because there is almost no public information about this disassembly output, I will work through it by trial and error while referring to the ClamAV source code. Reference: clamav/libclamav/bytecode.c at main · Cisco-Talos/clamav Reference: clamav/libclamav/bytecode_vm.c at main · Cisco-Talos/clamav Reference: clamav/libclamav/clambc.h at main · Cisco-Talos/clamav First, the initial The following In this case, it seems to be comparing against the constant 0 with ID 4. Values such as VIRUSNAME are represented as Because having many signature variables makes it hard to read, next we will disassemble a bytecode signature generated from the following code. Disassembling the bytecode signature generated from this code gives the following result. First, it stores the counts of magic and trojan in variables 0 and 1. After that, it stores the result of shifting variable 1 left by one bit (that is, multiplying by 2) into variable 2, and then adds variable 0 to it. The computation up to this point corresponds to the following code. It then uses In this way, the disassembly output of a bytecode signature can be read much like VM code. You can debug the VM execution of a bytecode signature to some extent using gdb. You can run the debugging session with the following commands. Reference: clamav/libclamav/bytecode_vm.c at main · Cisco-Talos/clamav If you continue debugging this function, you can reach the execution code for handling each opcode as shown below. Although this article does not use it, when debugging bytecode signatures, a very convenient approach is to modify the libclamav source code so that it outputs debug traces. I have summarized the details in the following article. Reference: How to Enable Bytecode Signature Debug Traces in libclamav Now that I have mostly organized my understanding of ClamAV signatures, it is finally time to solve the Devil Hunter challenge. The Devil Hunter challenge binary was the following cbc file. First, I checked the file information with The logical signature that triggers this bytecode signature appears to be the one defined with Unfortunately, the source-code information seems to have been tampered with, and I could not retrieve it even with So I decided to inspect the output of This signature appears to define three functions, with IDs 0 through 2. Among them, the function with ID 0 shown below looks like the entry point. Inside it, the result of That suggests the correct Flag is the input for which The function with ID 1 seems to compare some kind of values. It also executes the function with ID 2 via The function with ID 1 seems to contain the main logic, but I decided to examine the shorter function with ID 2 first. Below is the disassembly of the function with ID 2 (hereafter, Func2). This code has three BB sections. The first section is simple: it copies the values of several constants into local variables. The last section returns the variable with ID 13 via The middle section is implemented as follows. The presence of Also, the variable with ID 15 being evaluated here corresponds to the result of Since ID 25 is the constant Inside the loop, several variables are processed with XOR and shift operations. Another key point is variable 0, which is logically right-shifted by Translating that behavior into C gave the following code. Apparently, this function takes a 32-bit integer argument, splits it into four 8-bit chunks, and returns the result of performing shift and logical operations using those values. After reading the implementation of Func2, I moved on to the code of Func1. Func1 defines a very large number of variables and constants, but the constants that stood out in particular were the following. Among these, nine total 32-bit integer values are defined, including These values seemed likely to be used somehow in Flag verification. Func1 consists of BB blocks 0 through 7. The code of the first block is as follows. The GEP in GEPZ is probably short for GetElementPtr, and it appears to perform pointer-address calculation just like LLVM’s GEP instruction. I do not know LLVM very well, but based on the reference, it seems to be a process for working with the value pointed to by a pointer address. Reference: The Often Misunderstood GEP Instruction — LLVM 20.0.0git documentation In the next instruction, Reference: clamav/libclamav/bytecode_api.h at main · Cisco-Talos/clamav As we already saw from the logical-signature settings, this scan target contains the text In the final instruction, the value of constant ID 8 ( The code implemented in BB2 is as follows. From the definitions of BB7 appears to be the failure path, so here we need to determine the branch that does not jump to BB7. I extracted the branching part and replaced the constants with their actual values. From this, we can see that the variable Since It is unclear what After reading 36 characters and storing them somewhere, the BB3 block is invoked. Here, it reads one additional character and appears to verify that the character matches From the information so far, we can see that the correct Flag has the form In the next block, it reads one more character and checks that the read probably fails. In other words, it is likely checking that the scan target ends with In the BB5 block, the variable with ID 26 appears to be used as a counter for another loop. The constant 134 used in the loop-termination branch ( Inside it, the previously examined Func2 is also called. The argument passed when calling Func2 is the variable with ID 32, but it is not at all clear what gets stored there. However, For that reason, and also considering the structure of the challenge itself, it seems reasonable to assume that the value passed as the argument to Func2 is obtained by taking 4 characters (32 bits) from the input. This return value then appears to be stored, on the line In BB6, the final block, the values extracted from Based on everything confirmed so far, this bytecode signature seems to scan any file containing a Flag of the form Based on the findings so far, I tried creating a solver in Z3Py to identify an input that makes Func2 output the hardcoded values. I wrote the following solver, but even after various customizations I could not identify values that returned SAT. (I suspect I was not handling the types correctly, but I could not determine the exact cause.) So instead, I decided to identify the Flag by brute force using the following Func2 function implemented with By the time I finished writing it, I was thinking it might have been faster to write it in plain C instead of Using this Flag also lets you get past the ClamAV scan.json_is_active() checks whether File Properties Collection JSON is being generated. If it is not, the file is detected as InActive.FileType element.if (strlen == 14 && !memcmp(str, \"CL_TYPE_MSEXE\", 14)) {\n foundVirus(\"CL_TYPE_MSEXE\");\n return 0;\n}clamscan, you need to specify the --gen-json option.clamscan --gen-json --bytecode-unsigned=yes --disable-cache -d ./bytecodes/TESTCODE002.cbc ./samplefiles/doc_sample.docxSUBMIT.filetype.CL_TYPE_OOXML_WORD.--debug option with clamscan, you can dump the generated JSON object.{\n \"Magic\":\"CLAMJSONv0\",\n \"RootFileType\":\"CL_TYPE_OOXML_WORD\",\n \"FileName\":\"doc_sample.docx\",\n \"FileType\":\"CL_TYPE_OOXML_WORD\",\n \"FileSize\":29864,\n \"FileMD5\":\"1d45f29f2c0523d334d4665acd30a208\",\n \"CoreProperties\":{\n \"Attributes\":{\n \"cp\":\"http://schemas.openxmlformats.org/package/2006/metadata/core-properties\",\n \"dc\":\"http://purl.org/dc/elements/1.1/\",\n \"dcterms\":\"http://purl.org/dc/terms/\",\n \"dcmitype\":\"http://purl.org/dc/dcmitype/\",\n \"xsi\":\"http://www.w3.org/2001/XMLSchema-instance\"\n },\n \"Title\":{},\n \"Keywords\":{},\n \"Created\":{\n \"Value\":[\n \"2024-07-26T03:53:00Z\"\n ]\n },\n \"Modified\":{\n \"Value\":[\n \"2024-07-26T03:53:00Z\"\n ]\n }\n },\n \"CorePropertiesFileCount\":1,\n \"CustomPropertiesFileCount\":1,\n \"ContainedObjects\":[\n {\n \"FileName\":\"app.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-05142ae220fd85d0de8aa5fdbb679e88.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":1105,\n \"FileMD5\":\"133656865921af498aa28ec5b4f77b24\"\n },\n {\n \"FileName\":\".rels\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-1e11204e3c8bc451adce2bbf9684d61f.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":877,\n \"FileMD5\":\"834bb9f139e2c89042bc5f73ca3681ac\"\n },\n {\n \"FileName\":\"core.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-16f795eae2e129a3bc2d6b6d045d7ec6.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":602,\n \"FileMD5\":\"48d63fac37f1798301b4a380bc7fbd47\"\n },\n {\n \"FileName\":\"document.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-df7bee169e6486afa59bea2b33a0c6aa.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":16079,\n \"FileMD5\":\"7caa4d90df6f35547e9a0212c52c3cfb\"\n },\n {\n \"FileName\":\"webSettings.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-e66fe6b6cdc5505ef6837c41f64a7dc9.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":976,\n \"FileMD5\":\"e6ef4ee039cfbbe805db5fd64c9285d6\"\n },\n {\n \"FileName\":\"document.xml.rels\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-fcb2cd75df0a7781452fb1173c41b495.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":1962,\n \"FileMD5\":\"a272a252c4514589d0f0b4095edbf65b\"\n },\n {\n \"FileName\":\"theme11.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-1196c9448d0bd47e20333d0bdd69f464.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":6808,\n \"FileMD5\":\"d4c5d9b2fbc2334a7d960978173fcbc1\"\n },\n {\n \"FileName\":\"item3.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-c2d5f805bdde863a8c614f7b89a9ebda.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":219,\n \"FileMD5\":\"5eca9e027b94e6cd1bc64f2a06dcee92\"\n },\n {\n \"FileName\":\"itemProps31.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-5c0ec7b9b208dd18bc16221dd74383a8.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":335,\n \"FileMD5\":\"08962c42256ecf756d4c628af592ff6f\"\n },\n {\n \"FileName\":\"item3.xml.rels\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-5fef1f0b8a132ec493b0cb870a6ffc2d.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":293,\n \"FileMD5\":\"14d033452b3fba1be7138b73fa7d2e4b\"\n },\n {\n \"FileName\":\"settings.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-99884602b93a2ddf9d3eeaa0e70f0967.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":6081,\n \"FileMD5\":\"de6f78fd2ae424ff5fd54310e161a25b\"\n },\n {\n \"FileName\":\"fontTable.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-b2a1927c2e99604e8697311d48fd4e48.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":3025,\n \"FileMD5\":\"aadd621b59bb8af6b1324ce4579db1d8\"\n },\n {\n \"FileName\":\"item22.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-bce3cc1fe0e193e1f97ad4aa8bded549.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":1131,\n \"FileMD5\":\"1aa7d8c84bbb518b7eec09d8fa79bdf7\"\n },\n {\n \"FileName\":\"itemProps22.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-c1f279419e99fb98be3876f2ffaa58bc.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":614,\n \"FileMD5\":\"bbb569ce2200d3b8e0f5af2fd0ee87f2\"\n },\n {\n \"FileName\":\"item22.xml.rels\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-68018783a654cc1de6c75725876934cf.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":293,\n \"FileMD5\":\"1b52716de290d728812bdd805e6ee277\"\n },\n {\n \"FileName\":\"item13.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-1cb43cc91c383ab4dc962120b926aafb.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":306,\n \"FileMD5\":\"217ee5ba5f9835428ff1ab7501faf018\"\n },\n {\n \"FileName\":\"itemProps13.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-1832e99cda5310119c2166934cca1c9c.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":341,\n \"FileMD5\":\"f8fb694a3d90c965a676bdfec949186a\"\n },\n {\n \"FileName\":\"item13.xml.rels\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-395ccc11d1cb463e8e27d5075cd0f4ed.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":293,\n \"FileMD5\":\"4c767529172a3f3e3f06c29757972fd2\"\n },\n {\n \"FileName\":\"styles.xml\",\n \"FilePath\":\"/tmp/20240812_032807-scantemp.57234350df/clamav-5e22fe74d8b0fa6e8b63533680ba5d43.tmp\",\n \"FileType\":\"CL_TYPE_TEXT_ASCII\",\n \"FileSize\":51823,\n \"FileMD5\":\"6092dcc046c92f52c15c83ef435e4f35\",\n \"Viruses\":[\n \"SUBMIT.filetype.CL_TYPE_OOXML_WORD\"\n ]\n }\n ]\n}Using Regular Expressions
\nseek and loop processing.int entrypoint(void) {\n REGEX_SCANNER;\n \n seek(0, SEEK_SET);\n\n for (;;) {\n REGEX_LOOP_BEGIN\n /* \n * ! re2c\n * ANY = [^];\n * \n * \"eval(\" [a-zA-Z_] [a-zA-Z_0-9]* \".unescape\" {\n * long pos = REGEX_POS;\n * if (pos < 0)\n * continue;\n * debug(\"unescape found at: \");\n * debug(pos);\n * }\n * ANY {\n * continue;\n * }\n */\n }\n return 0;\n}Analyzing Bytecode Signatures
\nDisplaying Bytecode Signature Summary Information
\nclambc --info command, you can display summary information for a compiled bytecode signature.bytecode logical signature: TESTMALWARE.001.{A,B};Engine:79-255,Target:3;(0>1);61616161;74726f6a616eViewing the Source Code of a Bytecode Signature
\nclambc --printsrc command, you can view the original source code used to build the bytecode signature, as shown below.S inside the compiled bytecode signature.static void print_src(const char *file)\n{\n char buf[4096];\n int nread, i, found = 0, lcnt = 0;\n FILE *f = fopen(file, \"r\");\n if (!f) {\n fprintf(stderr, \"Unable to reopen %s\\n\", file);\n return;\n }\n do {\n nread = fread(buf, 1, sizeof(buf), f);\n for (i = 0; i < nread - 1; i++) {\n if (buf[i] == '\\n') {\n lcnt++;\n }\n /* skip over the logical trigger */\n if (lcnt >= 2 && buf[i] == '\\n' && buf[i + 1] == 'S') {\n found = 1;\n i += 2;\n break;\n }\n }\n } while (!found && (nread == sizeof(buf)));\n if (debug_flag)\n printf(\"[clambc] Source code:\");\n do {\n for (; i + 1 < nread; i++) {\n if (buf[i] == 'S' || buf[i] == '\\n') {\n putc('\\n', stdout);\n continue;\n }\n putc(((buf[i] & 0xf) | ((buf[i + 1] & 0xf) << 4)), stdout);\n i++;\n }\n if (i == nread - 1 && nread != 1)\n fseek(f, -1, SEEK_CUR);\n i = 0;\n nread = fread(buf, 1, sizeof(buf), f);\n } while (nread > 0);\n fclose(f);\n}(buf[i] & 0xf) | ((buf[i + 1] & 0xf) << 4).code = r\"\"\"Sobob`bdeedcedemdadldgeadbeednb`c`cacnbadSobob`bdeedcedemdadldgeadbeednb`c`cacnbbdSfeidbeeecendadmdedoe`ebeedfdidhehbbbdeedcedemdadldgeadbeednb`c`cacbbibSfeidbeeecendadmdedcehbbbadbblbbbbdbbib\ndeadbegdeddehbccibSSobob`bfdeendcdoeldedfeedldoe`cichcoeec`bmc`bgchcSfdeendcddeidodndadldiddeieoeldedfeedldoemdidndhbfdeendcdoeldedfeedldoe`cichcoeecibSSobob`bddefcflfafbgafdgifofnfcg\nceidgdndaddeeebeedceoeddedcdldoebdedgdidndSddedcdldadbeedoeceidgdndaddeeebeedhbmfafgfifcfibSddedcdldadbeedoeceidgdndaddeeebeedhbdgbgofjfafnfibSceidgdndaddeeebeedceoeddedcdldoeednddd\nSobob`bddefffifnfifdgifofnfcg`bSceidgdndaddeeebeedceoeddedfdoebdedgdidndSddedfdidndedoeceidgdndaddeeebeedhbmfafgfifcflbbbfcacfcacfcacfcacbbibSddedfdidndedoeceidgdndaddeeebeedhbdgbgofjfafnflbbbgcdcgcbcfcfffcaffcacfcefbbib\nceidgdndaddeeebeedceoeedndddSSobob`badlflf`bbfigdgefcfofdfef`bdgbgifgfgfefbgefdf`bbfig`blfofgfifcfaflf`bcgifgfnfafdgegbgefcg`bmfegcgdg`bhfaffgef`bdghfifcg`bffegnfcfdgifofnf\nbfofoflf`blfofgfifcfaflfoedgbgifgfgfefbghbfgofifdfibSkgSbgefdgegbgnf`bcfofegnfdgoemfafdgcfhfhbceifgfnfafdgegbgefcgnbmfafgfifcfib`bnc`backcSmgSSobob`bdehfifcg`bifcg`bdghfef`bbfigdgefcfofdfef`bffegnfcfdgifofnf`bdghfafdg`bifcg`bafcfdgegaflflfig`befhgefcfegdgefdf`bgghfefnf`bdghfef`blfofgfifcfaflf`bcgifgfnfafdgegbgef`bmfafdgcfhfefdf\nifnfdg`befnfdgbgig`gofifnfdghbfgofifdfibSkgSifff`bhbmfafdgcfhfefcghbceifgfnfafdgegbgefcgnbdgbgofjfafnfibib`bkg`bffofegnfdffeifbgegcghbbbadbbibkc`bmgSeflfcgef`bkg`bffofegnfdffeifbgegcghbbbbdbbibkc`bmg\nSobob`bcgegcfcfefcgcglb`bbgefdgegbgnf`b`cSbgefdgegbgnf`b`ckcSmg\"\"\"\n\ni = 0\nwhile True:\n if i >= len(code):\n break\n else:\n if code[i] == \"S\" or code[i] == \"\\n\":\n print()\n i += 1\n else:\n w = ((ord(code[i])) & 0xf) | (((ord(code[i+1])) & 0xf) << 4)\n print(chr(w), end=\"\")\n i += 2fake = b\"not so easy :P\\n\"\nline = \"S\"\nfor c in fake:\n line += chr(0x60 + (c & 0xf))\n line += chr(0x60 + ((c>>4) & 0xf))\nprint(line)Disassembling a Bytecode Signature
\nclambc --printsrc cannot be used, you can use clambc --printbcir to display the bytecode signature as readable text and analyze it.$ clambc --printbcir ./bytecodes/TESTCODE001.cbc \n\nfound 19 extra types of 83 total, starting at tid 69\nTID KIND INTERNAL\n------------------------------------------------------------------------\n 65: DPointerType i8*\n 66: DPointerType i16*\n 67: DPointerType i32*\n 68: DPointerType i64*\n 69: DArrayType [1 x i8]\n 70: DArrayType [2 x i8]\n 71: DArrayType [3 x i8]\n 72: DArrayType [4 x i8]\n 73: DArrayType [5 x i8]\n 74: DArrayType [6 x i8]\n 75: DArrayType [7 x i8]\n 76: DPointerType [64 x i32]*\n 77: DPointerType [18 x i8]*\n 78: DPointerType i32**\n 79: DPointerType i8**\n 80: DFunctionType i32 func ( i32 i32 )\n 81: DArrayType [18 x i8]\n 82: DArrayType [64 x i32]\n------------------------------------------------------------------------\n########################################################################\n####################### Function id 0 ################################\n########################################################################\nfound a total of 9 globals\nGID ID VALUE\n------------------------------------------------------------------------\n 0 [ 0]: i0 unknown\n 1 [ 1]: [18 x i8] unknown\n 2 [ 2]: [18 x i8] unknown\n 3 [ 3]: i32* unknown\n 4 [ 4]: i32* unknown\n 5 [ 5]: i8* unknown\n 6 [ 6]: i8* unknown\n 7 [ 7]: i8* unknown\n 8 [ 8]: i8* unknown\n------------------------------------------------------------------------\nfound 4 values with 0 arguments and 4 locals\nVID ID VALUE\n------------------------------------------------------------------------\n 0 [ 0]: i32\n 1 [ 1]: i1\n 2 [ 2]: i32\n 3 [ 3]: i32\n------------------------------------------------------------------------\nfound a total of 4 constants\nCID ID VALUE\n------------------------------------------------------------------------\n 0 [ 4]: 0(0x0)\n 1 [ 5]: 17(0x11)\n 2 [ 6]: 17(0x11)\n 3 [ 7]: 0(0x0)\n------------------------------------------------------------------------\nfound a total of 8 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.0 -> NUMINSTS 8\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n 0 0 OP_BC_LOAD [39 /198/ 3] load 0 <- p.-2147483644\n 0 1 OP_BC_ICMP_EQ [21 /108/ 3] 1 = (0 == 4)\n 0 2 OP_BC_BRANCH [17 / 85/ 0] br 1 ? bb.2 : bb.1\n\n 1 3 OP_BC_CALL_API [33 /168/ 3] 2 = setvirusname[4] (p.-2147483640, 5)\n 1 4 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n\n 2 5 OP_BC_CALL_API [33 /168/ 3] 3 = setvirusname[4] (p.-2147483642, 6)\n 2 6 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n\n 3 7 OP_BC_RET [19 / 98/ 3] ret 7\n------------------------------------------------------------------------Function id 0 appears in the dump result as well.// TESTMALWARE.001.A\n// TESTMALWARE.001.B\nVIRUSNAME_PREFIX(\"TESTMALWARE.001\")\nVIRUSNAMES(\"A\",\"B\")\nTARGET(3)\n\n// FUNC_LEVEL_098_5 = 78\nFUNCTIONALITY_LEVEL_MIN(FUNC_LEVEL_098_5)\n\n// Declarations\nSIGNATURES_DECL_BEGIN\nDECLARE_SIGNATURE(magic)\nDECLARE_SIGNATURE(trojan)\nSIGNATURES_DECL_END\n\n// Definitions \nSIGNATURES_DEF_BEGIN\nDEFINE_SIGNATURE(magic,\"61616161\")\nDEFINE_SIGNATURE(trojan,\"74726f6a616e\")\nSIGNATURES_END\n\n// All bytecode triggered by logical signatures must have this function\nbool logical_trigger(void)\n{\n return count_match(Signatures.magic) > 1;\n}\n\n// This is the bytecode function that is actually executed when the logical signature matched\nint entrypoint(void)\n{\n if (matches(Signatures.trojan)) { foundVirus(\"A\"); }\n else { foundVirus(\"B\"); }\n\n // success, return 0\n return 0;\n}BB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_LOAD [39 /198/ 3] load 0 <- p.-2147483644\n0 1 OP_BC_ICMP_EQ [21 /108/ 3] 1 = (0 == 4)\n0 2 OP_BC_BRANCH [17 / 85/ 0] br 1 ? bb.2 : bb.1\n1 3 OP_BC_CALL_API [33 /168/ 3] 2 = setvirusname[4] (p.-2147483640, 5)\n1 4 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n2 5 OP_BC_CALL_API [33 /168/ 3] 3 = setvirusname[4] (p.-2147483642, 6)\n2 6 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n3 7 OP_BC_RET [19 / 98/ 3] ret 7OP_BC_LOAD appears to load some value into a variable (probably the variable with ID 0).OP_BC_ICMP_EQ stores the result of comparing two operands into a variable (probably the variable with ID 1).OP_BC_BRANCH then determines whether to jump to bb.2 or bb.1 depending on the comparison result.p.-2147483640, so we cannot tell which is which from that alone, but looking at the source code confirms that the structure is condition ? True : False.// control operations (termination instructions)\ncase OP_BC_BRANCH:\n printf(\"br %d ? bb.%d : bb.%d\", inst->u.branch.condition,inst->u.branch.br_true, inst->u.branch.br_false);\n (*bbnum)++;\n break;int entrypoint(void)\n{\n int a = 1;\n int b = 2;\n int c;\n\n c = a * count_match(Signatures.magic) + b * count_match(Signatures.trojan);\n if (c > 5) { foundVirus(\"A\"); }\n else { foundVirus(\"B\"); }\n\n // success, return 0\n return 0;\n}found 7 values with 0 arguments and 7 locals\nVID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i32\n1 [ 1]: i32\n2 [ 2]: i32\n3 [ 3]: i32\n4 [ 4]: i1\n5 [ 5]: i32\n6 [ 6]: i32\n------------------------------------------------------------------------\nfound a total of 5 constants\nCID ID VALUE\n------------------------------------------------------------------------\n0 [ 7]: 1(0x1)\n1 [ 8]: 5(0x5)\n2 [ 9]: 17(0x11)\n3 [ 10]: 17(0x11)\n4 [ 11]: 0(0x0)\n------------------------------------------------------------------------\nfound a total of 12 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.0 -> NUMINSTS 11\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_LOAD [39 /198/ 3] load 0 <- p.-2147483642\n0 1 OP_BC_LOAD [39 /198/ 3] load 1 <- p.-2147483643\n0 2 OP_BC_SHL [8 / 43/ 3] 2 = 1 << 7\n0 3 OP_BC_ADD [1 / 8/ 0] 3 = 2 + 0\n0 4 OP_BC_ICMP_SGT [27 /138/ 3] 4 = (3 > 8)\n0 5 OP_BC_BRANCH [17 / 85/ 0] br 4 ? bb.1 : bb.2\n\n1 6 OP_BC_CALL_API [33 /168/ 3] 5 = setvirusname[4] (p.-2147483638, 9)\n1 7 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n\n2 8 OP_BC_CALL_API [33 /168/ 3] 6 = setvirusname[4] (p.-2147483640, 10)\n2 9 OP_BC_JMP [18 / 90/ 0] jmp bb.3\n\n3 10 OP_BC_RET [19 / 98/ 3] ret 11\n------------------------------------------------------------------------int a = 1;\nint b = 2;\nint c;\nc = a * count_match(Signatures.magic) + b * count_match(Signatures.trojan);OP_BC_ICMP_SGT to compare whether the computed result (variable 3) is greater than 5, and branches accordingly.Debugging Bytecode Signatures
\ngdb ~/clamav/build/clamscan/clamscan\n\n# Load libclamav\nrun --bytecode-unsigned=yes --disable-cache -d ./bytecodes/TESTCODE001.cbc ./samplefiles/TEST001.txt\n\n# Set a breakpoint and run\nb cli_vm_execute\nrun --bytecode-unsigned=yes --disable-cache -d ./bytecodes/TESTCODE001.cbc ./samplefiles/TEST001.txtcli_vm_execute is a function defined in bytecode_vm.c that is responsible for interpreting and executing the opcodes and operands inside a bytecode signature.Enabling Bytecode Signature Debug Traces in libclamav
\nSolving Devil Hunter by Analyzing the Bytecode Signature
\nClamBCafhaio`lfcf|aa```c``a```|ah`cnbac`cecnb`c``beaacp`clamcoincidencejb:4096\nSeccon.Reversing.{FLAG};Engine:56-255,Target:0;0;0:534543434f4e7b\nTeddaaahdabahdacahdadahdaeahdafahdagahebdeebaddbdbahebndebceaacb`bbadb`baacb`bb`bb`bdaib`bdbfaah\nEaeacabbae|aebgefafdf``adbbe|aecgefefkf``aebae|amcgefdgfgifbgegcgnfafmfef``\nG`ad`@`bdeBceBefBcfBcfBofBnfBnbBbeBefBfgBefBbgBcgBifBnfBgfBnbBfdBldBadBgd@`bad@Aa`bad@Aa`\nA`b`bLabaa`b`b`Faeac\nBaa``b`abTaa`aaab\nBb`baaabbaeAc`BeadTbaab\nBTcab`b@dE\nA`aaLbhfb`dab`dab`daahabndabad`bndabad`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`aa`b`d`b`b`aa`ah`aa`aa`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`b`b`b`d`b`d`b`b`b`b`bad`b`b`bad`b`d`aa`b`b`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`d`b`d`aa`Fbcgah\nBbadaedbbodad@dbadagdbbodaf@db`bahabbadAgd@db`d`bb@habTbaab\nBaaaiiab`dbbaBdbhb`d`bbbbaabTaaaiabac\nBb`dajbbabajb`dakh`ajB`bhb`dalj`akB`bhb`bamn`albadandbbodad@dbadaocbbadanamb`bb`aabbabaoAadaabaanab`bb`aAadb`dbbaa`ajAahb`d`bb@h`Taabaaagaa\nBb`bbcaabbabacAadaabdakab`bbca@dahbeabbacbeaaabfaeaahbeaBmgaaabgak`bdabfab`d`bb@h`Taabgaadag\nBb`bbhaabbabacAadaabiakab`bbha@db`d`bb@haab`d`bb@h`Taabiaagae\nBb`dbjabbaabjab`dbkah`bjaB`bhb`dblaj`bkaB`bhb`bbman`blabadbnadbbodad@dbadboacbbadbnabmab`bb`bgbboab`bbab`baacb`bb`dbbbh`bjaBnahb`dbcbj`bbbB`bhb`bbdbn`bcbb`bbebc`Add@dbadbfbcbbadagbebb`bbgbc`Addbdbbadbhbcbbadbfbbgbb`b`fbbabbhbb`dbiba`bjaAdhaabjbiab`dbibBdbhb`d`bbbibaaTaabjbaeaf\nBb`bbkbgbagaablbeab`bbkbHbj`hnicgdb`bbmbc`Add@dbadbnbcbbadagbmbb`bbobc`AddAadbadb`ccbbadbnbbobb`bbacgbb`caabbceab`bbacHcj`hnjjcdaabcck`blbbbcb`bbdcc`Add@dbadbeccbbadagbdcb`bbfcc`AddAbdbadbgccbbadbecbfcb`bbhcgbbgcaabiceab`bbhcHoigndjkcdaabjck`bccbicb`bbkcc`Add@dbadblccbbadagbkcb`bbmcc`AddAcdbadbnccbbadblcbmcb`bbocgbbncaab`deab`bbocHcoaljkhgdaabadk`bjcb`db`bbbdc`Add@dbadbcdcbbadagbbdb`bbddc`AddAddbadbedcbbadbcdbddb`bbfdgbbedaabgdeab`bbfdHcoalionedaabhdk`badbgdb`bbidc`Add@dbadbjdcbbadagbidb`bbkdc`AddAedbadbldcbbadbjdbkdb`bbmdgbbldaabndeab`bbmdHoilnikkcdaabodk`bhdbndb`bb`ec`Add@dbadbaecbbadagb`eb`bbbec`AddAfdbadbcecbbadbaebbeb`bbdegbbceaabeeeab`bbdeHdochfheedaabfek`bodbeeb`bbgec`Add@dbadbhecbbadagbgeb`bbiec`AddAgdbadbjecbbadbhebieb`bbkegbbjeaableeab`bbkeHdiemjoeedaabmek`bfebleb`bbnec`Add@dbadboecbbadagbneb`bb`fc`AddAhdbadbafcbbadboeb`fb`bbbfgbbafaabcfeab`bbbfHoimmoklfdaabdfk`bmebcfb`dbefo`bdfb`d`bbbef`Tbaag\nBb`dbffbb`bffaabgfn`bffTcaaabgfE\nAab`bLbaab`b`b`dab`dab`d`b`d`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`aa`b`d`b`d`Fbfaac\nBb`d`bb@habb`d`bbG`lckjljhaaTbaaa\nBb`dacbbaaacb`dadbbabadb`baen`acb`bafn`adb`bagh`afAcdb`bahi``agb`baik`ahBoodb`bajm`aiaeb`bakh`ajAhdb`bali`aeBhadb`baml`akalb`bana`afAadaaaoeab`banAddb`db`ao`anb`dbaao`amb`d`bbb`aabb`d`bbbaaaaTaaaoabaa\nBTcab`bamE\nSnfofdg`bcgof`befafcgig`bjc`ej`Inspecting the CBC File Information
\nclambc --info.534543434f4e7b(SECCON{) as the signature.$ clambc --info flag.cbc\n\nBytecode format functionality level: 6\nBytecode metadata:\n compiler version: 0.105.0\n compiled on: (1668026257) Wed Nov 9 20:37:37 2022\n compiled by:\n target exclude: 0\n bytecode type: logical only\n bytecode functionality level: 0 - 0\n bytecode logical signature: Seccon.Reversing.{FLAG};Engine:56-255,Target:0;0;0:534543434f4e7b\n virusname prefix: (null)\n virusnames: 0\n bytecode triggered on: files matching logical signature\n number of functions: 3\n number of types: 21\n number of global constants: 4\n number of debug nodes: 0\n bytecode APIs used:\n read, seek, setvirusnameclambc --printsrc.clambc --printbc instead.$ clambc --printbc flag.cbc\nfound 21 extra types of 85 total, starting at tid 69\nTID KIND INTERNAL\n------------------------------------------------------------------------\n65: DPointerType i8*\n66: DPointerType i16*\n67: DPointerType i32*\n68: DPointerType i64*\n69: DArrayType [1 x i8]\n70: DArrayType [2 x i8]\n71: DArrayType [3 x i8]\n72: DArrayType [4 x i8]\n73: DArrayType [5 x i8]\n74: DArrayType [6 x i8]\n75: DArrayType [7 x i8]\n76: DPointerType [22 x i8]*\n77: DPointerType i8**\n78: DArrayType [36 x i8]\n79: DPointerType [36 x i8]*\n80: DPointerType [9 x i32]*\n81: DFunctionType i32 func ( i32 i32 )\n82: DFunctionType i32 func ( i32 i32 )\n83: DArrayType [9 x i32]\n84: DArrayType [22 x i8]\n------------------------------------------------------------------------\n########################################################################\n####################### Function id 0 ################################\n########################################################################\nfound a total of 4 globals\nGID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i0 unknown\n1 [ 1]: [22 x i8] unknown\n2 [ 2]: i8* unknown\n3 [ 3]: i8* unknown\n------------------------------------------------------------------------\nfound 2 values with 0 arguments and 2 locals\nVID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i1\n1 [ 1]: i32\n------------------------------------------------------------------------\nfound a total of 2 constants\nCID ID VALUE\n------------------------------------------------------------------------\n0 [ 2]: 21(0x15)\n1 [ 3]: 0(0x0)\n------------------------------------------------------------------------\nfound a total of 4 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.0 -> NUMINSTS 5\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_CALL_DIRECT [32 /160/ 0] 0 = call F.1 ()\n0 1 OP_BC_BRANCH [17 / 85/ 0] br 0 ? bb.1 : bb.2\n\n1 2 OP_BC_CALL_API [33 /168/ 3] 1 = setvirusname[4] (p.-2147483645, 2)\n1 3 OP_BC_JMP [18 / 90/ 0] jmp bb.2\n\n2 4 OP_BC_RET [19 / 98/ 3] ret 3\n------------------------------------------------------------------------\n########################################################################\n####################### Function id 1 ################################\n########################################################################\nfound a total of 4 globals\nGID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i0 unknown\n1 [ 1]: [22 x i8] unknown\n2 [ 2]: i8* unknown\n3 [ 3]: i8* unknown\n------------------------------------------------------------------------\nfound 104 values with 0 arguments and 104 locals\nVID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: alloc i64\n1 [ 1]: alloc i64\n2 [ 2]: alloc i64\n3 [ 3]: alloc i8\n4 [ 4]: alloc [36 x i8]\n5 [ 5]: i8*\n6 [ 6]: alloc [36 x i8]\n7 [ 7]: i8*\n8 [ 8]: i32\n9 [ 9]: i1\n10 [ 10]: i64\n11 [ 11]: i64\n12 [ 12]: i64\n13 [ 13]: i32\n14 [ 14]: i8*\n15 [ 15]: i8*\n16 [ 16]: i32\n17 [ 17]: i1\n18 [ 18]: i64\n19 [ 19]: i32\n20 [ 20]: i1\n21 [ 21]: i8\n22 [ 22]: i1\n23 [ 23]: i1\n24 [ 24]: i32\n25 [ 25]: i1\n26 [ 26]: i64\n27 [ 27]: i64\n28 [ 28]: i64\n29 [ 29]: i32\n30 [ 30]: i8*\n31 [ 31]: i8*\n32 [ 32]: i32\n33 [ 33]: i32\n34 [ 34]: i64\n35 [ 35]: i64\n36 [ 36]: i32\n37 [ 37]: i32\n38 [ 38]: i8*\n39 [ 39]: i32\n40 [ 40]: i8*\n41 [ 41]: i64\n42 [ 42]: i1\n43 [ 43]: i32\n44 [ 44]: i1\n45 [ 45]: i32\n46 [ 46]: i8*\n47 [ 47]: i32\n48 [ 48]: i8*\n49 [ 49]: i32\n50 [ 50]: i1\n51 [ 51]: i1\n52 [ 52]: i32\n53 [ 53]: i8*\n54 [ 54]: i32\n55 [ 55]: i8*\n56 [ 56]: i32\n57 [ 57]: i1\n58 [ 58]: i1\n59 [ 59]: i32\n60 [ 60]: i8*\n61 [ 61]: i32\n62 [ 62]: i8*\n63 [ 63]: i32\n64 [ 64]: i1\n65 [ 65]: i1\n66 [ 66]: i32\n67 [ 67]: i8*\n68 [ 68]: i32\n69 [ 69]: i8*\n70 [ 70]: i32\n71 [ 71]: i1\n72 [ 72]: i1\n73 [ 73]: i32\n74 [ 74]: i8*\n75 [ 75]: i32\n76 [ 76]: i8*\n77 [ 77]: i32\n78 [ 78]: i1\n79 [ 79]: i1\n80 [ 80]: i32\n81 [ 81]: i8*\n82 [ 82]: i32\n83 [ 83]: i8*\n84 [ 84]: i32\n85 [ 85]: i1\n86 [ 86]: i1\n87 [ 87]: i32\n88 [ 88]: i8*\n89 [ 89]: i32\n90 [ 90]: i8*\n91 [ 91]: i32\n92 [ 92]: i1\n93 [ 93]: i1\n94 [ 94]: i32\n95 [ 95]: i8*\n96 [ 96]: i32\n97 [ 97]: i8*\n98 [ 98]: i32\n99 [ 99]: i1\n100 [100]: i1\n101 [101]: i64\n102 [102]: i64\n103 [103]: i1\n------------------------------------------------------------------------\nfound a total of 72 constants\nCID ID VALUE\n------------------------------------------------------------------------\n0 [104]: 0(0x0)\n1 [105]: 0(0x0)\n2 [106]: 7(0x7)\n3 [107]: 0(0x0)\n4 [108]: 0(0x0)\n5 [109]: 36(0x24)\n6 [110]: 32(0x20)\n7 [111]: 32(0x20)\n8 [112]: 0(0x0)\n9 [113]: 1(0x1)\n10 [114]: 1(0x1)\n11 [115]: 1(0x1)\n12 [116]: 0(0x0)\n13 [117]: 1(0x1)\n14 [118]: 0(0x0)\n15 [119]: 125(0x7d)\n16 [120]: 0(0x0)\n17 [121]: 1(0x1)\n18 [122]: 0(0x0)\n19 [123]: 0(0x0)\n20 [124]: 0(0x0)\n21 [125]: 32(0x20)\n22 [126]: 32(0x20)\n23 [127]: 0(0x0)\n24 [128]: 30(0x1e)\n25 [129]: 32(0x20)\n26 [130]: 4(0x4)\n27 [131]: 0(0x0)\n28 [132]: 4(0x4)\n29 [133]: 4(0x4)\n30 [134]: 36(0x24)\n31 [135]: 1939767458(0x739e80a2)\n32 [136]: 4(0x4)\n33 [137]: 0(0x0)\n34 [138]: 4(0x4)\n35 [139]: 1(0x1)\n36 [140]: 984514723(0x3aae80a3)\n37 [141]: 4(0x4)\n38 [142]: 0(0x0)\n39 [143]: 4(0x4)\n40 [144]: 2(0x2)\n41 [145]: 1000662943(0x3ba4e79f)\n42 [146]: 4(0x4)\n43 [147]: 0(0x0)\n44 [148]: 4(0x4)\n45 [149]: 3(0x3)\n46 [150]: 2025505267(0x78bac1f3)\n47 [151]: 4(0x4)\n48 [152]: 0(0x0)\n49 [153]: 4(0x4)\n50 [154]: 4(0x4)\n51 [155]: 1593426419(0x5ef9c1f3)\n52 [156]: 4(0x4)\n53 [157]: 0(0x0)\n54 [158]: 4(0x4)\n55 [159]: 5(0x5)\n56 [160]: 1002040479(0x3bb9ec9f)\n57 [161]: 4(0x4)\n58 [162]: 0(0x0)\n59 [163]: 4(0x4)\n60 [164]: 6(0x6)\n61 [165]: 1434878964(0x558683f4)\n62 [166]: 4(0x4)\n63 [167]: 0(0x0)\n64 [168]: 4(0x4)\n65 [169]: 7(0x7)\n66 [170]: 1442502036(0x55fad594)\n67 [171]: 4(0x4)\n68 [172]: 0(0x0)\n69 [173]: 4(0x4)\n70 [174]: 8(0x8)\n71 [175]: 1824513439(0x6cbfdd9f)\n------------------------------------------------------------------------\nfound a total of 176 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.1 -> NUMINSTS 115\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_GEPZ [36 /184/ 4] 5 = gepz p.4 + (104)\n0 1 OP_BC_GEPZ [36 /184/ 4] 7 = gepz p.6 + (105)\n0 2 OP_BC_CALL_API [33 /168/ 3] 8 = seek[3] (106, 107)\n0 3 OP_BC_COPY [34 /174/ 4] cp 108 -> 2\n0 4 OP_BC_JMP [18 / 90/ 0] jmp bb.2\n\n1 5 OP_BC_ICMP_ULT [25 /129/ 4] 9 = (18 < 109)\n1 6 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n1 7 OP_BC_BRANCH [17 / 85/ 0] br 9 ? bb.2 : bb.3\n\n2 8 OP_BC_COPY [34 /174/ 4] cp 2 -> 10\n2 9 OP_BC_SHL [8 / 44/ 4] 11 = 10 << 110\n2 10 OP_BC_ASHR [10 / 54/ 4] 12 = 11 >> 111\n2 11 OP_BC_TRUNC [14 / 73/ 3] 13 = 12 trunc ffffffffffffffff\n2 12 OP_BC_GEPZ [36 /184/ 4] 14 = gepz p.4 + (112)\n2 13 OP_BC_GEP1 [35 /179/ 4] 15 = gep1 p.14 + (13 * 65)\n2 14 OP_BC_CALL_API [33 /168/ 3] 16 = read[1] (p.15, 113)\n2 15 OP_BC_ICMP_SLT [30 /153/ 3] 17 = (16 < 114)\n2 16 OP_BC_ADD [1 / 9/ 0] 18 = 10 + 115\n2 17 OP_BC_COPY [34 /174/ 4] cp 116 -> 0\n2 18 OP_BC_BRANCH [17 / 85/ 0] br 17 ? bb.7 : bb.1\n\n3 19 OP_BC_CALL_API [33 /168/ 3] 19 = read[1] (p.3, 117)\n3 20 OP_BC_ICMP_SGT [27 /138/ 3] 20 = (19 > 118)\n3 21 OP_BC_COPY [34 /171/ 1] cp 3 -> 21\n3 22 OP_BC_ICMP_EQ [21 /106/ 1] 22 = (21 == 119)\n3 23 OP_BC_AND [11 / 55/ 0] 23 = 20 & 22\n3 24 OP_BC_COPY [34 /174/ 4] cp 120 -> 0\n3 25 OP_BC_BRANCH [17 / 85/ 0] br 23 ? bb.4 : bb.7\n\n4 26 OP_BC_CALL_API [33 /168/ 3] 24 = read[1] (p.3, 121)\n4 27 OP_BC_ICMP_SGT [27 /138/ 3] 25 = (24 > 122)\n4 28 OP_BC_COPY [34 /174/ 4] cp 123 -> 1\n4 29 OP_BC_COPY [34 /174/ 4] cp 124 -> 0\n4 30 OP_BC_BRANCH [17 / 85/ 0] br 25 ? bb.7 : bb.5\n\n5 31 OP_BC_COPY [34 /174/ 4] cp 1 -> 26\n5 32 OP_BC_SHL [8 / 44/ 4] 27 = 26 << 125\n5 33 OP_BC_ASHR [10 / 54/ 4] 28 = 27 >> 126\n5 34 OP_BC_TRUNC [14 / 73/ 3] 29 = 28 trunc ffffffffffffffff\n5 35 OP_BC_GEPZ [36 /184/ 4] 30 = gepz p.4 + (127)\n5 36 OP_BC_GEP1 [35 /179/ 4] 31 = gep1 p.30 + (29 * 65)\n5 37 OP_BC_LOAD [39 /198/ 3] load 32 <- p.31\n5 38 OP_BC_CALL_DIRECT [32 /163/ 3] 33 = call F.2 (32)\n5 39 OP_BC_SHL [8 / 44/ 4] 34 = 26 << 128\n5 40 OP_BC_ASHR [10 / 54/ 4] 35 = 34 >> 129\n5 41 OP_BC_TRUNC [14 / 73/ 3] 36 = 35 trunc ffffffffffffffff\n5 42 OP_BC_MUL [3 / 18/ 0] 37 = 130 * 131\n5 43 OP_BC_GEP1 [35 /179/ 4] 38 = gep1 p.7 + (37 * 65)\n5 44 OP_BC_MUL [3 / 18/ 0] 39 = 132 * 36\n5 45 OP_BC_GEP1 [35 /179/ 4] 40 = gep1 p.38 + (39 * 65)\n5 46 OP_BC_STORE [38 /193/ 3] store 33 -> p.40\n5 47 OP_BC_ADD [1 / 9/ 0] 41 = 26 + 133\n5 48 OP_BC_ICMP_ULT [25 /129/ 4] 42 = (41 < 134)\n5 49 OP_BC_COPY [34 /174/ 4] cp 41 -> 1\n5 50 OP_BC_BRANCH [17 / 85/ 0] br 42 ? bb.5 : bb.6\n\n6 51 OP_BC_LOAD [39 /198/ 3] load 43 <- p.7\n6 52 OP_BC_ICMP_EQ [21 /108/ 3] 44 = (43 == 135)\n6 53 OP_BC_MUL [3 / 18/ 0] 45 = 136 * 137\n6 54 OP_BC_GEP1 [35 /179/ 4] 46 = gep1 p.7 + (45 * 65)\n6 55 OP_BC_MUL [3 / 18/ 0] 47 = 138 * 139\n6 56 OP_BC_GEP1 [35 /179/ 4] 48 = gep1 p.46 + (47 * 65)\n6 57 OP_BC_LOAD [39 /198/ 3] load 49 <- p.48\n6 58 OP_BC_ICMP_EQ [21 /108/ 3] 50 = (49 == 140)\n6 59 OP_BC_AND [11 / 55/ 0] 51 = 44 & 50\n6 60 OP_BC_MUL [3 / 18/ 0] 52 = 141 * 142\n6 61 OP_BC_GEP1 [35 /179/ 4] 53 = gep1 p.7 + (52 * 65)\n6 62 OP_BC_MUL [3 / 18/ 0] 54 = 143 * 144\n6 63 OP_BC_GEP1 [35 /179/ 4] 55 = gep1 p.53 + (54 * 65)\n6 64 OP_BC_LOAD [39 /198/ 3] load 56 <- p.55\n6 65 OP_BC_ICMP_EQ [21 /108/ 3] 57 = (56 == 145)\n6 66 OP_BC_AND [11 / 55/ 0] 58 = 51 & 57\n6 67 OP_BC_MUL [3 / 18/ 0] 59 = 146 * 147\n6 68 OP_BC_GEP1 [35 /179/ 4] 60 = gep1 p.7 + (59 * 65)\n6 69 OP_BC_MUL [3 / 18/ 0] 61 = 148 * 149\n6 70 OP_BC_GEP1 [35 /179/ 4] 62 = gep1 p.60 + (61 * 65)\n6 71 OP_BC_LOAD [39 /198/ 3] load 63 <- p.62\n6 72 OP_BC_ICMP_EQ [21 /108/ 3] 64 = (63 == 150)\n6 73 OP_BC_AND [11 / 55/ 0] 65 = 58 & 64\n6 74 OP_BC_MUL [3 / 18/ 0] 66 = 151 * 152\n6 75 OP_BC_GEP1 [35 /179/ 4] 67 = gep1 p.7 + (66 * 65)\n6 76 OP_BC_MUL [3 / 18/ 0] 68 = 153 * 154\n6 77 OP_BC_GEP1 [35 /179/ 4] 69 = gep1 p.67 + (68 * 65)\n6 78 OP_BC_LOAD [39 /198/ 3] load 70 <- p.69\n6 79 OP_BC_ICMP_EQ [21 /108/ 3] 71 = (70 == 155)\n6 80 OP_BC_AND [11 / 55/ 0] 72 = 65 & 71\n6 81 OP_BC_MUL [3 / 18/ 0] 73 = 156 * 157\n6 82 OP_BC_GEP1 [35 /179/ 4] 74 = gep1 p.7 + (73 * 65)\n6 83 OP_BC_MUL [3 / 18/ 0] 75 = 158 * 159\n6 84 OP_BC_GEP1 [35 /179/ 4] 76 = gep1 p.74 + (75 * 65)\n6 85 OP_BC_LOAD [39 /198/ 3] load 77 <- p.76\n6 86 OP_BC_ICMP_EQ [21 /108/ 3] 78 = (77 == 160)\n6 87 OP_BC_AND [11 / 55/ 0] 79 = 72 & 78\n6 88 OP_BC_MUL [3 / 18/ 0] 80 = 161 * 162\n6 89 OP_BC_GEP1 [35 /179/ 4] 81 = gep1 p.7 + (80 * 65)\n6 90 OP_BC_MUL [3 / 18/ 0] 82 = 163 * 164\n6 91 OP_BC_GEP1 [35 /179/ 4] 83 = gep1 p.81 + (82 * 65)\n6 92 OP_BC_LOAD [39 /198/ 3] load 84 <- p.83\n6 93 OP_BC_ICMP_EQ [21 /108/ 3] 85 = (84 == 165)\n6 94 OP_BC_AND [11 / 55/ 0] 86 = 79 & 85\n6 95 OP_BC_MUL [3 / 18/ 0] 87 = 166 * 167\n6 96 OP_BC_GEP1 [35 /179/ 4] 88 = gep1 p.7 + (87 * 65)\n6 97 OP_BC_MUL [3 / 18/ 0] 89 = 168 * 169\n6 98 OP_BC_GEP1 [35 /179/ 4] 90 = gep1 p.88 + (89 * 65)\n6 99 OP_BC_LOAD [39 /198/ 3] load 91 <- p.90\n6 100 OP_BC_ICMP_EQ [21 /108/ 3] 92 = (91 == 170)\n6 101 OP_BC_AND [11 / 55/ 0] 93 = 86 & 92\n6 102 OP_BC_MUL [3 / 18/ 0] 94 = 171 * 172\n6 103 OP_BC_GEP1 [35 /179/ 4] 95 = gep1 p.7 + (94 * 65)\n6 104 OP_BC_MUL [3 / 18/ 0] 96 = 173 * 174\n6 105 OP_BC_GEP1 [35 /179/ 4] 97 = gep1 p.95 + (96 * 65)\n6 106 OP_BC_LOAD [39 /198/ 3] load 98 <- p.97\n6 107 OP_BC_ICMP_EQ [21 /108/ 3] 99 = (98 == 175)\n6 108 OP_BC_AND [11 / 55/ 0] 100 = 93 & 99\n6 109 OP_BC_SEXT [15 / 79/ 4] 101 = 100 sext 1\n6 110 OP_BC_COPY [34 /174/ 4] cp 101 -> 0\n6 111 OP_BC_JMP [18 / 90/ 0] jmp bb.7\n\n7 112 OP_BC_COPY [34 /174/ 4] cp 0 -> 102\n7 113 OP_BC_TRUNC [14 / 70/ 0] 103 = 102 trunc ffffffffffffffff\n7 114 OP_BC_RET [19 / 95/ 0] ret 103\n------------------------------------------------------------------------\n########################################################################\n####################### Function id 2 ################################\n########################################################################\nfound a total of 4 globals\nGID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i0 unknown\n1 [ 1]: [22 x i8] unknown\n2 [ 2]: i8* unknown\n3 [ 3]: i8* unknown\n------------------------------------------------------------------------\nfound 18 values with 1 arguments and 17 locals\nVID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i32 argument\n1 [ 1]: alloc i64\n2 [ 2]: alloc i64\n3 [ 3]: i64\n4 [ 4]: i64\n5 [ 5]: i32\n6 [ 6]: i32\n7 [ 7]: i32\n8 [ 8]: i32\n9 [ 9]: i32\n10 [ 10]: i32\n11 [ 11]: i32\n12 [ 12]: i32\n13 [ 13]: i32\n14 [ 14]: i32\n15 [ 15]: i1\n16 [ 16]: i64\n17 [ 17]: i64\n------------------------------------------------------------------------\nfound a total of 8 constants\nCID ID VALUE\n------------------------------------------------------------------------\n0 [ 18]: 0(0x0)\n1 [ 19]: 181056448(0xacab3c0)\n2 [ 20]: 3(0x3)\n3 [ 21]: 255(0xff)\n4 [ 22]: 8(0x8)\n5 [ 23]: 24(0x18)\n6 [ 24]: 1(0x1)\n7 [ 25]: 4(0x4)\n------------------------------------------------------------------------\nfound a total of 26 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.2 -> NUMINSTS 22\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n0 1 OP_BC_COPY [34 /174/ 4] cp 19 -> 1\n0 2 OP_BC_JMP [18 / 90/ 0] jmp bb.1\n\n1 3 OP_BC_COPY [34 /174/ 4] cp 1 -> 3\n1 4 OP_BC_COPY [34 /174/ 4] cp 2 -> 4\n1 5 OP_BC_TRUNC [14 / 73/ 3] 5 = 3 trunc ffffffffffffffff\n1 6 OP_BC_TRUNC [14 / 73/ 3] 6 = 4 trunc ffffffffffffffff\n1 7 OP_BC_SHL [8 / 43/ 3] 7 = 6 << 20\n1 8 OP_BC_LSHR [9 / 48/ 3] 8 = 0 >> 7\n1 9 OP_BC_AND [11 / 58/ 3] 9 = 8 & 21\n1 10 OP_BC_XOR [13 / 68/ 3] 10 = 9 ^ 5\n1 11 OP_BC_SHL [8 / 43/ 3] 11 = 10 << 22\n1 12 OP_BC_LSHR [9 / 48/ 3] 12 = 5 >> 23\n1 13 OP_BC_OR [12 / 63/ 3] 13 = 11 | 12\n1 14 OP_BC_ADD [1 / 8/ 0] 14 = 6 + 24\n1 15 OP_BC_ICMP_EQ [21 /108/ 3] 15 = (14 == 25)\n1 16 OP_BC_SEXT [15 / 79/ 4] 16 = 14 sext 20\n1 17 OP_BC_SEXT [15 / 79/ 4] 17 = 13 sext 20\n1 18 OP_BC_COPY [34 /174/ 4] cp 16 -> 2\n1 19 OP_BC_COPY [34 /174/ 4] cp 17 -> 1\n1 20 OP_BC_BRANCH [17 / 85/ 0] br 15 ? bb.2 : bb.1\n\n2 21 OP_BC_RET [19 / 98/ 3] ret 13\n------------------------------------------------------------------------call F.1 () is evaluated, and if it is True, the implementation returns foundVirus.BB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_CALL_DIRECT [32 /160/ 0] 0 = call F.1 ()\n0 1 OP_BC_BRANCH [17 / 85/ 0] br 0 ? bb.1 : bb.2\n\n1 2 OP_BC_CALL_API [33 /168/ 3] 1 = setvirusname[4] (p.-2147483645, 2)\n1 3 OP_BC_JMP [18 / 90/ 0] jmp bb.2\n\n2 4 OP_BC_RET [19 / 98/ 3] ret 3call F.1 () returns True.call F.2 (32).Investigating Func2
\n########################################################################\n####################### Function id 2 ################################\n########################################################################\nfound a total of 4 globals\nGID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i0 unknown\n1 [ 1]: [22 x i8] unknown\n2 [ 2]: i8* unknown\n3 [ 3]: i8* unknown\n------------------------------------------------------------------------\nfound 18 values with 1 arguments and 17 locals\nVID ID VALUE\n------------------------------------------------------------------------\n0 [ 0]: i32 argument\n1 [ 1]: alloc i64\n2 [ 2]: alloc i64\n3 [ 3]: i64\n4 [ 4]: i64\n5 [ 5]: i32\n6 [ 6]: i32\n7 [ 7]: i32\n8 [ 8]: i32\n9 [ 9]: i32\n10 [ 10]: i32\n11 [ 11]: i32\n12 [ 12]: i32\n13 [ 13]: i32\n14 [ 14]: i32\n15 [ 15]: i1\n16 [ 16]: i64\n17 [ 17]: i64\n------------------------------------------------------------------------\nfound a total of 8 constants\nCID ID VALUE\n------------------------------------------------------------------------\n0 [ 18]: 0(0x0)\n1 [ 19]: 181056448(0xacab3c0)\n2 [ 20]: 3(0x3)\n3 [ 21]: 255(0xff)\n4 [ 22]: 8(0x8)\n5 [ 23]: 24(0x18)\n6 [ 24]: 1(0x1)\n7 [ 25]: 4(0x4)\n------------------------------------------------------------------------\nfound a total of 26 total values\n------------------------------------------------------------------------\nFUNCTION ID: F.2 -> NUMINSTS 22\nBB IDX OPCODE [ID /IID/MOD] INST\n------------------------------------------------------------------------\n0 0 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n0 1 OP_BC_COPY [34 /174/ 4] cp 19 -> 1\n0 2 OP_BC_JMP [18 / 90/ 0] jmp bb.1\n\n1 3 OP_BC_COPY [34 /174/ 4] cp 1 -> 3\n1 4 OP_BC_COPY [34 /174/ 4] cp 2 -> 4\n1 5 OP_BC_TRUNC [14 / 73/ 3] 5 = 3 trunc ffffffffffffffff\n1 6 OP_BC_TRUNC [14 / 73/ 3] 6 = 4 trunc ffffffffffffffff\n1 7 OP_BC_SHL [8 / 43/ 3] 7 = 6 << 20\n1 8 OP_BC_LSHR [9 / 48/ 3] 8 = 0 >> 7\n1 9 OP_BC_AND [11 / 58/ 3] 9 = 8 & 21\n1 10 OP_BC_XOR [13 / 68/ 3] 10 = 9 ^ 5\n1 11 OP_BC_SHL [8 / 43/ 3] 11 = 10 << 22\n1 12 OP_BC_LSHR [9 / 48/ 3] 12 = 5 >> 23\n1 13 OP_BC_OR [12 / 63/ 3] 13 = 11 | 12\n1 14 OP_BC_ADD [1 / 8/ 0] 14 = 6 + 24\n1 15 OP_BC_ICMP_EQ [21 /108/ 3] 15 = (14 == 25)\n1 16 OP_BC_SEXT [15 / 79/ 4] 16 = 14 sext 20\n1 17 OP_BC_SEXT [15 / 79/ 4] 17 = 13 sext 20\n1 18 OP_BC_COPY [34 /174/ 4] cp 16 -> 2\n1 19 OP_BC_COPY [34 /174/ 4] cp 17 -> 1\n1 20 OP_BC_BRANCH [17 / 85/ 0] br 15 ? bb.2 : bb.1\n\n2 21 OP_BC_RET [19 / 98/ 3] ret 13\n------------------------------------------------------------------------0 0 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n0 1 OP_BC_COPY [34 /174/ 4] cp 19 -> 1\n0 2 OP_BC_JMP [18 / 90/ 0] jmp bb.1ret 13.br 15 ? bb.2 : bb.1 shows that this block performs a loop.OP_BC_ICMP_EQ 15 = (14 == 25).0x4, it is reasonable to assume that the variable with ID 14 serves as a counter and that the loop runs four times.1 3 OP_BC_COPY [34 /174/ 4] cp 1 -> 3\n1 4 OP_BC_COPY [34 /174/ 4] cp 2 -> 4\n1 5 OP_BC_TRUNC [14 / 73/ 3] 5 = 3 trunc ffffffffffffffff\n1 6 OP_BC_TRUNC [14 / 73/ 3] 6 = 4 trunc ffffffffffffffff\n1 7 OP_BC_SHL [8 / 43/ 3] 7 = 6 << 20\n1 8 OP_BC_LSHR [9 / 48/ 3] 8 = 0 >> 7\n1 9 OP_BC_AND [11 / 58/ 3] 9 = 8 & 21\n1 10 OP_BC_XOR [13 / 68/ 3] 10 = 9 ^ 5\n1 11 OP_BC_SHL [8 / 43/ 3] 11 = 10 << 22\n1 12 OP_BC_LSHR [9 / 48/ 3] 12 = 5 >> 23\n1 13 OP_BC_OR [12 / 63/ 3] 13 = 11 | 12\n1 14 OP_BC_ADD [1 / 8/ 0] 14 = 6 + 24\n1 15 OP_BC_ICMP_EQ [21 /108/ 3] 15 = (14 == 25)\n1 16 OP_BC_SEXT [15 / 79/ 4] 16 = 14 sext 20\n1 17 OP_BC_SEXT [15 / 79/ 4] 17 = 13 sext 20\n1 18 OP_BC_COPY [34 /174/ 4] cp 16 -> 2\n1 19 OP_BC_COPY [34 /174/ 4] cp 17 -> 1\n1 20 OP_BC_BRANCH [17 / 85/ 0] br 15 ? bb.2 : bb.1OP_BC_TRUNC and OP_BC_SEXT were a little hard to interpret, but they most likely just mean bit truncation when copying an i64 variable into an i32 variable for TRUNC, and sign extension when copying an i32 variable into an i64 variable for SEXT, so in practice they can probably be treated as simple copy operations.OP_BC_LSHR. As indicated by 0 [ 0]: i32 argument, this stores the 32-bit argument received from Func1.uint32_t func2(uint32_t v0) {\n uint64_t v1 = 0xacab3c0; // v19 = 0xacab3c0\n uint64_t v2 = 0; // v18 = 0\n uint32_t v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14;\n\n for (int i = 0; i < 4; i++) {\n v3 = (uint32_t)v1;\n v4 = (uint32_t)v2;\n \n v5 = v3;\n v6 = v4;\n v7 = v6 << 3; // v20 = 0x3\n v8 = v0 >> v7;\n v9 = v8 & 0xFF; // v21 = 0xFF\n v10 = v9 ^ v5;\n v11 = v10 << 8; // v22 = 0x8\n v12 = v5 >> 24; // v23 = 0x18\n v13 = v11 | v12;\n\n v2 = (uint64_t)(v6 + 1); // v24 = 1\n v1 = (uint64_t)v13;\n }\n\n return v13;\n}Investigating Func1
\n30 [134]: 36(0x24)\n31 [135]: 1939767458(0x739e80a2)\n32 [136]: 4(0x4)\n33 [137]: 0(0x0)\n34 [138]: 4(0x4)\n35 [139]: 1(0x1)\n36 [140]: 984514723(0x3aae80a3)\n37 [141]: 4(0x4)\n38 [142]: 0(0x0)\n39 [143]: 4(0x4)\n40 [144]: 2(0x2)\n41 [145]: 1000662943(0x3ba4e79f)\n42 [146]: 4(0x4)\n43 [147]: 0(0x0)\n44 [148]: 4(0x4)\n45 [149]: 3(0x3)\n46 [150]: 2025505267(0x78bac1f3)\n47 [151]: 4(0x4)\n48 [152]: 0(0x0)\n49 [153]: 4(0x4)\n50 [154]: 4(0x4)\n51 [155]: 1593426419(0x5ef9c1f3)\n52 [156]: 4(0x4)\n53 [157]: 0(0x0)\n54 [158]: 4(0x4)\n55 [159]: 5(0x5)\n56 [160]: 1002040479(0x3bb9ec9f)\n57 [161]: 4(0x4)\n58 [162]: 0(0x0)\n59 [163]: 4(0x4)\n60 [164]: 6(0x6)\n61 [165]: 1434878964(0x558683f4)\n62 [166]: 4(0x4)\n63 [167]: 0(0x0)\n64 [168]: 4(0x4)\n65 [169]: 7(0x7)\n66 [170]: 1442502036(0x55fad594)\n67 [171]: 4(0x4)\n68 [172]: 0(0x0)\n69 [173]: 4(0x4)\n70 [174]: 8(0x8)\n71 [175]: 1824513439(0x6cbfdd9f)0x739e80a2 and 0x3aae80a3.0 0 OP_BC_GEPZ [36 /184/ 4] 5 = gepz p.4 + (104)\n0 1 OP_BC_GEPZ [36 /184/ 4] 7 = gepz p.6 + (105)\n0 2 OP_BC_CALL_API [33 /168/ 3] 8 = seek[3] (106, 107)\n0 3 OP_BC_COPY [34 /174/ 4] cp 108 -> 2\n0 4 OP_BC_JMP [18 / 90/ 0] jmp bb.2OP_BC_GEPZ is defined in bytecode_vm.c as follows.DEFINE_OP(OP_BC_GEPZ)\n{\n int64_t ptr, iptr;\n int32_t off;\n READ32(off, inst->u.three[2]);\n\n // negative values checking, valid for intermediate GEP calculations\n if (off < 0) {\n cli_dbgmsg(\"bytecode warning: found GEP with negative offset %d!\\n\", off);\n }\n\n if (!(inst->interp_op % 5)) {\n // how do negative offsets affect pointer initialization?\n WRITE64(inst->dest, ptr_compose(stackid,\n inst->u.three[1] + off));\n } else {\n READ64(ptr, inst->u.three[1]);\n off += (ptr & 0x00000000ffffffffULL);\n iptr = (ptr & 0xffffffff00000000ULL) + (uint64_t)(off);\n WRITE64(inst->dest, iptr);\n }\n break;\n}8 = seek[3] (106, 107), it skips the first 7 bytes from the start of the data being scanned. (Constant ID 106 stores 7, and constant ID 107 stores 0, which means SEEK_SET.)enum {\n /**set file position to specified absolute position */\n SEEK_SET = 0,\n /**set file position relative to current position */\n SEEK_CUR,\n /**set file position relative to file end*/\n SEEK_END\n};\n\n/**\n\\group_file\n * Changes the current file position to the specified one.\n * @sa SEEK_SET, SEEK_CUR, SEEK_END\n * @param[in] pos offset (absolute or relative depending on \\p whence param)\n * @param[in] whence one of \\p SEEK_SET, \\p SEEK_CUR, \\p SEEK_END\n * @return absolute position in file\n */\nint32_t seek(int32_t pos, uint32_t whence);SECCON{, so this is probably processing to ignore that string.0) is copied into variable ID 2, and then execution jumps to BB2.br 9 ? bb.2 : bb.3 and br 17 ? bb.7 : bb.1, we can see that some kind of conditional-branch loop processing is taking place.1 5 OP_BC_ICMP_ULT [25 /129/ 4] 9 = (18 < 109)\n1 6 OP_BC_COPY [34 /174/ 4] cp 18 -> 2\n1 7 OP_BC_BRANCH [17 / 85/ 0] br 9 ? bb.2 : bb.3\n\n2 8 OP_BC_COPY [34 /174/ 4] cp 2 -> 10\n2 9 OP_BC_SHL [8 / 44/ 4] 11 = 10 << 110\n2 10 OP_BC_ASHR [10 / 54/ 4] 12 = 11 >> 111\n2 11 OP_BC_TRUNC [14 / 73/ 3] 13 = 12 trunc ffffffffffffffff\n2 12 OP_BC_GEPZ [36 /184/ 4] 14 = gepz p.4 + (112)\n2 13 OP_BC_GEP1 [35 /179/ 4] 15 = gep1 p.14 + (13 * 65)\n2 14 OP_BC_CALL_API [33 /168/ 3] 16 = read[1] (p.15, 113)\n2 15 OP_BC_ICMP_SLT [30 /153/ 3] 17 = (16 < 114)\n2 16 OP_BC_ADD [1 / 9/ 0] 18 = 10 + 115\n2 17 OP_BC_COPY [34 /174/ 4] cp 116 -> 0\n2 18 OP_BC_BRANCH [17 / 85/ 0] br 17 ? bb.7 : bb.11 5 OP_BC_ICMP_ULT [25 /129/ 4] v9 = (v18 < 0x24)\n1 6 OP_BC_COPY [34 /174/ 4] cp v18 -> v2\n1 7 OP_BC_BRANCH [17 / 85/ 0] br 9 ? bb.2 : bb.3\n\n2 8 OP_BC_COPY [34 /174/ 4] cp v2 -> v10\n\n2 14 OP_BC_CALL_API [33 /168/ 3] v16 = read[1] (p.15, 0x1)\n2 15 OP_BC_ICMP_SLT [30 /153/ 3] v17 = (v16 < 0x1)\n2 16 OP_BC_ADD [1 / 9/ 0] v18 = v10 + 0x1\n\n2 18 OP_BC_BRANCH [17 / 85/ 0] br v17 ? bb.7 : bb.1v2 is used as a counter for a loop that runs 36 (0x24) times.read is being called, this is probably reading one character at a time from the seeked position of the scan target and repeating that 36 times.p.15 points to, but judging from the implementation of the read function, it seems to point to the destination buffer for the data being read. (Perhaps variables prefixed with p. indicate that they are treated as pointers?)/**\n\\group_file\n * Reads specified amount of bytes from the current file\n * into a buffer. Also moves current position in the file.\n * @param[in] size amount of bytes to read\n * @param[out] data pointer to buffer where data is read into\n * @return amount read.\n */\nint32_t read(uint8_t* data, int32_t size);0x7d (}), which is stored in variable ID 119.3 19 OP_BC_CALL_API [33 /168/ 3] 19 = read[1] (p.3, 117)\n3 20 OP_BC_ICMP_SGT [27 /138/ 3] 20 = (19 > 118)\n3 21 OP_BC_COPY [34 /171/ 1] cp 3 -> 21\n3 22 OP_BC_ICMP_EQ [21 /106/ 1] 22 = (21 == 119)\n3 23 OP_BC_AND [11 / 55/ 0] 23 = 20 & 22\n3 24 OP_BC_COPY [34 /174/ 4] cp 120 -> 0\n3 25 OP_BC_BRANCH [17 / 85/ 0] br 23 ? bb.4 : bb.7SECCON{<36-character string>}.4 26 OP_BC_CALL_API [33 /168/ 3] 24 = read[1] (p.3, 121)\n4 27 OP_BC_ICMP_SGT [27 /138/ 3] 25 = (24 > 122)\n4 28 OP_BC_COPY [34 /174/ 4] cp 123 -> 1\n4 29 OP_BC_COPY [34 /174/ 4] cp 124 -> 0\n4 30 OP_BC_BRANCH [17 / 85/ 0] br 25 ? bb.7 : bb.5}.OP_BC_ICMP_ULT 42 = (41 < 134)) is 36 (0x24), but the constant ID 133 added to the counter in each loop is 4 (0x4), so this loop appears to run 9 times.5 31 OP_BC_COPY [34 /174/ 4] cp 1 -> 26\n5 32 OP_BC_SHL [8 / 44/ 4] 27 = 26 << 125\n5 33 OP_BC_ASHR [10 / 54/ 4] 28 = 27 >> 126\n5 34 OP_BC_TRUNC [14 / 73/ 3] 29 = 28 trunc ffffffffffffffff\n5 35 OP_BC_GEPZ [36 /184/ 4] 30 = gepz p.4 + (127)\n5 36 OP_BC_GEP1 [35 /179/ 4] 31 = gep1 p.30 + (29 * 65)\n5 37 OP_BC_LOAD [39 /198/ 3] load 32 <- p.31\n5 38 OP_BC_CALL_DIRECT [32 /163/ 3] 33 = call F.2 (32)\n5 39 OP_BC_SHL [8 / 44/ 4] 34 = 26 << 128\n5 40 OP_BC_ASHR [10 / 54/ 4] 35 = 34 >> 129\n5 41 OP_BC_TRUNC [14 / 73/ 3] 36 = 35 trunc ffffffffffffffff\n5 42 OP_BC_MUL [3 / 18/ 0] 37 = 130 * 131\n5 43 OP_BC_GEP1 [35 /179/ 4] 38 = gep1 p.7 + (37 * 65)\n5 44 OP_BC_MUL [3 / 18/ 0] 39 = 132 * 36\n5 45 OP_BC_GEP1 [35 /179/ 4] 40 = gep1 p.38 + (39 * 65)\n5 46 OP_BC_STORE [38 /193/ 3] store 33 -> p.40\n5 47 OP_BC_ADD [1 / 9/ 0] 41 = 26 + 133\n5 48 OP_BC_ICMP_ULT [25 /129/ 4] 42 = (41 < 134)\n5 49 OP_BC_COPY [34 /174/ 4] cp 41 -> 1\n5 50 OP_BC_BRANCH [17 / 85/ 0] br 42 ? bb.5 : bb.6p.4, referenced by OP_BC_GEPZ 30 = gepz p.4 + (127) on an earlier line, appears to be the same one used when obtaining the pointer to where the input characters are stored.OP_BC_STORE store 33 -> p.40, at the pointer address obtained from OP_BC_GEP1 38 = gep1 p.7 + (37 * 65).p.7 are compared in order against the nine integer values confirmed earlier, such as 0x739e80a2, and it appears to return 1 only if all checks succeed.{[ ... (omitted) ]}\n6 100 OP_BC_ICMP_EQ [21 /108/ 3] 92 = (91 == 170)\n6 101 OP_BC_AND [11 / 55/ 0] 93 = 86 & 92\n6 102 OP_BC_MUL [3 / 18/ 0] 94 = 171 * 172\n6 103 OP_BC_GEP1 [35 /179/ 4] 95 = gep1 p.7 + (94 * 65)\n6 104 OP_BC_MUL [3 / 18/ 0] 96 = 173 * 174\n6 105 OP_BC_GEP1 [35 /179/ 4] 97 = gep1 p.95 + (96 * 65)\n6 106 OP_BC_LOAD [39 /198/ 3] load 98 <- p.97\n6 107 OP_BC_ICMP_EQ [21 /108/ 3] 99 = (98 == 175)\n6 108 OP_BC_AND [11 / 55/ 0] 100 = 93 & 99\n6 109 OP_BC_SEXT [15 / 79/ 4] 101 = 100 sext 1\n6 110 OP_BC_COPY [34 /174/ 4] cp 101 -> 0\n6 111 OP_BC_JMP [18 / 90/ 0] jmp bb.7SECCON{<36 characters>}, extract the 36 characters inside the Flag as 32-bit integers four characters at a time, run them through Func2, and compare the results against hardcoded integer values.Creating a Solver to Identify the Flag
\nfrom z3 import *\n\ns = Solver()\n\nv0 = BitVec(f\"v0\", 32) # i32 argument\nv1, v2 = BitVec(\"v1\", 64), BitVec(\"v2\", 64) # v18 = 0 v19 = 0xacab3c0\n\nfor i in range(4):\n v3 = Extract(31,0,v1)\n v4 = Extract(31,0,v2)\n\n v5 = v3\n v6 = v4\n v7 = v6 << 0x3 # v20 = 0x3\n v8 = v0 >> v7 # Extend v0 to 64 bits to match operations\n v9 = v8 & 0xFF # v21 = 0xFF\n v10 = v9 ^ v5\n v11 = v10 << 0x8 # v22 = 0x8\n v12 = v5 >> 0x18 # v23 = 0x18\n v13 = v11 | v12\n\n v14 = v6 + 1 # v24 = 1\n v2 = v14 # v16\n v1 = v13 # v17\n\nans = v13\nprint(ans)\n\ns.add(v1 == 0xacab3c0)\ns.add(v2 == 0)\ns.add(ans == 1939767458)\n\nif s.check() == sat:\n m = s.model()\n print(m)ctypes.import ctypes\n\ndef func2(v0):\n v1 = ctypes.c_uint64(0xacab3c0) # v19 = 0xacab3c0\n v2 = ctypes.c_uint64(0) # v18 = 0\n \n v3 = ctypes.c_uint32(0)\n v4 = ctypes.c_uint32(0)\n v5 = ctypes.c_uint32(0)\n v6 = ctypes.c_uint32(0)\n v7 = ctypes.c_uint32(0)\n v8 = ctypes.c_uint32(0)\n v9 = ctypes.c_uint32(0)\n v10 = ctypes.c_uint32(0)\n v11 = ctypes.c_uint32(0)\n v12 = ctypes.c_uint32(0)\n v13 = ctypes.c_uint32(0)\n \n for i in range(4):\n v3.value = ctypes.c_uint32(v1.value & 0xFFFFFFFF).value\n v4.value = ctypes.c_uint32(v2.value & 0xFFFFFFFF).value\n \n v5.value = v3.value\n v6.value = v4.value\n \n v7.value = v6.value << 3 # v20 = 0x3\n v8.value = v0 >> v7.value\n v9.value = v8.value & 0xFF # v21 = 0xFF\n v10.value = v9.value ^ v5.value\n v11.value = v10.value << 8 # v22 = 0x8\n v12.value = v5.value >> 24 # v23 = 0x18\n v13.value = v11.value | v12.value\n \n v2.value = ctypes.c_uint64(v6.value + 1).value # v24 = 1\n v1.value = ctypes.c_uint64(v13.value).value\n \n return v13.value\n\nans = [0x739e80a2,0x3aae80a3,0x3ba4e79f,0x78bac1f3,0x5ef9c1f3,0x3bb9ec9f,0x558683f4,0x55fad594,0x6cbfdd9f]\nflag = [\"\" for i in range(9)]\nfor a in range(0x21,0x7e):\n for b in range(0x21,0x7e):\n for c in range(0x21,0x7e):\n for d in range(0x21,0x7e):\n res = func2(\n a << 24 | b << 16 | c << 8 | d\n )\n if res in ans:\n flag[ans.index(res)] = chr(d) + chr(c) + chr(b) + chr(a)\n print(flag)\n\nprint(\"SECCON{\" + \"\".join(flag) + \"}\")ctypes, but I was still able to identify the correct Flag using this solver.